Probleme Virus

Salut,
en faite je n'arrete pas d'avoir des pub meme avec mozilla firefox et aussi les pages internet plantes souvent et mon ordi est devenu lent.
J'ai fais des scan avec Nod32, Ad Aware,Spybot.. Ad aware et Spybot trouvent des truc et les supprimes mais les pub etc.. continuent et Nod32 me trouvent des virus mais ne me les enlevent pas..

Quelqu'un s'aurrait m'aider?

Voila comme tu peux le voir j'ai essayer plein d'antivirus xD

Logfile of HijackThis v1.99.1
Scan saved at 2:13:41 PM, on 5/31/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NavNT\rtvscan.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\ESET\nod32kui.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O2 - BHO: (no name) - {C7615447-AB30-4365-8853-E550AC33ACA7} - C:\WINDOWS\System32\ssqpn.dll
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: ssqpn - C:\WINDOWS\System32\ssqpn.dll
O20 - Winlogon Notify: __c0042E93 - C:\WINDOWS\System32\__c0042E93.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Voila desole de repondre seulement maintenant mais je suis a Los Angeles et avec le decalage horaire..

Bon voila le rapport Vundo:


VundoFix V6.4.1

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 8:30:28 AM 6/1/2007

Listing files found while scanning....

C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\System32\npqss.bak2
C:\WINDOWS\System32\npqss.ini
C:\WINDOWS\System32\npqss.ini2
C:\WINDOWS\System32\ssqpn.dll
C:\WINDOWS\System32\unfyrlio.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\npqss.bak1
C:\WINDOWS\system32\npqss.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\System32\npqss.bak2
C:\WINDOWS\System32\npqss.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\npqss.ini
C:\WINDOWS\System32\npqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\npqss.ini2
C:\WINDOWS\System32\npqss.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\ssqpn.dll
C:\WINDOWS\System32\ssqpn.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...



Et voila le rapport Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 11:28:54 AM, on 6/1/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NavNT\rtvscan.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O2 - BHO: (no name) - {BCFF752E-A929-42F9-A957-A52496BD4FB9} - C:\WINDOWS\System32\ssqpn.dll
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: ssqpn - C:\WINDOWS\System32\ssqpn.dll
O20 - Winlogon Notify: __c0042E93 - C:\WINDOWS\System32\__c0042E93.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe

Je fais quoi maintenant?

EN faite sa a redemarrer mais apres ca a plante..
donc je recommence et je remets les 2 rapports? (celui de Vundo et Hijack)

Voila j'ai refais un scan apres il m'a proposer de redemarrer j'ai redemarrer et puis quand il a redemarrer il a continuer de marquer
Could not be deleted
et puis il m'a proposer de redemarrer et que quand j'aurais redemarrer je devrais clicker sur remove.. mais quand j'ai redemarrer dans la liste des objets detectes il n'y avait plus rien a supprimer..

Enfin voila le rapport de Vundo:


VundoFix V6.4.1

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 3:01:59 PM 6/1/2007

Listing files found while scanning....

C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\System32\ssqpn.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\system32\npqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\ssqpn.dll
C:\WINDOWS\System32\ssqpn.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\npqss.ini
C:\WINDOWS\system32\npqss.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\ssqpn.dll
C:\WINDOWS\System32\ssqpn.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Et le rapport Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 7:37:58 PM, on 6/1/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\CTFMON.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NavNT\rtvscan.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O2 - BHO: (no name) - {A2DAF30D-E48F-427F-8D2C-86A15D8D8976} - C:\WINDOWS\System32\ssqpn.dll
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\avgfwafu.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: ssqpn - C:\WINDOWS\System32\ssqpn.dll
O20 - Winlogon Notify: __c0042E93 - C:\WINDOWS\System32\__c0042E93.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Voila le rapport ComboFix:

"Phuong Nguyen" - 2007-06-02 10:41:29 Service Pack 1
ComboFix 07-05.27.BV - Running from: "C:\Documents and Settings\Phuong Nguyen\Desktop\"


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\ssqpn.dll
C:\WINDOWS\system32\npqss.ini


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


"C:\WINDOWS\system32\linkprd.exe"

-- Purity Folders:

C:\WINDOWS\system32\FNTS~1
C:\DOCUME~1\PHUONG~1\MYDOCU~1\TSKS~1



((((((((((((((((((((((((((((((( Files Created from 2007-05-02 to 2007-06-02 ))))))))))))))))))))))))))))))))))


