Beagle AAw, SROSA.SYS,HLDRR.EXE

bonjour, essais de le réinstaller et de le passer en mode sans echec et puis si ça peut t'aider http://www.commentcamarche.net/faq/sujet 9889 comment supprimer le virus beagle bagle

j'ai déjà vu cette page merci , mais j'ai également lu ailleurs que le mode sans échec ne marche pas avec ces virus , et perso , je sais pas trop comment on l'utilise .
sinon j'ai essayer d'utiliser la fonction éxecuter , mais windows me dit qu'il le trouve pas , pourtant je remet exactement le nom du truc mais bon . De plus , j'avais utiliser un dvd RW pour copier elibagle ( déjà renommé) et quand je mets le dvd , il apparait plus sur le dvd , alors que ça marche sur mon 2 ème pc .

Tout ça commence à m'énerver. Surtout que si je renomme pas elibagle , ça marche pas.

Salut


Télécharge sur ton bureau DSS (ex Comboscan) de Deckard:

http://deckard.geekstogo.com/dss.exe


(choisis enregistrer, puis Bureau comme emplacement)

Ferme toutes les applications en cours.

Double-clic sur DSS.exe pour lancer l'outil.

Une fenêtre s'ouvre, invitant à fermer toutes les applications, clique sur OK.

A la fin de l'analyse, une fenêtre s'ouvre, clique sur OK.

Le rapport main.txt va s'afficher, copie le dans ta prochaine réponse.
Si un rapport complémentaire a été créé ( extra.txt ), poste le aussi dans ta réponse.

Les rapports sont ici :
(!) C:\Deckard\System Scanner\main.txt
(!) C:\Deckard\System Scanner\extra.txt

(CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller )

A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                  Bonne écoute 

ok, je teste

main txt

Deckard's System Scanner v20071014.68
Run by jules on 2008-07-28 18:23:04
Computer is in Normal Mode.
------------------------------------------------------------­--------------------

Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------­


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-28 18:24:27
Platform: Windows Vista (6.00.6000)
MSIE: Internet Explorer (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\taskeng.exe
C:\WINDOWS\System32\dwm.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Users\jules\Desktop\dss.exe
C:\WINDOWS\System32\conime.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvvsvc.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\System32\ZoneLabs\vsmon.exe

End of file - 6257 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R0 giveio - c:\windows\system32\giveio.sys
R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {ff646f80-8def-11d2-9449-00105a075f6b}
Description: pcouffin device ...
Device ID: ROOT\PCOUFFIN\0000
Manufacturer:
Name: pcouffin device ...
PNP Device ID: ROOT\PCOUFFIN\0000
Service:


-- Scheduled Tasks -------------------------------------------------------------

2008-07-28 00:19:31 418 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{43BF90AC-D740-43B8-A9D0-DAF671AC0EFD}.job


-- Files created between 2008-06-28 and 2008-07-28 -----------------------------

2008-07-26 22:49:07 0 d-------- C:\!KillBox
2008-07-26 18:32:18 0 --a------ C:\ntuser.dat
2008-07-19 14:31:19 98304 --a------ C:\Windows\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >
2008-07-19 14:28:52 0 d-------- C:\Program Files\THQ
2008-07-17 23:08:44 0 d-------- C:\NVIDIA
2008-07-17 03:44:47 0 d-------- C:\Users\All Users\media center programs
2008-07-17 03:01:42 0 d-------- C:\Program Files\Funcom
2008-07-17 02:59:45 0 d-------- C:\Users\All Users\Funcom
2008-07-15 21:16:14 0 d-------- C:\Program Files\antitrock
2008-07-11 22:42:45 0 d-------- C:\Wysigot
2008-07-10 16:57:54 0 d-------- C:\Program Files\Common Files\Adobe
2008-07-09 22:05:23 0 d-------- C:\Program Files\Microsoft Silverlight
2008-07-09 16:20:29 90112 --a------ C:\Windows\unvise32.exe <Not Verified; MindVision Software; Installer VISE>
2008-07-09 16:18:59 0 d-------- C:\Program Files\Pixie
2008-07-09 16:18:53 0 d-a------ C:\Program Files\Furnish Pro
2008-07-08 18:56:28 0 d-------- C:\Program Files\Java
2008-07-08 18:56:05 0 d-------- C:\Program Files\Common Files\Java
2008-07-08 18:32:55 0 d-------- C:\eMule
2008-07-04 00:04:40 0 d-------- C:\Users\All Users\Real
2008-07-04 00:04:40 0 d-------- C:\Program Files\Real Alternative
2008-07-03 23:59:02 0 d-------- C:\Users\All Users\GRETECH
2008-07-03 23:57:45 0 d-------- C:\Program Files\GRETECH
2008-07-03 15:45:47 217127 --a------ C:\Windows\system32\drv43260.dll <Not Verified; RealNetworks, Inc.; RealVideo 9 (32-bit)>
2008-07-03 15:45:47 208935 --a------ C:\Windows\system32\drv33260.dll <Not Verified; RealNetworks, Inc.; RealVideo 8 (32-bit)>
2008-07-03 15:45:47 176165 --a------ C:\Windows\system32\drv23260.dll <Not Verified; RealNetworks, Inc.; RealVideo G2 (32-bit)>
2008-07-03 15:45:47 65602 --a------ C:\Windows\system32\cook3260.dll <Not Verified; RealNetworks, Inc.; RealPlayer 10>
2008-07-03 15:45:46 626688 --a------ C:\Windows\system32\vp7vfw.dll <Not Verified; On2.com; On2_VP70>
2008-07-03 15:45:45 0 d-------- C:\Program Files\VSO
2008-06-28 19:26:45 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-28 19:26:32 0 d-------- C:\Program Files\Windows Live
2008-06-28 19:25:57 0 d-------- C:\Users\All Users\WLInstaller


