Brave Sentry

Redémarre en mode sans échec (tuto faire seulement avec la 1ere méthode !).
Relance Smitfraudix.
Prends cette fois l’option 2. (Oui à toutes les questions)

Si tu dois redémarrer, ton ordi fais-le .
Poste le rapport qui se situe dans C:\rapport.txt .
Ainsi qu’un nouveau rapport HiJackThis.

Bonjour et merci!
alors voila

mitFraudFix v2.219

Rapport fait à 15:13:16,20, 08/09/2007
Executé à partir de F:\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B20509}"="DCOM Server 20509"

[HKEY_CLASSES_ROOT\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B20509}\InProcServer32]
@="C:\WINDOWS\system32\xztzzuy.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B20509}\InProcServer32]
@="C:\WINDOWS\system32\xztzzuy.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\xpupdate.exe supprimé
C:\WINDOWS\system32\svchosts.exe supprimé
C:\Documents and Settings\Clara\Application Data\Install.dat supprimé
C:\DOCUME~1\Clara\Bureau\BraveSentry.lnk supprimé
C:\Program Files\Video ActiveX Object\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{F5117CC5-4074-450E-BFC6-B93B6637A5B1}: DhcpNameServer=212.198.0.91 212.198.2.51
HKLM\SYSTEM\CS2\Services\Tcpip\..\{A0FF0B3C-BA2C-4B7F-814A-BD0E01D2A8D3}: DhcpNameServer=212.198.0.91 212.198.2.51
HKLM\SYSTEM\CS2\Services\Tcpip\..\{F5117CC5-4074-450E-BFC6-B93B6637A5B1}: DhcpNameServer=212.198.0.91 212.198.2.51
HKLM\SYSTEM\CS3\Services\Tcpip\..\{F5117CC5-4074-450E-BFC6-B93B6637A5B1}: DhcpNameServer=212.198.0.91 212.198.2.51
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.198.0.91 212.198.2.51


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{2C1CD3D7-86AC-4068-93BC-A02304B20509}"="DCOM Server 20509"

[HKEY_CLASSES_ROOT\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B20509}\InProcServer32]
@="C:\WINDOWS\system32\xztzzuy.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{2C1CD3D7-86AC-4068-93BC-A02304B20509}\InProcServer32]
@="C:\WINDOWS\system32\xztzzuy.dll"



»»»»»»»»»»»»»»»»»»»»»»»» Fin


et voilou


Logfile of HijackThis v1.99.1
Scan saved at 15:20:09, on 08/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Clara\Bureau\Bureau\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.thesims.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:4343
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02099B50-B7B7-4B4A-B6E5-D5A446AE350C} - C:\Program Files\Windows NT\nipysax2.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: bho3 Class - {58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} - C:\WINDOWS\system32\98103130.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: HttpGuard - {98B822AD-6BE7-49BC-B773-97240B774080} - C:\WINDOWS\system32\AClient.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: IE Redirector - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\WINDOWS\system32\dnsersnd.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [xem] C:\WINDOWS\ServicePackFiles\services.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [xem] C:\WINDOWS\ServicePackFiles\winlogon.exe
O4 - HKCU\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe
O4 - HKCU\..\Run: [mcdsys] sqvxga6met3.exe
O4 - HKCU\..\Run: [dsiknd] C:\WINDOWS\system32\nbkdms.exe
O4 - HKCU\..\Run: [certds] C:\WINDOWS\system32\cncersh.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://jedi.esa.int/get/uri/http://esahqnotes1a.hq.esa...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: botreg - C:\Documents and Settings\All Users\Documents\Settings\bot.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\xztzzuy.dll
O21 - SSODL: xDAtltF - {789F4FC5-D235-E56F-1BBC-F99A85E5AAB4} - C:\WINDOWS\system32\jlnrn.dll
O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
O23 - Service: CPnumericable - Unknown owner - C:\Program Files\ControleParental\CPnumericable.exe" -s "C:\Program Files\ControleParental\wrapper.conf (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:exe.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

Télécharge SDFix

Enregistre le sur ton le bureau.

Lances le.
Fais install afin qu’il puisse s’extraire.

Redémarre en mode sans échec (tuto faire seulement avec la 1ere méthode !)

Lance SDFix.
Double clique sur RunThis.bat (Le .bat apparaît si tu fais ça : Aller dans poste de travail>outils>option des dossiers>affichage>décocher masquer les extensions dont le type est connu. - - > Appliquer - - > OK)
Appuie sur Y pour le lancer.