2007-06-02 10:43 131,124 --a------ C:\WINDOWS\system32\fjrgpooy.dll
2007-06-02 10:43 1,583,854 ---hs---- C:\WINDOWS\system32\npqss.bak1
2007-06-01 12:44 <DIR> d-------- C:\Program Files\SopCast
2007-06-01 08:30 <DIR> d-------- C:\VundoFix Backups
2007-05-31 14:09 <DIR> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-05-30 16:07 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-05-30 16:07 <DIR> d-------- C:\Program Files\Alwil Software
2007-05-30 15:09 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-05-29 22:27 <DIR> d-------- C:\Program Files\SPYWAREfighter
2007-05-29 22:27 <DIR> d-------- C:\Program Files\Common Files\Application
2007-05-29 22:09 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-05-29 22:05 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-05-29 17:45 <DIR> d-------- C:\DOCUME~1\PHUONG~1\APPLIC~1\Google
2007-05-29 17:45 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-05-29 17:44 <DIR> d-------- C:\Program Files\Google
2007-05-29 11:24 <DIR> d-------- C:\Program Files\a-squared Free
2007-05-29 10:25 14,390 --a------ C:\syspuan.exe
2007-05-27 13:01 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-05-27 12:17 <DIR> d-------- C:\WINDOWS\CSC
2007-05-27 12:15 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-05-27 11:03 258 --a------ C:\xcrashdump.dat
2007-05-25 22:40 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-05-25 22:40 298,104 --a------ C:\WINDOWS\system32\imon.dll
2007-05-25 22:40 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-05-25 20:51 36,352 --a------ C:\WINDOWS\system32\__c00CF001.dat
2007-05-25 20:51 36,352 --a------ C:\WINDOWS\system32\__c00BC4C4.dat
2007-05-25 20:51 36,352 --a------ C:\WINDOWS\system32\__c006D4D9.dat
2007-05-25 20:51 36,352 --a------ C:\WINDOWS\system32\__c0042E93.dat
2007-05-24 21:21 28,256 --a------ C:\WINDOWS\system32\drivers\MxlW2k.sys
2007-05-23 22:23 <DIR> d-------- C:\Program Files\Ahead
2007-05-04 11:51 108,544 --a------ C:\WINDOWS\system32\pxcpyi64.exe
2007-05-04 11:51 104,960 --a------ C:\WINDOWS\system32\pxinsi64.exe
2007-05-04 11:50 89,088 --a------ C:\WINDOWS\system32\atl71.dll
2007-05-04 11:50 1,047,552 --a------ C:\WINDOWS\system32\mfc71u.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-02 17:19:32 36,352 ----a-w C:\WINDOWS\system32\__c0042E93.dat
2007-06-02 02:37:46 -------- d-----w C:\Program Files\Hijackthis Version Française
2007-06-01 20:08:55 -------- d-----w C:\Program Files\PowerArchiver
2007-05-26 03:51:20 36,352 ----a-w C:\WINDOWS\system32\__c006D4D9.dat
2007-05-24 06:07:54 -------- d-----w C:\Program Files\EPSON Print CD
2007-05-06 01:23:42 -------- d-----w C:\Program Files\Dictionnaire
2007-05-04 18:51:04 -------- d-----w C:\Program Files\MUSICMATCH
2007-05-04 18:50:56 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-04-10 07:04:38 -------- d-----w C:\Program Files\YouTUBE (TM) movie downloader
2007-04-05 20:38:35 -------- d-----w C:\DOCUME~1\PHUONG~1\APPLIC~1\Lavasoft
2007-04-05 20:38:15 -------- d-----w C:\Program Files\Lavasoft
2007-04-05 19:13:26 346 ----a-w C:\Program Files\mpc4.reg
2007-04-05 19:13:26 3,476 ----a-w C:\Program Files\mpc7.reg
2007-04-05 19:13:26 18,156 ----a-w C:\Program Files\mpc6.reg
2007-04-05 19:13:26 16,296 ----a-w C:\Program Files\mpc5.reg
2007-04-05 19:13:25 7,644 ----a-w C:\Program Files\ffdssetts.reg
2007-04-05 19:13:25 680 ----a-w C:\Program Files\mpc2.reg
2007-04-05 19:13:25 596 ----a-w C:\Program Files\mpc1.reg
2007-04-05 19:13:25 3,490 ----a-w C:\Program Files\ffdsasetts.reg
2007-04-05 19:13:25 3,026 ----a-w C:\Program Files\mpc3.reg
2007-04-05 19:10:22 -------- d-----w C:\DOCUME~1\PHUONG~1\APPLIC~1\Media Player Classic
2007-04-05 19:08:42 -------- d-----w C:\Program Files\Satsuki Decoder Pack
2007-04-05 19:02:58 -------- d-----w C:\Program Files\ffdshow
2007-04-04 17:11:05 -------- d-----w C:\Program Files\Messenger Plus! Live
2007-04-04 17:11:04 -------- d-----w C:\Program Files\MSN Messenger
2007-04-04 02:23:27 -------- d-----w C:\Program Files\LimeWire
2007-03-13 16:09:00 56,360 ----a-w C:\WINDOWS\system32\WBHELP2.DLL


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2006-12-03 14:19]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 13:05]
"Genuine"="C:\WINDOWS\System32\fjrgpooy.dll" [2007-06-02 10:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-29 17:44]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2006-07-29 19:34]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2003-09-30 17:00]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c0042E93]
C:\WINDOWS\System32\__c0042E93.dat

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Usnsvc usnsvc

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*


********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-02 10:45:27
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\yoopgrjf.ini

scan completed successfully
hidden files: 1


********************************************************************

Completion time: 2007-06-02 10:46:40 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-02 10:46

--- E O F ---


Et Voila le rapport Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 10:51:36 AM, on 6/2/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NavNT\rtvscan.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\SPYWAREfighter\spftray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [Genuine] rundll32.exe "C:\WINDOWS\System32\fjrgpooy.dll",realset
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O20 - Winlogon Notify: __c0042E93 - C:\WINDOWS\System32\__c0042E93.dat
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe

Voila j'ai fais ce que tu as dis
maintenant voila le rapport OTMoveIt:

DllUnregisterServer procedure not found in C:\WINDOWS\System32\fjrgpooy.dll
C:\WINDOWS\System32\fjrgpooy.dll NOT unregistered.
C:\WINDOWS\System32\fjrgpooy.dll moved successfully.
C:\WINDOWS\system32\yoopgrjf.ini moved successfully.
File move failed. C:\WINDOWS\system32\__c0042E93.dat scheduled to be moved on reboot.
C:\WINDOWS\system32\__c006D4D9.dat moved successfully.
File/Folder C:\WINDOWS\system32\__c006D4D9.dat not found.
C:\WINDOWS\system32\__c00CF001.dat moved successfully.
C:\WINDOWS\system32\__c00BC4C4.dat moved successfully.
C:\WINDOWS\system32\npqss.bak1 moved successfully.