-- Find3M Report ---------------------------------------------------------------

2008-07-28 17:36:00 690594 --a------ C:\Windows\system32\perfh00C.dat
2008-07-28 17:36:00 117366 --a------ C:\Windows\system32\perfc00C.dat
2008-07-25 18:19:35 0 d-------- C:\Program Files\Common Files\LightScribe
2008-07-24 20:35:49 0 d-------- C:\Program Files\DAEMON Tools
2008-07-19 14:28:50 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-13 00:20:06 0 d-------- C:\Users\jules\AppData\Roaming\Mozilla
2008-07-11 23:05:24 0 d-------- C:\Program Files\Opera
2008-07-10 16:57:54 0 d-------- C:\Program Files\Common Files
2008-07-10 16:51:19 0 d-------- C:\Users\jules\AppData\Roaming\Adobe
2008-07-10 03:08:41 0 d-------- C:\Users\jules\AppData\Roaming\Media Player Classic
2008-07-09 03:28:52 174 --ahs---- C:\Program Files\desktop.ini
2008-07-09 03:00:51 0 d-------- C:\Program Files\Windows Mail
2008-07-08 18:48:43 0 d-------- C:\Users\jules\AppData\Roaming\U3
2008-07-04 00:04:40 0 d-------- C:\Users\jules\AppData\Roaming\Real
2008-07-03 23:57:53 0 d-------- C:\Users\jules\AppData\Roaming\GRETECH
2008-07-03 17:33:24 0 d-------- C:\Users\jules\AppData\Roaming\Vso
2008-07-03 17:33:23 668 --a------ C:\Users\jules\AppData\Roaming\vso_ts_preview.xml
2008-07-03 17:00:23 0 d-------- C:\Users\jules\AppData\Roaming\Ahead
2008-07-03 15:46:04 74 --a------ C:\Users\jules\AppData\Roaming\pcouffin.log
2008-07-03 15:45:51 47360 --a------ C:\Users\jules\AppData\Roaming\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-07-03 15:45:51 1144 --a------ C:\Users\jules\AppData\Roaming\pcouffin.inf
2008-07-03 15:45:51 7887 --a------ C:\Users\jules\AppData\Roaming\pcouffin.cat
2008-06-29 04:11:41 0 d-------- C:\Program Files\Windows Calendar
2008-06-24 15:01:39 0 d-------- C:\Program Files\Microsoft Works
2008-06-24 15:01:27 0 d-------- C:\Program Files\MSBuild
2008-06-24 15:00:47 0 d-------- C:\Program Files\Microsoft.NET
2008-06-24 14:58:10 0 d-------- C:\Program Files\Microsoft Visual Studio 8
2008-06-24 13:42:58 0 d-------- C:\Program Files\SpeedFan
2008-06-24 12:14:05 0 d-------- C:\Program Files\Electronic Arts
2008-06-24 04:39:36 0 d-------- C:\Program Files\Windows Defender
2008-06-24 04:39:33 0 d-------- C:\Program Files\Windows Sidebar
2008-06-24 02:39:14 2543 --a------ C:\Windows\unins000.dat
2008-06-24 02:36:05 691545 --a------ C:\Windows\unins000.exe
2008-06-23 22:16:40 0 d-------- C:\Program Files\Activision
2008-06-23 21:10:00 0 d-------- C:\Users\jules\AppData\Roaming\WinRAR
2008-06-23 17:18:20 0 d-------- C:\Users\jules\AppData\Roaming\vlc
2008-06-23 17:17:56 0 d-------- C:\Program Files\VideoLAN
2008-06-23 16:59:20 0 d-------- C:\Users\jules\AppData\Roaming\Macromedia
2008-06-23 16:34:12 0 d-------- C:\Users\jules\AppData\Roaming\Opera
2008-06-23 16:28:12 0 d-------- C:\Program Files\WinTV
2008-06-23 16:26:37 0 d-------- C:\Program Files\Realtek
2008-06-23 16:26:26 0 d-------- C:\Program Files\Common Files\InstallShield
2008-06-23 16:26:18 0 d-------- C:\Program Files\Common Files\Ahead
2008-06-23 16:25:19 0 d-------- C:\Program Files\Nero
2008-06-23 16:24:51 2 -r-hs---- C:\USER
2008-06-23 16:19:52 0 d-------- C:\Program Files\Alwil Software
2008-06-23 16:05:10 0 d-------- C:\Users\jules\AppData\Roaming\SampleView
2008-06-23 15:48:19 0 d-------- C:\Users\jules\AppData\Roaming\Identities
2008-06-23 15:44:51 0 d-------- C:\Program Files\Windows NT
2008-06-23 15:44:51 0 d--hs---- C:\Program Files\Fichiers communs