Il te sera demandé d'appuyer sur une touche pour redemarrer , fais le
Il est probable que le redémarrage soit un peu plus long que d’habitude.
Une fois l’apparition de ton Bureau, il affichera Finished

Appuie sur une touche.

Un rapport est généré , poste le dans ta réponse.
Il se trouve également. dans le dossier SDFix >Report.txt<
et un nouveau rapport Hijackthis

avant d'appuyer sur une touche pour redemarrer, ca me dit
"WinZip Self-Extractor - XP.exe

to unzip all files in XP.exe to the specified folder press the unzip button.

Unzip to folder:
C:\Windows\System32 Browse...
[petite case cochée] Overwrite files without prompting"

et apres j'ai le choix entre:
"Unzip", "Run WinZip", "Close", "About" ou "Help"

que dois-je faire?

OUPS DESOLEE

en fait c'est bon c'est ecrit juste en dessous desolée =_='

et voilaaa ce fut long mais bon


SDFix: Version 1.102

Run by Clara on 08/09/2007 at 16:00

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
ICF
ldrsvc

ImagePath:
C:\WINDOWS\system32\svchost.exe:exe.exe
%SystemRoot%\System32\svchost.exe -k netsvcs

ICF - Deleted
ldrsvc - Deleted



Infected mswsock.dll Found!

mswsock.dll File Locations:

C:\WINDOWS\$NtServicePackUninstall$\mswsock.dll
C:\WINDOWS\ServicePackFiles\i386\mswsock.dll
C:\WINDOWS\SYSTEM32\mswsock.dll
C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll

Modified Files Are Listed Below:

C:\WINDOWS\ServicePackFiles\i386\mswsock.dll
C:\WINDOWS\SYSTEM32\mswsock.dll
C:\WINDOWS\SYSTEM32\DLLCACHE\mswsock.dll

Note: SDFix Does Not Repair This File!


Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service
Resetting AppInit_DLLs value


Rebooting...