Created on 06/02/2007 15:15:26

Et voila le rapport Hijack:

Logfile of HijackThis v1.99.1
Scan saved at 3:23:56 PM, on 6/2/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SPYWAREfighter\spftray.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\NavNT\rtvscan.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\System32\MsgSys.EXE
C:\Program Files\ESET\nod32kui.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\NavNT\rtvscan.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe

Salut j'ai fais l'analyse et apparement ya encore des virus tien voila le rapport:

KASPERSKY ON-LINE SCANNER REPORT
Monday, June 04, 2007 2:41:33 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 4/06/2007
Enregistrements dans la base antivirus Kaspersky : 318426
Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai
Cible de l'analyse Poste de travail
C:\
D:\
E:\
Statistiques de l'analyse
Total d'objets analysés 46254
Nombre de virus trouvés 13
Nombre d'objets infectés 38 / 0
Nombre d'objets suspects 12
Durée de l'analyse 01:43:08

Nom de l'objet infecté Nom du virus Dernière action
C:\Documents and Settings\All Users\Application Data\McAfee.com\Agent\Logs\TaskScheduler\McTskshd002.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\054C0000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\054C0001.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05F40000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05F40001.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05F80000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05F80001.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\05F80002.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06080000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06080001.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06080002.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\060C0000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06100000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06100001.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06100002.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06180000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06180001.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\061C0000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\061C0001.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06200000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\06A40000.VBN Infecté : Trojan-Downloader.Win32.VB.att ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\07E40000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08CC0000.VBN Infecté : Trojan-Downloader.JS.Agent.hj ignoré
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\08D80000.VBN Infecté : Trojan.Win32.BHO.g ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Messenger\style-fr@hotmail.com\SharingMetadata\Logs\Dfsr.log L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Messenger\style-fr@hotmail.com\SharingMetadata\pending.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Messenger\style-fr@hotmail.com\SharingMetadata\Working\database_E0CC_FB6F_CCFB_3E7A\dfsr.db L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Messenger\style-fr@hotmail.com\SharingMetadata\Working\database_E0CC_FB6F_CCFB_3E7A\fsr.log L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Messenger\style-fr@hotmail.com\SharingMetadata\Working\database_E0CC_FB6F_CCFB_3E7A\fsrtmp.log L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Messenger\style-fr@hotmail.com\SharingMetadata\Working\database_E0CC_FB6F_CCFB_3E7A\tmp.edb L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Windows Live Contacts\style-fr@hotmail.com\real\members.stg L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Application Data\Microsoft\Windows Live Contacts\style-fr@hotmail.com\shadow\members.stg L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\History\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\History\History.IE5\MSHist012007060420070605\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Temp\~DF42F7.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Temp\~DF4304.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Temp\~DF690C.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Temp\~DF6919.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\My Documents\Mes Historiques de Conversation\June 2007\asturiano4000@hotmail.com.html L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\My Documents\Mes Historiques de Conversation\June 2007\barby_sasou05@hotmail.com.html L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\Phuong Nguyen\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Program Files\Common Files\Symantec Shared\VirusDefs\20070530.041\0021NAV~.TMP L'objet est verrouillé ignoré
C:\Program Files\ESET\cache\CACHE.NDB L'objet est verrouillé ignoré
C:\Program Files\ESET\infected\0UPSLXCA.NQF Infecté : not-virus:Hoax.Win32.Renos.he ignoré
C:\Program Files\ESET\infected\5ZP32WCA.NQF/EXE-file Suspect : Packed.Win32.Morphine.a ignoré
C:\Program Files\ESET\infected\5ZP32WCA.NQF Embedded EXE: suspect - 1 ignoré
C:\Program Files\ESET\infected\5ZP32WCA.NQF PE-Crypt.XorPE: suspect - 1 ignoré
C:\Program Files\ESET\infected\C5AD42CA.NQF Infecté : Trojan-Spy.Win32.VBStat.h ignoré
C:\Program Files\ESET\infected\HKQ52VDA.NQF/EXE-file Suspect : Packed.Win32.Morphine.a ignoré
C:\Program Files\ESET\infected\HKQ52VDA.NQF Embedded EXE: suspect - 1 ignoré
C:\Program Files\ESET\infected\HKQ52VDA.NQF PE-Crypt.XorPE: suspect - 1 ignoré
C:\Program Files\ESET\infected\JNMUWNBA.NQF Infecté : Trojan-Downloader.Win32.VB.awk ignoré
C:\Program Files\ESET\infected\OCG5ZQAA.NQF Infecté : Trojan-Downloader.Win32.VB.awk ignoré
C:\Program Files\ESET\infected\PMRG1DAA.NQF Infecté : Trojan-Downloader.Win32.PurityScan.dx ignoré
C:\Program Files\ESET\logs\virlog.dat L'objet est verrouillé ignoré
C:\Program Files\ESET\logs\warnlog.dat L'objet est verrouillé ignoré
C:\Program Files\SPYWAREfighter\spf.dat L'objet est verrouillé ignoré
C:\Program Files\SPYWAREfighter\spf.log L'objet est verrouillé ignoré
C:\syspuan.exe Infecté : Trojan-Downloader.Win32.Agent.bnn ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP454\A0043166.exe/stream/data0001/01.exe Infecté : Packed.Win32.PolyCrypt.b ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP454\A0043166.exe/stream/data0001 Infecté : Packed.Win32.PolyCrypt.b ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP454\A0043166.exe/stream Infecté : Packed.Win32.PolyCrypt.b ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP454\A0043166.exe NSIS: infecté - 3 ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP466\A0050036.exe/data.rar/patch.exe Infecté : Trojan.Win32.Agent.qt ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP466\A0050036.exe/data.rar/crack.exe Infecté : Trojan.Win32.Inject.br ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP466\A0050036.exe/data.rar/install.exe Infecté : Trojan-Downloader.Win32.Small.eqn ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP466\A0050036.exe/data.rar Infecté : Trojan-Downloader.Win32.Small.eqn ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP466\A0050036.exe RarSFX: infecté - 4 ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP468\A0054345.exe/EXE-file Suspect : Packed.Win32.Morphine.a ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP468\A0054345.exe Embedded EXE: suspect - 1 ignoré
C:\System Volume Information\_restore{3BC079CD-3D8C-457A-BABC-9B27620B97E9}\RP476\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\oakley.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\_OTMoveIt\MovedFiles\WINDOWS\System32\__c0042E93.dat Suspect : Packed.Win32.Morphine.a ignoré
C:\_OTMoveIt\MovedFiles\WINDOWS\System32\__c006D4D9.dat Suspect : Packed.Win32.Morphine.a ignoré
C:\_OTMoveIt\MovedFiles\WINDOWS\System32\__c00BC4C4.dat Suspect : Packed.Win32.Morphine.a ignoré
C:\_OTMoveIt\MovedFiles\WINDOWS\System32\__c00CF001.dat Suspect : Packed.Win32.Morphine.a ignoré
Analyse terminée.