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [24/06/2008 03:18]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" []
"RtHDVCpl"="RtHDVCpl.exe" [29/12/2006 20:11 C:\WINDOWS\RtHDVCpl.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [16/05/2008 01:19]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [28/07/2008 17:30]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [25/03/2008 04:28]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 22:16]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [16/05/2008 14:01]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [16/05/2008 14:01]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [24/06/2008 03:06]
"WindowsWelcomeCenter"="oobefldr.dll,ShowWelcomeCenter" []
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [26/07/2008 19:22]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [02/11/2006 14:36]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Launcher"=%WINDIR%\SMINST\launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
AutoRun\command- J:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aa9e439-4160-11dd-b533-001d600d9880}]
AutoRun\command- L:\Autorun.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-07-28 18:25:17 ------------

extra .txt
Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
------------------------------------------------------------­--------------------

-- System Information ----------------------------------------------------------

Microsoft® Windows Vista™ Édition Familiale Premium (build 6000)
Architecture: X86; Language: French

CPU 0: Intel(R) Core(TM)2 CPU 6420 @ 2.13GHz
Percentage of Memory in Use: 21%
Physical Memory (total/avail): 3326.31 MiB / 2602.85 MiB
Pagefile Memory (total/avail): 6828.82 MiB / 6147.54 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1915.39 MiB

C: is Fixed (NTFS) - 457.21 GiB total, 309.01 GiB free.
D: is Fixed (NTFS) - 8.55 GiB total, 4.34 GiB free.
E: is CDROM (CDFS)
F: is Removable (No Media)
G: is Removable (No Media)
H: is Removable (No Media)
I: is Removable (No Media)
J: is CDROM (No Media)
L: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - SAMSUNG HD501LJ ATA Device - 465.76 GiB - 2 partitions
\PARTITION0 (bootable) - Système de fichiers installable - 457.21 GiB - C:
\PARTITION1 - Système de fichiers installable - 8.55 GiB - D:

\\.\PHYSICALDRIVE2 - Generic USB CF Reader USB Device

\\.\PHYSICALDRIVE4 - Generic USB MS Reader USB Device

\\.\PHYSICALDRIVE1 - Generic USB SD Reader USB Device

\\.\PHYSICALDRIVE3 - Generic USB SM Reader USB Device



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is disabled.