Service asc355 - Deleted after Reboot
Service asc3550u - Deleted after Reboot

Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\DLLH8J~1.EXE - Deleted
C:\202370~1 - Deleted
C:\WINDOWS\SYSTEM32\203157~1.DLL - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\1.dllb - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\2.dllb - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\5.dllb - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\6.dllb - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\7.dllb - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\1.dllb - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\2.dllb - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\5.dllb - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\6.dllb - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\7.dllb - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun1.exe - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun2.exe - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun3.exe - Deleted
C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun4.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun1.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun10.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun11.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun12.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun13.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun14.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun15.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun16.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun2.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun3.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun4.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun5.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun6.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun7.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun8.exe - Deleted
C:\Documents and Settings\NetworkService\Local Settings\Temp\stdrun9.exe - Deleted
C:\WINDOWS\Temp\stdrun1.exe - Deleted
C:\WINDOWS\Temp\stdrun2.exe - Deleted
C:\WINDOWS\Temp\stdrun3.exe - Deleted
C:\WINDOWS\Temp\stdrun4.exe - Deleted
C:\WINDOWS\Temp\stdrun5.exe - Deleted
C:\WINDOWS\Temp\stdrun6.exe - Deleted
C:\WINDOWS\ServicePackFiles\www.google.com\favicon.ico - Deleted
C:\WINDOWS\ServicePackFiles\www.google.com\index.html - Deleted
C:\WINDOWS\ServicePackFiles\www.google.com\thank.html - Deleted
C:\WINDOWS\ServicePackFiles\www.google.com\Google_files\hp0.gif - Deleted
C:\WINDOWS\ServicePackFiles\www.google.com\Google_files\hp1.gif - Deleted
C:\WINDOWS\ServicePackFiles\www.google.com\Google_files\hp2.gif - Deleted
C:\WINDOWS\ServicePackFiles\www.google.com\Google_files\hp3.gif - Deleted
C:\Program Files\InetGet2\popinstall.exe - Deleted
C:\Program Files\WinPop\UnInstall.exe - Deleted
C:\Program Files\WinPop\winpop.exe - Deleted
C:\Documents and Settings\Clara\Application Data\.rdr.ini - Deleted
C:\Documents and Settings\Clara\new.txt - Deleted
C:\Documents and Settings\All Users\Documents\Settings\bot.dll - Deleted
C:\d.exe - Deleted
C:\i - Deleted
C:\WINDOWS\album14.zip - Deleted
C:\WINDOWS\album17.zip - Deleted
C:\WINDOWS\album32.zip - Deleted
C:\WINDOWS\album38.zip - Deleted
C:\WINDOWS\album44.zip - Deleted
C:\WINDOWS\album56.zip - Deleted
C:\WINDOWS\album71.zip - Deleted
C:\WINDOWS\album77.zip - Deleted
C:\WINDOWS\album80.zip - Deleted
C:\WINDOWS\album89.zip - Deleted
C:\WINDOWS\album95.zip - Deleted
C:\WINDOWS\album98.zip - Deleted
C:\WINDOWS\b122.exe - Deleted
C:\WINDOWS\photo12.zip - Deleted
C:\WINDOWS\photo3.zip - Deleted
C:\WINDOWS\photo30.zip - Deleted
C:\WINDOWS\photo36.zip - Deleted
C:\WINDOWS\photo39.zip - Deleted
C:\WINDOWS\photo42.zip - Deleted
C:\WINDOWS\photo45.zip - Deleted
C:\WINDOWS\photo78.zip - Deleted
C:\WINDOWS\photo81.zip - Deleted
C:\WINDOWS\photo93.zip - Deleted
C:\WINDOWS\photo96.zip - Deleted
C:\WINDOWS\photos2007_1.zip - Deleted
C:\WINDOWS\photos2007_13.zip - Deleted
C:\WINDOWS\photos2007_16.zip - Deleted
C:\WINDOWS\photos2007_19.zip - Deleted
C:\WINDOWS\photos2007_28.zip - Deleted
C:\WINDOWS\photos2007_37.zip - Deleted
C:\WINDOWS\photos2007_4.zip - Deleted
C:\WINDOWS\photos2007_43.zip - Deleted
C:\WINDOWS\photos2007_46.zip - Deleted
C:\WINDOWS\photos2007_52.zip - Deleted
C:\WINDOWS\photos2007_55.zip - Deleted
C:\WINDOWS\photos2007_7.zip - Deleted
C:\WINDOWS\photos2007_70.zip - Deleted
C:\WINDOWS\photos2007_76.zip - Deleted
C:\WINDOWS\photos2007_82.zip - Deleted
C:\WINDOWS\photos2007_88.zip - Deleted
C:\WINDOWS\photos2007_94.zip - Deleted
C:\WINDOWS\photos2007_97.zip - Deleted
C:\WINDOWS\photo_album16.zip - Deleted
C:\WINDOWS\photo_album19.zip - Deleted
C:\WINDOWS\photo_album31.zip - Deleted
C:\WINDOWS\photo_album34.zip - Deleted
C:\WINDOWS\photo_album37.zip - Deleted
C:\WINDOWS\photo_album49.zip - Deleted
C:\WINDOWS\photo_album64.zip - Deleted
C:\WINDOWS\photo_album67.zip - Deleted
C:\WINDOWS\photo_album7.zip - Deleted
C:\WINDOWS\photo_album73.zip - Deleted
C:\WINDOWS\photo_album76.zip - Deleted
C:\WINDOWS\photo_album91.zip - Deleted
C:\WINDOWS\photo_album94.zip - Deleted
C:\WINDOWS\retadpu27.exe - Deleted
C:\WINDOWS\retadpu420.exe - Deleted
C:\WINDOWS\ServicePackFiles\mm.pid - Deleted
C:\WINDOWS\ServicePackFiles\mm2591.exe - Deleted
C:\WINDOWS\ServicePackFiles\mmxs.exe - Deleted
C:\WINDOWS\ServicePackFiles\services.exe - Deleted
C:\WINDOWS\ServicePackFiles\winlogon.exe - Deleted
C:\WINDOWS\spooldr.exe - Deleted
C:\WINDOWS\svchost.DLL - Deleted
C:\WINDOWS\system32\AClient.dll - Deleted
C:\WINDOWS\system32\allworld.exe - Deleted
C:\WINDOWS\system32\arcac.exe - Deleted
C:\WINDOWS\system32\arcac.exe.bak - Deleted
C:\WINDOWS\system32\dllh8jkd1q1.exe - Deleted
C:\WINDOWS\system32\dllh8jkd1q5.exe - Deleted
C:\WINDOWS\system32\dllh8jkd1q6.exe - Deleted
C:\WINDOWS\system32\dllh8jkd1q7.exe - Deleted
C:\WINDOWS\system32\dllh8jkd1q8.exe - Deleted
C:\WINDOWS\system32\dnsersnd.dll - Deleted
C:\WINDOWS\system32\drivers\fee - Deleted
C:\WINDOWS\system32\f06WtR\f06WtR1083.exe - Deleted
C:\WINDOWS\system32\intlprinters.exe - Deleted
C:\WINDOWS\system32\kernelwind32.exe - Deleted
C:\WINDOWS\system32\kr_done1 - Deleted
C:\WINDOWS\system32\ldcore.dll - Deleted
C:\WINDOWS\system32\ldinfo.ldr - Deleted
C:\WINDOWS\system32\max1d1164v.exe - Deleted
C:\WINDOWS\system32\mstdmc.exe - Deleted
C:\WINDOWS\system32\rpcc.dll - Deleted
C:\WINDOWS\system32\spooldr.ini - Deleted
C:\WINDOWS\system32\spoolsvv.exe - Deleted
C:\WINDOWS\system32\sqvx5gamet2.exe - Deleted
C:\WINDOWS\system32\sqvxga7met4.exe - Deleted
C:\WINDOWS\system32\svcp.csv - Deleted
C:\WINDOWS\system32\TFTP2620 - Deleted
C:\WINDOWS\system32\TFTP3100 - Deleted
C:\WINDOWS\system32\TFTP3192 - Deleted
C:\WINDOWS\system32\TFTP556 - Deleted
C:\WINDOWS\system32\vedxg6ame4.exe - Deleted
C:\WINDOWS\system32\vedxga1me4t1.exe - Deleted
C:\WINDOWS\system32\vedxga3me2.exe - Deleted
C:\WINDOWS\system32\vedxga4m1et4.exe - Deleted
C:\WINDOWS\system32\vedxga4me1.exe - Deleted
C:\WINDOWS\system32\vedxga5me3.exe - Deleted
C:\WINDOWS\system32\vx.tll - Deleted
C:\WINDOWS\system32\WinCore32.exe - Deleted
C:\WINDOWS\system32\winsub.xml - Deleted
C:\WINDOWS\winvip.exe - Deleted
C:\WINDOWS\wpcjmd.log - Deleted
C:\WINDOWS\wr.txt - Deleted
C:\WINDOWS\system32\drivers\asc355.sys - Deleted