Qu'est-ce que je dois faire maintenant?

Salut desole de repondre seulement maintenant mais j'ai pas eu beaucoup le temps..

Les pages internet ne plantent plus aussi souvent et je n'ai plus autant de pub mais j'en ai encore de temps en temps mais mon ordi mets beaucoup de temps a s'eteindre..

J'ai fais ce que tu as dit mais le pc met toujours beaucoup de temps a s'eteindre et la sa fais deja 2 fois que quand j'allume le pc il prends du temps pour demarrer et une fois sur windows il me met un message windows a planter un truc comme ca..

Je te mets le rapport:

Desole encore une fois de repondre que maintenant..

Le rapport:

DiagHelp version v1.1.2 - http://www.malekal.com
excute le Tue 06/19/2007 à 9:24:59.29


Liste des derniers fichies modifies/crees dans windir\system32
C:\WINDOWS\System32/drivers\MxlW2k.sys -->5/27/2007 10:35:51 PM
C:\WINDOWS\System32/drivers\amon.sys -->5/25/2007 10:40:04 PM
C:\WINDOWS\System32/drivers\nod32drv.sys -->5/25/2007 10:40:03 PM
C:\WINDOWS\System32/drivers\pxhelp20.sys -->2/7/2007 10:35:00 PM
C:\WINDOWS\System32/drivers\afc.sys -->2/23/2005 3:58:56 PM
C:\WINDOWS\System32/drivers\wpdusb.sys -->1/28/2005 1:36:24 AM
C:\WINDOWS\System32/drivers\ALCXWDM.SYS -->11/17/2004 4:05:38 AM

C:\WINDOWS\System32\wpa.dbl -->6/16/2007 12:03:31 PM
C:\WINDOWS\System32\FNTCACHE.DAT -->6/11/2007 10:59:02 PM
C:\WINDOWS\System32\perfh009.dat -->6/2/2007 10:46:40 AM
C:\WINDOWS\System32\perfc009.dat -->6/2/2007 10:46:40 AM
C:\WINDOWS\System32\PerfStringBackup.INI -->6/2/2007 10:46:39 AM
C:\WINDOWS\System32\CONFIG.NT -->6/2/2007 10:39:35 AM
C:\WINDOWS\System32\imon1.dat -->6/1/2007 12:04:04 AM
C:\WINDOWS\System32\zllictbl.dat -->5/29/2007 10:09:49 PM
C:\WINDOWS\System32\MobileSidewalk.ico -->5/27/2007 11:12:05 AM
C:\WINDOWS\System32\imon.dll -->5/25/2007 10:40:05 PM
C:\WINDOWS\System32\runmdvyw.ini -->5/25/2007 10:32:21 AM
C:\WINDOWS\System32\GameFly_2.ico -->5/24/2007 12:24:55 PM
C:\WINDOWS\System32\ClickToFindandFixErrors_RON_Intl.ico -->5/24/2007 1:11:38 AM
C:\WINDOWS\System32\ssldivx.dll -->4/22/2007 5:15:18 PM
C:\WINDOWS\System32\libdivx.dll -->4/22/2007 5:15:18 PM
C:\WINDOWS\System32\satsukidecodersettings.ini -->4/5/2007 12:08:42 PM
C:\WINDOWS\System32\nscompat.tlb -->4/5/2007 11:53:24 AM
C:\WINDOWS\System32\amcompat.tlb -->4/5/2007 11:53:24 AM
C:\WINDOWS\System32\jupdate-1.5.0_03-b07.log -->4/3/2007 7:23:16 PM
C:\WINDOWS\System32\E_FCF0BNA.UCFE_FCF0BNA.UCF -->3/27/2007 10:44:32 PM
C:\WINDOWS\System32\E_FCF0BNA.UCF -->3/27/2007 10:44:32 PM
C:\WINDOWS\System32\WBOCX.OCX -->3/13/2007 9:09:00 AM
C:\WINDOWS\System32\WBHELP2.DLL -->3/13/2007 9:09:00 AM
C:\WINDOWS\System32\ff_vfw.dll -->2/21/2007 1:00:28 PM
C:\WINDOWS\System32\pxcpyi64.exe -->2/7/2007 10:35:29 PM