FW: ZoneAlarm Firewall v7.1.254.000 (Check Point, LTD.)
AV: avast! antivirus 4.8.1201 [VPS 080724-1] v4.8.1201 (ALWIL Software)
AS: Windows Defender v1.1.1505.0 (Microsoft Corporation) [COLOR=RED]Disabled/COLOR
AS: avast! antivirus 4.8.1201 [VPS 080724-1] v4.8.1201 (ALWIL Software)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\ProgramData
APPDATA=C:\Users\jules\AppData\Roaming
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=PC-DE-JULES
ComSpec=C:\Windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Users\jules
LOCALAPPDATA=C:\Users\jules\AppData\Local
LOGONSERVER=\\PC-DE-JULES
NUMBER_OF_PROCESSORS=2
OS=Windows_NT
Path=C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\Pixie\bin
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PIXIEHOME=C:\Program Files\Pixie
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 6, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0f06
ProgramData=C:\ProgramData
ProgramFiles=C:\Program Files
PROMPT=$P$G
PUBLIC=C:\Users\Public
SHADERS=C:\Program Files\Pixie\shaders
SystemDrive=C:
SystemRoot=C:\Windows
TEMP=C:\Users\jules\AppData\Local\Temp
TMP=C:\Users\jules\AppData\Local\Temp
tvdumpflags=8
USERDOMAIN=PC-de-jules
USERNAME=jules
USERPROFILE=C:\Users\jules
windir=C:\Windows


-- User Profiles ---------------------------------------------------------------

jules


-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
--> C:\Windows\UNNeroBackItUp.exe /UNINSTALL
--> C:\Windows\UNNeroMediaHome.exe /UNINSTALL
--> C:\Windows\UNNeroShowTime.exe /UNINSTALL
--> C:\Windows\UNRecode.exe /UNINSTALL
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0015-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0016-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0018-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0019-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001A-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001B-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0401-0000-0000000FF1CE} /uninstall {5A2F65A4-808F-4A1E-973E-92E17824982D}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0407-0000-0000000FF1CE} /uninstall {2AB528A5-BB1B-4EBE-8E51-AD0C4CD33CA9}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0413-0000-0000000FF1CE} /uninstall {B3F4DC34-7F60-4B7C-A79F-1C13012D99D4}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1) --> msiexec /package {90120000-0044-040C-0000-0000000FF1CE} /uninstall {A0353900-21A2-42CF-B973-883500A027F7}
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) --> MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX --> C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin --> C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 8.1.2 - Français --> MsiExec.exe /I{AC76BA86-7AD7-1036-7B44-A81200000003}
Adobe Reader 8.1.2 Security Update 1 (KB403742) -->
Age of Conan : Hyborian Adventures --> "C:\Program Files\Funcom\Age of Conan\unins000.exe"
Archiveur WinRAR --> C:\Program Files\WinRAR\uninstall.exe
Assistant de connexion Windows Live --> MsiExec.exe /I{AFA4E5FD-ED70-4D92-99D0-162FD56DC986}
avast! Antivirus --> C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
Call of Duty(R) 4 - Modern Warfare(TM) --> C:\Program Files\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x040c
ConvertXtoDVD 3.0.0.1 --> "C:\Program Files\VSO\ConvertX\3\unins000.exe"
eMulev0.48a.-MorphXTv10.5 --> "C:\Program Files\eMule\unins000.exe"
Furnish Pro --> C:\Windows\unvise32.exe C:\Program Files\Furnish Pro\Furnish Pro uninstal.log
GOM Player --> "C:\Program Files\GRETECH\GomPlayer\Uninstall.exe"
Hauppauge MCE XP/Vista Software Encoder (2.0.25022) --> C:\PROGRA~1\WinTV\UNSftMCE.EXE C:\PROGRA~1\WinTV\softMCE.LOG
Java(TM) 6 Update 6 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Les Chevaliers de Baphomet - Les Gardiens du Temple de Salomon --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F41C11EC-7C13-47A7-A07C-251D96EC3879}\setup.exe" -l0x40c -removeonly
Microsoft Office Access MUI (French) 2007 --> MsiExec.exe /X{90120000-0015-040C-0000-0000000FF1CE}
Microsoft Office Excel MUI (French) 2007 --> MsiExec.exe /X{90120000-0016-040C-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (French) 2007 --> MsiExec.exe /X{90120000-0044-040C-0000-0000000FF1CE}
Microsoft Office Language Pack 2007 Service Pack 1 (SP1) --> msiexec /package {90120000-006E-040C-0000-0000000FF1CE} /uninstall {EC50B538-CBE1-42E6-B7FE-87AA540AADFB}
Microsoft Office Outlook MUI (French) 2007 --> MsiExec.exe /X{90120000-001A-040C-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (French) 2007 --> MsiExec.exe /X{90120000-0018-040C-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007 --> MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (Arabic) 2007 --> MsiExec.exe /X{90120000-001F-0401-0000-0000000FF1CE}
Microsoft Office Proof (Dutch) 2007 --> MsiExec.exe /X{90120000-001F-0413-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007 --> MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007 --> MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007 --> MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (French) 2007 --> MsiExec.exe /X{90120000-002C-040C-0000-0000000FF1CE}
Microsoft Office Publisher MUI (French) 2007 --> MsiExec.exe /X{90120000-0019-040C-0000-0000000FF1CE}
Microsoft Office Shared MUI (French) 2007 --> MsiExec.exe /X{90120000-006E-040C-0000-0000000FF1CE}
Microsoft Office Word MUI (French) 2007 --> MsiExec.exe /X{90120000-001B-040C-0000-0000000FF1CE}
Microsoft Silverlight --> MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Mozilla Firefox (3.0.1) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Need for Speed™ ProStreet --> MsiExec.exe /X{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}
Nero 7 Essentials --> MsiExec.exe /I{AEF06A82-9986-4CDD-91DA-CD958F151036}
NVIDIA Drivers --> C:\Windows\system32\NVUNINST.EXE UninstallGUI
Opera 9.51 --> MsiExec.exe /X{179624B1-2683-45ED-965A-B72189EB5820}
Pixie 1.4.1 --> "C:\Program Files\Pixie\unins000.exe"
Real Alternative 1.8.0 --> "C:\Program Files\Real Alternative\unins000.exe"
Realtek High Definition Audio Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x40c -removeonly
Security Update for Excel 2007 (KB946974) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Microsoft Office Publisher 2007 (KB950114) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office Word 2007 (KB950113) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Office 2007 (KB947801) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
SpeedFan (remove only) --> "C:\Program Files\SpeedFan\uninstall.exe"
Spybot - Search & Destroy --> "C:\Program Files\Spybot - Search & Destroy\unins001.exe"
Spybot - Search & Destroy 1.5.2.20 --> "C:\Windows\unins000.exe"
Update for Microsoft Office Outlook 2007 (KB952142) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {4AD3A076-427C-491F-A5B7-7D1DE788A756}
Update for Office 2007 (KB946691) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb953463) --> msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {1B78D541-9FF1-4330-ADD8-CED14F0C1E8E}
VideoLAN VLC media player 0.8.6c --> C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Live installer --> MsiExec.exe /X{FD44E544-E7D0-4DBA-9FA0-8AE1A1300390}
Windows Live Messenger --> MsiExec.exe /X{BADF6744-3787-48F6-B8C9-4C4995401D65}
Wysigot --> "C:\Wysigot\unins000.exe"
ZoneAlarm --> C:\Program Files\Zone Labs\ZoneAlarm\zauninst.exe