Folder C:\Documents and Settings\All Users\Documents\Settings - Removed
Folder C:\Program Files\InetGet2 - Removed
Folder C:\Program Files\WinPop - Removed
Folder C:\Temp\fse - Removed
Folder C:\WINDOWS\ServicePackFiles\www.google.com - Removed
Folder C:\WINDOWS\system32\f06WtR - Removed

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
: ADS Found!

svchost.exe: deleted 58880 bytes in 1 streams.

Checking for remaining Streams

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

C:\Documents and Settings\Clara\Bureau\Bureau\[www.narutoyaoi.comYonekura_Kengo\Thumbs.db
C:\Documents and Settings\Clara\Bureau\Bureau\[www.narutoyaoi.comYonekura_Kengo\[www.narutoyaoi.com]Koi o Suru\Thumbs.db
C:\Documents and Settings\Clara\Mes documents\Mes images\Clara 1\[www.narutoyaoi.com]Asuma\Thumbs.db
C:\Documents and Settings\Clara\Mes documents\projet Clara\Temporary Internet Files 1\croco\[www.narutoyaoi.com]Aperitif\Thumbs.db
C:\Documents and Settings\Clara\Mes documents\projet Clara\Visual_Boy_Advance_V1.7\[www.narutoyaoi.comYonekura_Kengo\Thumbs.db
C:\Documents and Settings\Clara\Mes documents\projet Clara\Visual_Boy_Advance_V1.7\[www.narutoyaoi.com]Asuma\Thumbs.db
C:\Documents and Settings\CLara\Mes documents\projet Clara\Visual_Boy_Advance_V1.7\[www.narutoyaoi.com]Desconocido\Thumbs.db
C:\Documents and Settings\Clara\Mes documents\projet Clara\Visual_Boy_Advance_V1.7\[www.narutoyaoi.com]Let me hear words of love 2\Thumbs.db
C:\Program Files\Image-Line\FL Studio 7\REX Shared Library.dll
C:\WINDOWS\SYSTEM32\cncersh.exe~
C:\WINDOWS\SYSTEM32\nbkdms.exe~
C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp
C:\Documents and Settings\Clara\Application Data\Microsoft\Office\Shortcut Bar\Bur595h.tmp
C:\Documents and Settings\Clara\Application Data\Microsoft\Office\Shortcut Bar\Bur595s.tmp
C:\Documents and Settings\Clara\Application Data\Microsoft\Office\Shortcut Bar\Fav86E.tmp
C:\Documents and Settings\Clara\Application Data\Microsoft\Office\Shortcut Bar\OffAF.tmp
C:\Documents and Settings\Clara\Application Data\Microsoft\Office\Shortcut Bar\OffAFh.tmp
C:\Documents and Settings\Clara\Application Data\Microsoft\Office\Shortcut Bar\OffAFs.tmp
C:\Program Files\Microsoft Office\Office\Gestionnaire Office\Off4.tmp

