[claudiojoli]

bonsoir à tous,

je n'arrive pas à demarrer Avast apres une re installation. Je pense avoir attrape un truc pas bon sur le PC
j'ai le message d'erreur suivant

"C:\Program Files\...\ashAvast.exe n'est pas une application Win32 valide"

j'ai fait deux fois desinstall puis re install mais c'est toujours pareil

quelqu'un a t'il une idee du souci??merci, bonne soiree, Claudio 

[zaede]

Bonjour claudiojoli, pas bon signe ça


- Télécharge FindyKill (de Chiquitine29)

http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe Enregistre ce fichier sur le bureau

- Double clic sur FindyKill.exe afin de lancer son installation

- Double clic sur le raccourci FindyKill qui est sur le bureau

- Au menu principal, choisis l'option 1 (Recherche)

- La recherche terminée poste le contenu de C:\FindyKill.txt

- Aide pour FindyKill http://www.malekal.com/tutorial_FindyKill.php

NOTE:
FindyKill peut être détecté par certains antivirus.
Ne pas en tenir compte, c'est un faux positif
Cliquer sur ignorer et continuer la procédure 

[claudiojoli]

ok merci,

des que la manip est faite je reviens

question: "poste le contenu de C:\FindyKill.txt " ici, sur le forum ?

merci, Claudio 

[Geronimo]

Bonjour claudiojoli

- C'est exact tu poste le contenu de C:\FindyKill.txt ici dans ta prochaine réponse. 

[claudiojoli]

voila ce que j'ai
desole c'est tres long (y a peut etre une autre facon de faire...)
merci, Claudio

############################## [ FindyKill V4.727 ]

# User : Clode (Administrateurs) # PC_CLODE
# Update on 27/04/09 by Chiquitine29
# Start at: 07:41:04 | 30/04/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

# Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 50 Go (25,91 Go free) [System] # NTFS
# D:\ # Disque fixe local # 415,76 Go (347,61 Go free) [PC Clode] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## [ Processus actifs ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\SFR\Media Center\MediaCenter.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Clode\Application Data\drivers\winupgro.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SFR\Media Center\httpd\httpd.exe
C:\Program Files\SFR\Media Center\httpd\httpd.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Documents and Settings\Clode\Application Data\m\flec006.exe
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FAMTEDE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Processus infectieux stoppés ]

"C:\Documents and Settings\Clode\Application Data\drivers\winupgro.exe" (1920)
"C:\Documents and Settings\Clode\Application Data\m\flec006.exe" (468)
"C:\WINDOWS\system32\wintems.exe" (3864)

################## [ Fichiers / Dossiers infectieux ]

Found ! C:\WINDOWS\Prefetch\1000781.EXE-04EF84B0.pf
Found ! C:\WINDOWS\Prefetch\101781.EXE-3A83E878.pf
Found ! C:\WINDOWS\Prefetch\123500.EXE-194825A0.pf
Found ! C:\WINDOWS\Prefetch\1247953.EXE-32B677E4.pf
Found ! C:\WINDOWS\Prefetch\126062.EXE-2F4DFDEE.pf
Found ! C:\WINDOWS\Prefetch\147734.EXE-081B87F1.pf
Found ! C:\WINDOWS\Prefetch\156250.EXE-08BD7F48.pf
Found ! C:\WINDOWS\Prefetch\173875.EXE-0E4569E5.pf
Found ! C:\WINDOWS\Prefetch\193000.EXE-2BD69AFE.pf
Found ! C:\WINDOWS\Prefetch\200921.EXE-39E6BE1E.pf
Found ! C:\WINDOWS\Prefetch\205984.EXE-3AD0CA31.pf
Found ! C:\WINDOWS\Prefetch\206953.EXE-03FD7E2C.pf
Found ! C:\WINDOWS\Prefetch\209843.EXE-360A2B08.pf
Found ! C:\WINDOWS\Prefetch\212359.EXE-20A56845.pf
Found ! C:\WINDOWS\Prefetch\219687.EXE-02BD6C77.pf
Found ! C:\WINDOWS\Prefetch\221609.EXE-0B4F2900.pf
Found ! C:\WINDOWS\Prefetch\273593.EXE-1E14152E.pf
Found ! C:\WINDOWS\Prefetch\289250.EXE-15FC5DF2.pf
Found ! C:\WINDOWS\Prefetch\325562.EXE-0688E9DC.pf
Found ! C:\WINDOWS\Prefetch\339093.EXE-2B668751.pf
Found ! C:\WINDOWS\Prefetch\462281.EXE-0005461C.pf
Found ! C:\WINDOWS\Prefetch\516484.EXE-01FDF228.pf
Found ! C:\WINDOWS\Prefetch\528390.EXE-07C30BC2.pf
Found ! C:\WINDOWS\Prefetch\83906.EXE-22FBFE10.pf
Found ! C:\WINDOWS\Prefetch\986453.EXE-335AD8E1.pf
Found ! C:\WINDOWS\Prefetch\FLEC006.EXE-19B51067.pf
Found ! C:\WINDOWS\Prefetch\MDELK.EXE-1D176F91.pf
Found ! C:\WINDOWS\Prefetch\WINTEMS.EXE-2A563F9B.pf
Found ! C:\WINDOWS\system32\ban_list.txt
Found ! C:\WINDOWS\system32\mdelk.exe
Found ! C:\WINDOWS\system32\wintems.exe
Found ! "C:\Documents and Settings\Clode\Application Data\drivers"
Found ! "C:\Documents and Settings\Clode\Application Data\drivers\downld"
Found ! "C:\Documents and Settings\Clode\Application Data\drivers\srosa2.sys"
Found ! "C:\Documents and Settings\Clode\Application Data\drivers\wfsintwq.sys"
Found ! "C:\Documents and Settings\Clode\Application Data\drivers\winupgro.exe"
Found ! "C:\Documents and Settings\Clode\Application Data\m"
Found ! "C:\Documents and Settings\Clode\Application Data\m\data.oct"
Found ! "C:\Documents and Settings\Clode\Application Data\m\flec006.exe"
Found ! "C:\Documents and Settings\Clode\Application Data\m\list.oct"
Found ! "C:\Documents and Settings\Clode\Application Data\m\shared"
Found ! "C:\Documents and Settings\Clode\Application Data\m\srvlist.oct"