-- Application Event Log -------------------------------------------------------

Event Record #/Type2483 / Success
Event Submitted/Written: 07/28/2008 05:29:02 PM
Event ID/Source: 5617 / WinMgmt
Event Description:


Event Record #/Type2482 / Success
Event Submitted/Written: 07/28/2008 05:29:02 PM
Event ID/Source: 5615 / WinMgmt
Event Description:


Event Record #/Type2480 / Success
Event Submitted/Written: 07/28/2008 05:28:16 PM
Event ID/Source: 902 / Software Licensing Service
Event Description:
Le service de gestion des licences du logiciel a démarré.

Event Record #/Type2470 / Success
Event Submitted/Written: 07/28/2008 05:27:11 PM
Event ID/Source: 903 / Software Licensing Service
Event Description:
Le service de gestion de licences du logiciel s'est arrêté.

Event Record #/Type2463 / Success
Event Submitted/Written: 07/28/2008 04:26:21 PM
Event ID/Source: 5617 / WinMgmt
Event Description:




-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type21158 / Error
Event Submitted/Written: 07/28/2008 05:29:12 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
TrueVector Internet Monitor%%193

Event Record #/Type21055 / Error
Event Submitted/Written: 07/28/2008 04:26:32 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
TrueVector Internet Monitor%%193

Event Record #/Type20953 / Error
Event Submitted/Written: 07/28/2008 03:03:03 PM
Event ID/Source: 7000 / Service Control Manager
Event Description:
TrueVector Internet Monitor%%193

Event Record #/Type20902 / Warning
Event Submitted/Written: 07/28/2008 01:17:10 AM
Event ID/Source: 51 / cdrom
Event Description:
Une erreur a été détectée sur le périphérique \Device\CdRom0 lors d'une opération de pagination.