Finished



et



Logfile of HijackThis v1.99.1
Scan saved at 16:32:02, on 08/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Documents and Settings\Clara\Bureau\Bureau\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.thesims.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:4343
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02099B50-B7B7-4B4A-B6E5-D5A446AE350C} - C:\Program Files\Windows NT\nipysax2.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [mcdsys] sqvxga6met3.exe
O4 - HKCU\..\Run: [dsiknd] C:\WINDOWS\system32\nbkdms.exe
O4 - HKCU\..\Run: [certds] C:\WINDOWS\system32\cncersh.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://jedi.esa.int/get/uri/http://esahqnotes1a.hq.esa...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\xztzzuy.dll
O21 - SSODL: xDAtltF - {789F4FC5-D235-E56F-1BBC-F99A85E5AAB4} - C:\WINDOWS\system32\jlnrn.dll
O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
O23 - Service: CPnumericable - Unknown owner - C:\Program Files\ControleParental\CPnumericable.exe" -s "C:\Program Files\ControleParental\wrapper.conf (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

euh vu que XmichouX s'est deconnecté est-ce que quelqu'un d'autre pourrait me prendre en main s'il vous plait?

up

Très gros ménage de la part de SDfix, refais-le une fois et postel e rapport.

hum mon pere a supprimer sdfix et je peux plus le telecharger (meme quand ej change les parametres de securité ca me dit "les parametres de securité ne vous permettent pas de telecharger ce fichier")

Reposte un HiJackthis.
Pour SDFix, essaie de le télécharger à partir d'un autre ordinateur et de l'amener ici par usb.

Logfile of HijackThis v1.99.1
Scan saved at 17:59:06, on 09/09/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure\Anti-Virus\FSGK32.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\F-Secure\Anti-Virus\fssm32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Common\FNRB32.EXE
C:\Program Files\F-Secure\Common\FIH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\F-Secure\BackWeb\7681197\Program\BACKWE~1.EXE
C:\Program Files\F-Secure\Common\FSM32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\lexpps.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Documents and Settings\Clara\Bureau\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.thesims.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:4343
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {02099B50-B7B7-4B4A-B6E5-D5A446AE350C} - C:\Program Files\Windows NT\nipysax2.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [mcdsys] sqvxga6met3.exe
O4 - HKCU\..\Run: [dsiknd] C:\WINDOWS\system32\nbkdms.exe
O4 - HKCU\..\Run: [certds] C:\WINDOWS\system32\cncersh.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://jedi.esa.int/get/uri/http://esahqnotes1a.hq.esa...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/fl...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: DCOM Server 20509 - {2C1CD3D7-86AC-4068-93BC-A02304B20509} - C:\WINDOWS\system32\xztzzuy.dll
O21 - SSODL: xDAtltF - {789F4FC5-D235-E56F-1BBC-F99A85E5AAB4} - C:\WINDOWS\system32\jlnrn.dll
O23 - Service: FS BackWeb (BackWeb Client - 7681197) - Unknown owner - C:\PROGRA~1\F-Secure\BackWeb\7681197\PROGRAM\SERVIC~1.EXE
O23 - Service: CPnumericable - Unknown owner - C:\Program Files\ControleParental\CPnumericable.exe" -s "C:\Program Files\ControleParental\wrapper.conf (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: F-Secure BackWeb LAN Access - Unknown owner - C:\Program Files\F-Secure\BackWeb\7681197\Program\fsbwlan.exe
O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\F-Secure\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Network Request Broker - F-Secure Corporation - C:\Program Files\F-Secure\Common\FNRB32.EXE
O23 - Service: F-Secure Authentication Agent (FSAA) - F-Secure Corporation. All Rights Reserved. - C:\Program Files\F-Secure\Common\FSAA.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

pour sdfix pour l'instant je peux pas faudra attendre lundi soir au plus tot desolée je vous facilite pas la tache ^^'

Ok.
Tu referas SDFix quand tu auras le temps .