C:\WINDOWS\0.log -->6/19/2007 6:01:02 AM
C:\WINDOWS\bootstat.dat -->6/19/2007 6:00:02 AM
C:\WINDOWS\SchedLgU.Txt -->6/17/2007 12:07:02 PM
C:\WINDOWS\setupapi.log -->6/17/2007 11:39:23 AM
C:\WINDOWS\ODBC.INI -->6/11/2007 10:57:20 PM
C:\WINDOWS\win.ini -->6/11/2007 10:57:07 PM
C:\WINDOWS\cdPlayer.ini -->4/13/2007 12:17:26 AM
C:\WINDOWS\VPC32.INI -->4/9/2007 6:48:14 PM
C:\WINDOWS\WMSysPr9.prx -->4/5/2007 11:51:44 AM
C:\WINDOWS\EPSPR260.ini -->3/27/2007 10:09:19 PM
C:\WINDOWS\EPSMTL32.TXT -->3/27/2007 10:00:47 PM
C:\WINDOWS\mozver.dat -->1/7/2007 9:17:48 PM
C:\WINDOWS\winamp.ini -->8/24/2006 9:19:42 PM
C:\WINDOWS\WMSysPrx.prx -->1/29/2006 8:25:07 PM
C:\WINDOWS\nsreg.dat -->3/15/2005 8:30:41 PM


Volume in drive C has no label.
Volume Serial Number is CCFB-3E7A

Directory of C:\WINDOWS\system32

09/30/2003 05:00 PM 4,096 csrss.exe
1 File(s) 4,096 bytes
0 Dir(s) 67,991,425,024 bytes free

Contenu de Downloaded Program Files
Volume in drive C has no label.
Volume Serial Number is CCFB-3E7A

Directory of C:\WINDOWS\Downloaded Program Files

06/04/2007 10:01 PM <DIR> .
06/04/2007 10:01 PM <DIR> ..
03/15/2005 12:32 PM 65 desktop.ini
10/14/1997 07:52 PM 697 DirectAnimation Java Classes.osd
08/08/2006 11:45 AM 576 kavwebscan.inf
01/20/2000 04:25 PM 1,162 Microsoft XML Parser for Java.osd
10/08/2004 04:01 PM 372,736 MsnPUpld.dll
10/08/2004 04:13 PM 587 MSNPupld.inf
09/22/2004 03:59 PM 110,592 PURen-us.dll
10/15/2004 07:59 AM 110,592 PURfr-xx.dll
11/09/2006 02:36 PM 5,019 swflash.inf
9 File(s) 602,026 bytes

Total Files Listed:
9 File(s) 602,026 bytes
2 Dir(s) 67,991,425,024 bytes free

Recherche de rootkit! (Merci S!Ri)

Recherche d'infections connues

Export des clefs sensibles..

Liste des fichiers en exception sur le pare-feu XP SP2

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\uusee\\UUSeePlayer.exe"="C:\\Program Files\\uusee\\UUSeePlayer.exe:*:Enabled:UUSEE"

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Export de la clef SharedTaskScheduler

[SharedTaskScheduler]

Rechercher adresses sensibles dans le fichier HOSTS...



catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-19 09:25:14
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden files ...

scan completed successfully
hidden files: 0


KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Process list by traversal of KiWaitListHead

4 - System
240 - ctfmon.exe
492 - csrss.exe
516 - winlogon.exe
568 - services.exe
580 - lsass.exe
752 - svchost.exe
812 - svchost.exe
992 - svchost.exe
1248 - alg.exe
1380 - nod32krn.exe
1396 - rtvscan.exe
1464 - explorer.exe
1508 - GoogleUpdater.e
1872 - IEXPLORE.EXE
1932 - spfprc.exe
2036 - MSGSYS.EXE
2816 - msnmsgr.exe
3008 - nod32kui.exe
3244 - IEXPLORE.EXE
3760 - svchost.exe
4076 - cmd.exe

Total number of processes = 22
NOTE: Under WinXP, this will not show all processes.

KProcCheck Version 0.2-beta1 Proof-of-Concept by SIG^2 (www.security.org.sg)