Event Record #/Type20895 / Error
Event Submitted/Written: 07/27/2008 11:13:22 PM
Event ID/Source: 11 / cdrom
Event Description:
Le pilote a détecté une erreur du contrôleur sur \Device\CdRom0.



-- End of Deckard's System Scanner: finished at 2008-07-28 18:25:17 ------------

pendant que l on regarde tes rapport verifie si le mode sans echec marche et dis nous



Comment redémarrer en mode sans echec?

Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
Ps : si F8 ne marche pas utilise la touche F5.

-> Tuto :http://www.pcloisirs.eu/mode_sans_echec.htm A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                  Bonne écoute 

ok

en faisant f8 , j'ai un écran avec un fond bleu avec des truc bizarre , boot agent....??
avec f5 j'ai des truc avec un fond noir pour faire un test mémoire windows

je suis sous vista avec un truc multimedis, mais en faisant reset , je sais que j'ai accès au truc avec mode sans echec

Donc j'ai selectionné mode sans échec et ça marche .

ok


-> Redémarre en mode sans échec avec prise en charge reseau :

Comment redémarrer en mode sans echec avec prise en charge reseau ?

Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec avec prise en charge reseau puis tape entrée.
Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
Ps : si F8 ne marche pas utilise la touche F5.

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Avant de telecharger combofix renome le en killbagle et enregistre le sur le bureau


-> Double clique sur killbagle.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.


Une fois fait, sur ton bureau double-clic sur killbagle.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)


-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.


A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                  Bonne écoute 

demarrer sans echec sous vista

.cliques sur démarrer
.sur panneau de configuration
.sur outils d'administration
.sur configuration système
.sur le message cliques sur continuer
.sur la nouvel fenêtre choisir démarrage en mode diagnostic
.puis cliques sur appliquer et OK
.sur la demande sur redémarrer

une fois redémarrer en mode diagnostic fais ce que tu as à faire et puis pour revenir au mode normal tu refais la même chose

démarrer/panneau de configuration/ outils d'administration
et faire le chois démarrage normal/ appliquer et OK /redémarrer

tutoriel en images si tu as un problème:

http://bibou0007.com/...

ComboFix 08-07-27.6 - SYSTEM 2008-07-28 19:40:53.1 - NTFSx86 MINIMAL
Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6000.0.1252.1.1036.18.2940 [GMT 2:00]
Endroit: C:\Windows\system32\config\systemprofile\Desktop\Killbagle.exe
* Resident AV is active

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\downld
C:\Windows\system32\drivers\downld\150556.exe
C:\Windows\system32\drivers\downld\185875.exe
C:\Windows\system32\drivers\downld\192474.exe
C:\Windows\system32\drivers\downld\198854.exe
C:\Windows\system32\drivers\downld\200461.exe
C:\Windows\system32\drivers\downld\206966.exe
C:\Windows\system32\drivers\downld\262268.exe
C:\Windows\system32\drivers\downld\272658.exe
C:\Windows\system32\drivers\downld\58796.exe
C:\Windows\system32\drivers\downld\77735.exe
C:\Windows\system32\drivers\downld\88920.exe
C:\Windows\system32\drivers\downld\91151.exe
C:\Windows\system32\drivers\downld\97828.exe
C:\Windows\system32\drivers\hldrrr.exe
C:\Windows\system32\drivers\mdelk.exe
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SROSA
-------\Service_srosa


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-28 to 2008-07-28 ))))))))))))))))))))))))))))))))))))
.