Télécharge Navilog

Enregistre-le sur ton Bureau.
Dézippe le.

Double clique sur Navilog1.bat.
Laisse-toi guider par l'utilitaire. Choisis l'option 1 puis valide.
! N'utilise pas l'option 2,3 et 4 sans notre accord !
Patiente jusqu'à l'apparition de ce message :
"*** Analyse Termine le ..... ***"
Appuie sur une touche comme demandé. Le Bloc-notes va s'ouvrir. Poste le rapport ici.

Le rapport se trouve ici : C:\fixnavi.txt

bon je sais pas si c'est bon vu que le message "*** Analyse Termine le .....***" n'est pas apparu apres que je l'ai fait tourné 1h mais bon voici le rapport quand meme


Search Navipromo version 3.0.1 commencé le 09/09/2007 à 21:57:05,37

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Poster ce rapport sur le forum pour le faire analyser !!!
!!! Ne pas lancer la partie désinfection sans l'avis d'un spécialiste !!!

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 08.09.2007 a 21h00 by IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11


*** Recherche Programmes installes ***




*** Recherche dossiers dans C:\WINDOWS ***



*** Recherche dossiers dans C:\Program Files ***



*** Recherche dossiers dans C:\Documents and Settings\All Users\Application Data ***




*** Recherche dossiers dans C:\Documents and Settings\Clara\Application Data ***


*** Recherche avec BlackLight Engine/F-secure ***
BlackLight Engine est un produit de F-secure, pour + d'infos :
http://www.f-secure.com/blacklight/blacklight_help.html


F-SECURE BLACKLIGHT ROOTKIT ELIMINATOR
======================================

Copyright 2005-2006 F-Secure Corporation. All rights reserved.
This is a beta version. It will expire on 1st of October, 2007.
Version information: 2.2.1064.

[+] Started on 09/09/07 at 21:57:08.
[+] Initializing ...
[+] Starting scan, press Ctrl-C to abort.
[+] Scanning for hidden items ...............................................................................................
[+] Scan complete.
[+] Summary: 0 hidden item(s) found, 0 scheduled for renaming.
[+] Exited on 09/09/07 at 22:08:24 (return code = 0).


*** Recherche avec GenericNaviSearch ***
!!! Tous Ces résultats peuvent révéler des fichiers légitimes !!!
!!! A verifier impérativement avant toute suppression manuelle !!!

* Scan C:\WINDOWS\system32 *

Tu peux recommencer une fois pour voir ?
Tu dis que tu l'as fait tourné une heure ?

Télécharge AVG Anti-Spyware Installes-le.
Lance AVG et fais une mise à jour.
Clique sur le bouton Analyse (de la barre d'outils)
Puis sur l'onglet comment réagir, clique sur Actions recommandées. Choisis Quarantaine.
Ne fais pas d’analyse pour le moment.

Télécharge sur ton bureau : Clean
Dézippe le sur ton bureau. Double-clic sur ce dossier clean.
Double-clic sur clean.cmd. Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé et poste le rapport ici.

alors voila le rapport clean je suppose que je dois supprimer les deux fichiers indiqués non?

10/09/2007 a 17:40:43,00

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\ide21201.vxd FOUND
C:\WINDOWS\System32\fuamfu32.ini FOUND

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !

J'aimerais avant que tu repasses SDFix en me donnant le rapport et que tu ressaies une fois avec navilog pour voir  

bin j'ai refait navilog et, au bout de deux heures d'attente cette fois, ca avance toujours pas   c'est bizarre. Est ce que c'est parce que en meme temps j'ecoute de la musique et que je joue au freecell parce que je me fais chier? (si oui je recommence sans rien toucher)
et pour sdfix je vais reessayé de le telecharger sinon faudra attendre demain soir a tout de suite

Ok j'attendrai pour SDFix.
Pour navilog, inutile de ressayer, ça prend beaucoup moins de temps normalement.
En attendant,

Redémarre en mode sans échec (tuto).
Relance Avg.
Reviens à l'onglet Analyse. Clique sur Analyse complète du système.
A la fin du scan, choisis l'option " Appliquer toutes les actions " en bas.
Clique sur "Enregistrer le rapport". Ceci génère un rapport qui se trouve dans le dossier Reports du dossier d'AVG Anti-Spyware.
Poste le ici.
&
Toujours en mode sans échec, relance clean et fais l'option 2, poste le rapport.