Driver/Module list by traversal of PsLoadedModuleList

804D4000 - \WINDOWS\system32\ntoskrnl.exe
806AB000 - \WINDOWS\system32\hal.dll
F7D2E000 - \WINDOWS\system32\KDCOM.DLL
F7C3E000 - \WINDOWS\system32\BOOTVID.dll
F77E1000 - ACPI.sys
F7D30000 - \WINDOWS\System32\DRIVERS\WMILIB.SYS
F782E000 - pci.sys
F783E000 - isapnp.sys
F7DF6000 - pciide.sys
F7AAE000 - \WINDOWS\System32\DRIVERS\PCIIDEX.SYS
F784E000 - MountMgr.sys
F77C2000 - ftdisk.sys
F7D32000 - dmload.sys
F779E000 - dmio.sys
F7AB6000 - PartMgr.sys
F785E000 - VolSnap.sys
F7788000 - atapi.sys
F786E000 - disk.sys
F787E000 - \WINDOWS\System32\DRIVERS\CLASSPNP.SYS
F7777000 - sr.sys
F7ABE000 - PxHelp20.sys
F7763000 - KSecDD.sys
F76D9000 - Ntfs.sys
F76B0000 - NDIS.sys
F7696000 - Mup.sys
F7AC6000 - agp440.sys
F7B36000 - \SystemRoot\System32\DRIVERS\processr.sys
F75FE000 - \SystemRoot\System32\DRIVERS\ati2mtaa.sys
F75EC000 - \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS
F7B3E000 - \SystemRoot\System32\DRIVERS\usbuhci.sys
F75CA000 - \SystemRoot\System32\DRIVERS\USBPORT.SYS
F7B46000 - \SystemRoot\System32\DRIVERS\usbehci.sys
F75B8000 - \SystemRoot\System32\DRIVERS\Rtlnicxp.sys
F79EE000 - \SystemRoot\System32\DRIVERS\i8042prt.sys
F7B56000 - \SystemRoot\System32\DRIVERS\kbdclass.sys
F7B5E000 - \SystemRoot\System32\DRIVERS\fdc.sys
F79FE000 - \SystemRoot\System32\DRIVERS\serial.sys
F7D02000 - \SystemRoot\System32\DRIVERS\serenum.sys
F75A5000 - \SystemRoot\System32\DRIVERS\parport.sys
F7A0E000 - \SystemRoot\System32\DRIVERS\imapi.sys
F7B66000 - \SystemRoot\system32\drivers\Afc.sys
F7B6E000 - \SystemRoot\system32\drivers\iviaspi.sys
F7D0A000 - \SystemRoot\system32\drivers\pfc.sys
F7B76000 - \SystemRoot\System32\Drivers\MxlW2k.SYS
F7A1E000 - \SystemRoot\System32\DRIVERS\cdrom.sys
F7A2E000 - \SystemRoot\System32\DRIVERS\redbook.sys
F7584000 - \SystemRoot\System32\DRIVERS\ks.sys
F7353000 - \SystemRoot\system32\drivers\ALCXWDM.SYS
F7332000 - \SystemRoot\system32\drivers\portcls.sys
F7A3E000 - \SystemRoot\system32\drivers\drmk.sys
F7E72000 - \SystemRoot\System32\DRIVERS\audstub.sys
F7A4E000 - \SystemRoot\System32\DRIVERS\rasl2tp.sys
F7D16000 - \SystemRoot\System32\DRIVERS\ndistapi.sys
F731C000 - \SystemRoot\System32\DRIVERS\ndiswan.sys
F7A5E000 - \SystemRoot\System32\DRIVERS\raspppoe.sys
F7A6E000 - \SystemRoot\System32\DRIVERS\raspptp.sys
F7D1A000 - \SystemRoot\System32\DRIVERS\TDI.SYS
F730B000 - \SystemRoot\System32\DRIVERS\psched.sys
F7A7E000 - \SystemRoot\System32\DRIVERS\msgpc.sys
F7B7E000 - \SystemRoot\System32\DRIVERS\ptilink.sys
F7B86000 - \SystemRoot\System32\DRIVERS\raspti.sys
F6F24000 - \SystemRoot\System32\DRIVERS\rdpdr.sys
F7A9E000 - \SystemRoot\System32\DRIVERS\termdd.sys
F7B8E000 - \SystemRoot\System32\DRIVERS\mouclass.sys
F7EBB000 - \SystemRoot\System32\DRIVERS\swenum.sys
F6EDA000 - \SystemRoot\System32\DRIVERS\update.sys
F78EE000 - \SystemRoot\System32\Drivers\NDProxy.SYS
F790E000 - \SystemRoot\System32\DRIVERS\usbhub.sys
F7D90000 - \SystemRoot\System32\DRIVERS\USBD.SYS
F7D9A000 - \SystemRoot\System32\Drivers\Fs_Rec.SYS
F7EAF000 - \SystemRoot\System32\Drivers\Null.SYS
F7D9C000 - \SystemRoot\System32\Drivers\Beep.SYS
F7BE6000 - \SystemRoot\System32\drivers\vga.sys
F7D9E000 - \SystemRoot\System32\Drivers\mnmdd.SYS
F7DA0000 - \SystemRoot\System32\DRIVERS\RDPCDD.sys
F7BEE000 - \SystemRoot\System32\Drivers\Msfs.SYS
F7BF6000 - \SystemRoot\System32\Drivers\Npfs.SYS
F6F1C000 - \SystemRoot\System32\DRIVERS\rasacd.sys
F792E000 - \SystemRoot\System32\DRIVERS\ipsec.sys
F3D80000 - \SystemRoot\System32\DRIVERS\tcpip.sys
F3D5B000 - \SystemRoot\System32\DRIVERS\netbt.sys
F793E000 - \SystemRoot\System32\DRIVERS\netbios.sys
F3D33000 - \SystemRoot\System32\DRIVERS\rdbss.sys
F7DA2000 - \SystemRoot\system32\drivers\nod32drv.sys
F3CD3000 - \SystemRoot\System32\DRIVERS\mrxsmb.sys
F794E000 - \SystemRoot\System32\Drivers\Fips.SYS
F795E000 - \SystemRoot\System32\DRIVERS\wanarp.sys
F796E000 - \SystemRoot\System32\Drivers\Cdfs.SYS
F7C0E000 - \SystemRoot\System32\DRIVERS\usbprint.sys
F7656000 - \SystemRoot\System32\DRIVERS\hidusb.sys
F797E000 - \SystemRoot\System32\DRIVERS\HIDCLASS.SYS
F7C16000 - \SystemRoot\System32\DRIVERS\HIDPARSE.SYS
F7652000 - \SystemRoot\System32\DRIVERS\mouhid.sys
F3C95000 - \SystemRoot\System32\Drivers\dump_atapi.sys
F7DAC000 - \SystemRoot\System32\Drivers\dump_WMILIB.SYS
BF800000 - \SystemRoot\System32\win32k.sys
F7CCE000 - \SystemRoot\System32\watchdog.sys
F7CD2000 - \SystemRoot\System32\drivers\Dxapi.sys
BFF80000 - \SystemRoot\System32\drivers\dxg.sys
F7E30000 - \SystemRoot\System32\drivers\dxgthk.sys
BF99E000 - \SystemRoot\System32\ati2dvaa.dll
F3B34000 - \SystemRoot\System32\drivers\afd.sys
F3BC5000 - \SystemRoot\System32\drivers\ws2ifsl.sys
F3CC7000 - \SystemRoot\System32\DRIVERS\ndisuio.sys
F3901000 - \SystemRoot\System32\DRIVERS\mrxdav.sys
F7DEE000 - \SystemRoot\System32\Drivers\ParVdm.SYS
F385E000 - \SystemRoot\system32\drivers\amon.sys
F3747000 - \SystemRoot\System32\DRIVERS\srv.sys
F7B1E000 - \??\C:\Program Files\NavNT\NAVAPEL.SYS
F35A3000 - \SystemRoot\System32\DRIVERS\ipnat.sys
F36BF000 - \??\C:\Program Files\Symantec\SYMEVENT.SYS
F34AF000 - \??\C:\Program Files\NavNT\NAVAP.sys
F33E0000 - \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070613.022\NAVEX15.sys
F33CE000 - \??\C:\PROGRA~1\COMMON~1\SYMANT~1\VIRUSD~1\20070613.022\NAVENG.sys
F32F6000 - \SystemRoot\system32\drivers\sysaudio.sys
F3231000 - \SystemRoot\system32\drivers\wdmaud.sys
F7B96000 - \??\C:\Program Files\SPYWAREfighter\spyfighter.sys
F27CC000 - \SystemRoot\system32\drivers\kmixer.sys
F7E91000 - \SystemRoot\System32\DRIVERS\KProcCheck.sys