Pas de nouveau fichier cr‚‚ dans cet espace de temps

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-26 16:32 0 ----a-w C:\ntuser.dat
2008-07-25 16:19 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-07-24 20:40 --------- d-----w C:\PROGRA~2\Spybot - Search & Destroy
2008-07-24 18:43 352,615 ---ha-w C:\Windows\system32\drivers\vsconfig.xml
2008-07-24 18:35 --------- d-----w C:\Program Files\DAEMON Tools
2008-07-24 14:05 --------- d-----w C:\Program Files\antitrock
2008-07-19 12:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-19 12:28 --------- d-----w C:\Program Files\THQ
2008-07-18 06:04 3,650,560 ----a-w C:\Windows\Internet Logs\xDB9C4E.tmp
2008-07-17 21:16 --------- d-----w C:\PROGRA~2\NVIDIA
2008-07-17 01:44 --------- d-----w C:\PROGRA~2\media center programs
2008-07-17 01:01 --------- d-----w C:\Program Files\Funcom
2008-07-17 00:59 --------- d-----w C:\PROGRA~2\Funcom
2008-07-17 00:41 3,117,056 ----a-w C:\Windows\Internet Logs\xDBA8BC.tmp
2008-07-11 21:05 --------- d-----w C:\Program Files\Opera
2008-07-10 14:58 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-09 20:09 --------- d-----w C:\PROGRA~2\Microsoft Help
2008-07-09 20:05 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-07-09 14:20 --------- d---a-w C:\Program Files\Furnish Pro
2008-07-09 14:20 --------- d-----w C:\Program Files\Pixie
2008-07-09 01:28 174 --sha-w C:\Program Files\desktop.ini
2008-07-09 01:00 --------- d-----w C:\Program Files\Windows Mail
2008-07-08 16:57 --------- d-----w C:\Program Files\Java
2008-07-08 16:56 --------- d-----w C:\Program Files\Common Files\Java
2008-07-03 22:20 429,568 ----a-w C:\Windows\Internet Logs\xDBB9FB.tmp
2008-07-03 22:04 --------- d-----w C:\Program Files\Real Alternative
2008-07-03 21:59 --------- d-----w C:\PROGRA~2\GRETECH
2008-07-03 21:57 --------- d-----w C:\Program Files\GRETECH
2008-07-03 13:45 --------- d-----w C:\Program Files\VSO
2008-06-29 02:11 --------- d-----w C:\Program Files\Windows Calendar
2008-06-29 01:04 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-06-29 01:04 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-06-29 01:04 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-06-29 01:04 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-06-29 01:04 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-06-28 17:33 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-28 17:33 --------- d-----w C:\Program Files\Windows Live
2008-06-28 17:25 2,402,832 ----a-w C:\WLinstaller.exe
2008-06-28 17:25 --------- d-----w C:\PROGRA~2\WLInstaller
2008-06-24 13:01 --------- d-----w C:\Program Files\MSBuild
2008-06-24 13:01 --------- d-----w C:\Program Files\Microsoft Works
2008-06-24 13:00 --------- d-----w C:\Program Files\Microsoft.NET
2008-06-24 12:58 --------- d-----w C:\Program Files\Microsoft Visual Studio 8
2008-06-24 11:42 --------- d-----w C:\Program Files\SpeedFan
2008-06-24 10:14 --------- d-----w C:\Program Files\Electronic Arts
2008-06-24 02:39 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-24 02:39 --------- d-----w C:\Program Files\Windows Defender
2008-06-24 01:20 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-06-24 01:20 2,923,520 ----a-w C:\Windows\explorer.exe
2008-06-24 01:20 110,080 ----a-w C:\Windows\system32\drivers\mrxdav.sys
2008-06-24 01:18 41,984 ----a-w C:\Windows\system32\drivers\monitor.sys
2008-06-24 01:18 1,060,920 ----a-w C:\Windows\system32\drivers\ntfs.sys
2008-06-24 01:15 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-06-24 01:15 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-06-24 01:15 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-06-24 01:14 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-06-24 01:14 211,000 ----a-w C:\Windows\system32\drivers\volsnap.sys
2008-06-24 01:14 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-06-24 01:14 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-06-24 01:14 15,928 ----a-w C:\Windows\system32\drivers\pciide.sys
2008-06-24 01:14 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-06-24 01:13 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-06-24 01:13 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-06-24 01:10 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-06-24 01:10 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-06-24 01:10 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-06-24 01:10 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-06-24 01:10 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-06-24 01:10 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-06-24 01:10 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys
2008-06-24 01:07 113,664 ----a-w C:\Windows\system32\drivers\rmcast.sys
2008-06-24 01:06 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-06-24 01:06 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-06-24 01:06 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-06-24 01:06 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-06-24 01:06 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-06-24 01:05 84,992 ----a-w C:\Windows\system32\drivers\srvnet.sys
2008-06-24 01:05 58,368 ----a-w C:\Windows\system32\drivers\mrxsmb20.sys
2008-06-24 01:05 53,760 ----a-w C:\Windows\system32\drivers\hdaudbus.sys
2008-06-24 01:05 130,048 ----a-w C:\Windows\system32\drivers\srv2.sys
2008-06-24 01:05 101,888 ----a-w C:\Windows\system32\drivers\mrxsmb.sys
2008-06-24 01:04 12,800 ----a-w C:\Windows\system32\drivers\fs_rec.sys
2008-06-24 01:02 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-24 00:55 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-24 00:36 691,545 ----a-w C:\Windows\unins000.exe
2008-06-23 20:16 --------- d-----w C:\Program Files\Activision
2008-06-23 20:05 685,816 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-06-23 15:17 --------- d-----w C:\Program Files\VideoLAN
2008-06-23 14:48 --------- d-----w C:\Program Files\Zone Labs
2008-06-23 14:48 --------- d-----w C:\PROGRA~2\CheckPoint
2008-06-23 14:28 --------- d-----w C:\Program Files\WinTV
2008-06-23 14:26 319,456 ----a-w C:\Windows\DIFxAPI.dll
2008-06-23 14:26 --------- d-----w C:\Program Files\Realtek
2008-06-23 14:26 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-06-23 14:26 --------- d-----w C:\Program Files\Common Files\Ahead
2008-06-23 14:25 --------- d-----w C:\Program Files\Nero
2008-06-23 14:25 --------- d-----w C:\PROGRA~2\Nero
2008-06-23 14:19 --------- d-----w C:\Program Files\Alwil Software
2008-06-23 13:44 --------- d-sh--w C:\Program Files\Fichiers communs
2008-06-23 13:44 --------- d-sh--w C:\PROGRA~2\Modèles
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-06-24 03:06 1232896]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-26 19:22 2097488]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]
"WindowsWelcomeCenter"="oobefldr.dll" [2006-11-02 14:34 2159104 C:\WINDOWS\System32\oobefldr.dll]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-16 01:19 79224]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-28 18:53 959976]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-05-16 14:01 13535776]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-05-16 14:01 92704]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-29 20:11 4317184 C:\WINDOWS\RtHDVCpl.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-940212003-742955070-3152845943-1000]
"EnableNotificationsRef"=dword:00000003

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{EEAA6ACC-3F76-4C04-8700-81398A89C986}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{ADC6821B-AC70-47B9-B00A-A79AEFEDCD18}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM)
"{45FC8FE2-351E-4161-9EA8-E9F0A49F1B12}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{CE94B7E8-2AC8-4DDA-977A-AFD0F5565640}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{23D31F51-5F6D-4D31-9025-81468DC8B064}"= UDP:C:\Program Files\eMule\emule.exe:eMuleMorphXT
"{D6551345-EE6E-4E7B-8E4F-962D40F7C00C}"= TCP:C:\Program Files\eMule\emule.exe:eMuleMorphXT

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-05-16 01:20]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-05-16 01:18]
R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Controller;C:\Windows\system32\DRIVERS\atl01v32.sys [2006-11-16 07:24]
R3 Hauppauge WinTV-HVR;Hauppauge WinTV-HVR 713X PCI Card;C:\Windows\system32\DRIVERS\HCW713x.sys [2006-07-07 16:36]
S3 Ph3xIB32;Philips 713x VU PCI TV Card;C:\Windows\system32\DRIVERS\Ph3xIB32.sys [2006-11-02 10:27]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\Autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1aa9e439-4160-11dd-b533-001d600d9880}]
\shell\AutoRun\command - L:\Autorun.exe
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-NeroFilterCheck - C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe


.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-28 19:45:58
Windows 6.0.6000 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\nvvsvc.exe
C:\WINDOWS\System32\audiodg.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\System32\WUDFHost.exe
C:\WINDOWS\System32\conime.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-28 19:47:37 - machine was rebooted [jules]
ComboFix-quarantined-files.txt 2008-07-28 17:47:26

Pre-Run: Le texte du message associé au numéro 0x2379 est introuvable dans le fichier de messages pour Application.
Post-Run: 331,557,474,304 octets libres

224 --- E O F --- 2008-07-22 20:25:45

avast remarche , le centre de sécurité de windows aussi, mais pas windows defender ; ni zone alarm , ni spybot

il va falloir désinstaller tes protetections et les réinstaller

ensuite :


en mode normal :


Télécharge HijackThis ici :

-> http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe


Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol.fr/balltrap34/Hijenr.gif

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

Post le rapport généré ici stp...
A découvrir : Estopa, Rosario Flores, La Oreja De Van Gogh
                  Bonne écoute 

ok je vais m'ocuper de cela , mais windows defender , je peux le déinstaller , il est d'origine avec vista .
ET je viens de voir que le centre de sécurité de windows me dit que zone alarm est en activité(mais moi j'y ai pas accès) donc je l'efface quand même? ( de toutefaçon ça me coute rien de l'effacer)