Total number of drivers = 119

Liste des programmes installes

Ad-Aware SE Personal
Adobe Flash Player 9 ActiveX
Adobe Reader 8 - Français
ArcSoft PhotoImpression 5
CCleaner (remove only)
DivX Content Uploader
DivX Web Player
EasyCleaner
EPSON Print CD
EPSON Printer Software
EPSON Stylus Photo R260 User's Guide
ffdshow [rev 1070] [2007-03-25]
Google Toolbar for Internet Explorer
HijackThis 1.99.1
Hijackthis Version Française 1.99.0.1
Internet Explorer Q828750
InterVideo DVDCopy 2
InterVideo WinDVD Recorder 5
J2SE Runtime Environment 5.0 Update 3
Java 2 Runtime Environment, SE v1.4.1_02
Java Web Start
Kaspersky Online Scanner
Lecteur Windows Media 10
LimeWire 4.12.11
LiveUpdate 1.7 (Symantec Corporation)
McAfee SecurityCenter
Messenger Plus! Live
Microsoft Office XP Professional with FrontPage
Mozilla Firefox (2.0.0.3)
Mozilla Firefox (2.0.0.4)
NOD32 Antivirus System
Norton AntiVirus Corporate Edition
Opera 9.21
Outil de mise à jour Google
PowerArchiver 2007 French
Realtek AC'97 Audio
Satsuki Decoder Pack
Spybot - Search & Destroy 1.4
SPYWAREfighter
USSA RecordNow DX
USSA RecordNow DX Update Manager
Vpskeys 4.3
WebFldrs XP
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows Media Format Runtime
Windows Media Player Hotfix [See wm828026 for more information]
Windows XP Hotfix - KB824105
Windows XP Hotfix - KB824146
Windows XP Hotfix (SP2) Q329441
Windows XP Hotfix (SP2) Q817287
YouTUBE (TM) movie downloader



Volume in drive C has no label.
Volume Serial Number is CCFB-3E7A

Directory of C:\Program Files

06/17/2007 11:34 AM <DIR> .
06/17/2007 11:34 AM <DIR> ..
04/06/2007 05:40 PM <DIR> Adobe
05/25/2007 03:20 PM <DIR> Ahead
05/30/2007 04:07 PM <DIR> Alwil Software
03/15/2005 08:30 PM <DIR> AOD
03/27/2007 10:05 PM <DIR> ArcSoft
06/01/2007 08:24 AM <DIR> a-squared Free
06/12/2007 09:28 AM <DIR> CCleaner
06/11/2007 10:56 PM <DIR> Common Files
03/15/2005 12:31 PM <DIR> ComPlus Applications
03/15/2005 10:04 PM <DIR> CyberLink
05/05/2007 06:23 PM <DIR> Dictionnaire
06/11/2007 01:34 PM <DIR> DivX
03/27/2007 10:09 PM <DIR> EPSON
05/23/2007 11:07 PM <DIR> EPSON Print CD
05/27/2007 08:54 AM <DIR> ESET
04/05/2007 12:13 PM 3,490 ffdsasetts.reg
04/05/2007 12:02 PM <DIR> ffdshow
04/05/2007 12:13 PM 7,644 ffdssetts.reg
05/30/2007 02:50 PM <DIR> Google
06/02/2007 03:23 PM <DIR> Hijackthis Version Française
03/15/2005 12:50 PM <DIR> Intel
01/07/2007 09:29 PM <DIR> Internet Explorer
03/15/2005 08:11 PM <DIR> InterVideo
04/03/2007 07:23 PM <DIR> Java
03/15/2005 08:30 PM <DIR> Java Web Start
04/05/2007 01:38 PM <DIR> Lavasoft
04/03/2007 07:23 PM <DIR> LimeWire
03/26/2007 12:03 AM <DIR> McAfee.com
03/15/2005 12:31 PM <DIR> Messenger
04/04/2007 10:11 AM <DIR> Messenger Plus! Live
06/11/2007 10:56 PM <DIR> Microsoft ActiveSync
03/15/2005 12:41 PM <DIR> microsoft frontpage
01/24/2007 10:01 PM <DIR> Microsoft Office
03/15/2005 12:32 PM <DIR> Movie Maker
06/12/2007 09:35 AM <DIR> Mozilla Firefox
04/05/2007 12:13 PM 596 mpc1.reg
04/05/2007 12:13 PM 680 mpc2.reg
04/05/2007 12:13 PM 3,026 mpc3.reg
04/05/2007 12:13 PM 346 mpc4.reg
04/05/2007 12:13 PM 16,296 mpc5.reg
04/05/2007 12:13 PM 18,156 mpc6.reg
04/05/2007 12:13 PM 3,476 mpc7.reg
03/15/2005 12:31 PM <DIR> MSN
03/15/2005 12:31 PM <DIR> MSN Gaming Zone
04/04/2007 10:11 AM <DIR> MSN Messenger
05/04/2007 11:51 AM <DIR> MUSICMATCH
01/16/2007 05:09 PM <DIR> NavNT
03/15/2005 12:32 PM <DIR> NetMeeting
03/15/2005 12:31 PM <DIR> Online Services
06/05/2007 01:19 PM <DIR> Opera
01/07/2007 09:29 PM <DIR> Outlook Express
06/19/2007 09:23 AM <DIR> PowerArchiver
04/05/2007 12:08 PM <DIR> Satsuki Decoder Pack
04/05/2007 12:08 PM 4,704 satsukidecodersettings.ini
06/01/2007 01:43 PM <DIR> SopCast
05/30/2007 02:46 PM <DIR> Spybot - Search & Destroy
05/30/2007 10:06 AM <DIR> SPYWAREfighter
01/16/2007 05:09 PM <DIR> Symantec
06/12/2007 09:30 AM <DIR> ToniArts
10/24/2005 06:50 PM <DIR> USSA
06/17/2007 11:56 AM <DIR> uusee
08/08/2006 05:16 PM <DIR> VERITAS Software
01/07/2007 09:04 PM <DIR> Vpskeys
06/12/2007 09:35 AM <DIR> Windows Media Player
03/15/2005 12:31 PM <DIR> Windows NT
03/15/2005 12:41 PM <DIR> xerox
04/10/2007 12:04 AM <DIR> YouTUBE (TM) movie downloader
10 File(s) 58,414 bytes
59 Dir(s) 67,989,585,920 bytes free
Volume in drive C has no label.
Volume Serial Number is CCFB-3E7A

Directory of C:\Program Files\common files

06/11/2007 10:56 PM <DIR> .
06/11/2007 10:56 PM <DIR> ..
04/06/2007 05:40 PM <DIR> Adobe
05/29/2007 10:27 PM <DIR> Application
06/11/2007 10:56 PM <DIR> Designer
03/27/2007 10:01 PM <DIR> InstallShield
03/15/2005 08:10 PM <DIR> InterVideo
04/03/2007 07:19 PM <DIR> Java
06/11/2007 10:56 PM <DIR> Microsoft Shared
03/15/2005 12:31 PM <DIR> MSSoap
03/15/2005 04:25 AM <DIR> ODBC
03/15/2005 12:32 PM <DIR> Services
03/15/2005 04:25 AM <DIR> SpeechEngines
01/16/2007 05:09 PM <DIR> Symantec Shared
01/24/2007 10:01 PM <DIR> System
0 File(s) 0 bytes
15 Dir(s) 67,989,585,920 bytes free
Volume in drive C has no label.
Volume Serial Number is CCFB-3E7A

Directory of C:\

05/12/2007 06:22 PM 68,096 diff.exe
05/12/2007 06:22 PM 103,424 grep.exe
10/31/2005 08:56 AM 700,416 StubInstaller.exe
3 File(s) 871,936 bytes
0 Dir(s) 67,989,585,920 bytes free
c:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
c:\Documents and Settings\Phuong Nguyen\.limewire\.NetworkShare\LimeWireWinInstaller.exe
c:\Documents and Settings\Phuong Nguyen\Application Data\Microsoft\Installer\{AF599832-2305-4922-9342-6FF48894E384}\ARPPRODUCTICON.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\a2FreeSetup.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\aswclnr.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\ccsetup140.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\cleaner42.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\ComboFix.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\DivXWebPlayerInstaller.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\EClea2_0.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\Google Updater.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\HIJACKTHIS VF.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\HiJackThis_v2.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\setupfre.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\spybotsd14.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\spywarefighter.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\VundoFix.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\Antivirus\zapSetup_70_337_000_fr.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\catchme.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\diff.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\dumphive.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\FilesInfoCmd.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\find2.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\Fport.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\grep.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\KProcCheck.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\LFiles.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\LISTDLLS.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\pslist.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\streams.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\DiagHelp\DiagHelp\swreg.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\me\Dico\dic_vietnamien.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\me\Dico\dictionnaire_setup.exe
c:\Documents and Settings\Phuong Nguyen\Desktop\sreng2\SREng.EXE
c:\Documents and Settings\Phuong Nguyen\Local Settings\Temp\Install_Messenger.exe
c:\Documents and Settings\Phuong Nguyen\My Documents\AWG 7.1(Anti Virus)\avg75afwt_433a904.exe
c:\Documents and Settings\Phuong Nguyen\My Documents\AWG 7.1(Anti Virus)\Khoa mo AVG.exe
c:\Documents and Settings\Phuong Nguyen\My Documents\mcafee8i\mcafee8i\InstMsiw.exe
c:\Documents and Settings\Phuong Nguyen\My Documents\mcafee8i\mcafee8i\Setupvse.exe
c:\Documents and Settings\Phuong Nguyen\My Documents\Replay Convert\TE\RCSetup.exe
c:\Documents and Settings\Phuong Nguyen\My Documents\SpywareDoctor4.0\sdsetup.exe
c:\Documents and Settings\Phuong Nguyen\My Documents\SpywareDoctor4.0\Spyware.Doctor.v4.0.0.2593_patch.exe
c:\Documents and Settings\All Users\Application Data\Microsoft\IdentityCRL\production\ppcrlconfig.dll

****** Fin du rapport DiagHelp

Salut,

Je sais que je 2 antivirus mais c'est l'ordi de mon pere et c'est lui qui met Norton c'est pour ca que je mettre Nod32.

Maintenant au demarrage de windows les icones ne se metre plus en bas a droite et quand j'essaye de lancer Msn il ne ce lancent pas et quand je faire ctrl+alt+delete dans processes il est ecrit que msnmsgr.exe prends 80 de CPU

Desole de mon Francais et je vais poster le rapport OTMoveIT bientot

Bien


Fais une analyse antivirus en ligne sur Kaspersky
http://webscanner.kaspersky.fr/
Clique sur Démarrer Online Scanner.
Sélectionne le poste de travail comme analyse.
Colle son rapport ici.