################## [ Infected Temp Files ]

Found ! C:\Documents and Settings\Clode\Local Settings\Temporary Internet Files\Content.IE5\6LHAE3GC\b64_3[1].jpg
Found ! C:\Documents and Settings\Clode\Local Settings\Temporary Internet Files\Content.IE5\6LHAE3GC\file[1].txt
Found ! C:\Documents and Settings\Clode\Local Settings\Temporary Internet Files\Content.IE5\E1034LWR\b640440019_98422065019_518[1].jpg
Found ! C:\Documents and Settings\Clode\Local Settings\Temporary Internet Files\Content.IE5\OLKHY7OH\mxd[1].jpg

################## [ Registre / Clés infectieuses ]

Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\Local AppWizard-Generated Applications\install_patch
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\Local AppWizard-Generated Applications\winupgro
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\bisoft
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\DateTime4
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\FFC
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\MuleAppData
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch
Found ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Found ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Found ! HKEY_CURRENT_USER\Software\bisoft
Found ! HKEY_CURRENT_USER\Software\DateTime4
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Found ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"
Found ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

# (!) HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
# (!) HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1

################## [ Recherche dans supports amovibles]


################## [ Registre / Mountpoints2 ]

# -> Not found !

################## [ ! Fin du rapport # FindyKill V4.727 ! ] 

[Geronimo]

C'est une infection par bagle.

1/

- Relance FindyKill, choisis l'option 2 (Suppression) au menu principal

- Pendant la phase de suppression le PC va redémarrer, laisse travailler l'outil jusqu'à l'apparition du message Nettoyage effectué !

- Poste le contenu C:\FindyKill.txt dans ta prochaine réponse.


2/

- Suis précisément les instructions données pour le téléchargement et l'enregistrement du fichier c'est important

- Combofix doit être renommé au moment du téléchargement et non une fois enregistré sur le bureau

-Fais un clic droit sur l'un de ces liens
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

- Choisis Enregistrer la cible sous ...
- Choisis le bureau comme lieu d'enregistrement

- Donne lui ce nom ce nom Combo-Fix.exe clique sur Enregistrer



- Fais un double clic sur Combo-Fix.exe laisse ensuite le scan se dérouler sans toucher à la souris ni au clavier.

* Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Note : Tu as deux rapports à poster 

[claudiojoli]

voili voulou, les 2 rapports
de plus en plus long...


############################## [ FindyKill V4.727 ]

# User : Clode (Administrateurs) # PC_CLODE
# Update on 27/04/09 by Chiquitine29
# Start at: 19:10:08 | 30/04/2009
# Website : http://pagesperso-orange.fr/FindyKill.Ad.Remover/

# Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz
# Microsoft Windows XP Professionnel (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 8.0.6001.18702
# Windows Firewall Status : Enabled

# C:\ # Disque fixe local # 50 Go (25,9 Go free) [System] # NTFS
# D:\ # Disque fixe local # 415,76 Go (347,61 Go free) [PC Clode] # NTFS
# E:\ # Disque CD-ROM
# F:\ # Disque CD-ROM

############################## [ Active Processes ]

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\SCardSvr.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40ST7.EXE
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fujitsu Siemens Computers\SystemDiagnostics\OnlineDiagnostic\TestManager\TestHandler.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

################## [ Infected Files \ Folders ]

Deleted ! C:\WINDOWS\Prefetch\1000781.EXE-04EF84B0.pf
Deleted ! C:\WINDOWS\Prefetch\101781.EXE-3A83E878.pf
Deleted ! C:\WINDOWS\Prefetch\123500.EXE-194825A0.pf
Deleted ! C:\WINDOWS\Prefetch\1247953.EXE-32B677E4.pf
Deleted ! C:\WINDOWS\Prefetch\126062.EXE-2F4DFDEE.pf
Deleted ! C:\WINDOWS\Prefetch\147734.EXE-081B87F1.pf
Deleted ! C:\WINDOWS\Prefetch\156250.EXE-08BD7F48.pf
Deleted ! C:\WINDOWS\Prefetch\173875.EXE-0E4569E5.pf
Deleted ! C:\WINDOWS\Prefetch\193000.EXE-2BD69AFE.pf
Deleted ! C:\WINDOWS\Prefetch\200921.EXE-39E6BE1E.pf
Deleted ! C:\WINDOWS\Prefetch\205984.EXE-3AD0CA31.pf
Deleted ! C:\WINDOWS\Prefetch\206953.EXE-03FD7E2C.pf
Deleted ! C:\WINDOWS\Prefetch\209843.EXE-360A2B08.pf
Deleted ! C:\WINDOWS\Prefetch\212359.EXE-20A56845.pf
Deleted ! C:\WINDOWS\Prefetch\219687.EXE-02BD6C77.pf
Deleted ! C:\WINDOWS\Prefetch\221609.EXE-0B4F2900.pf
Deleted ! C:\WINDOWS\Prefetch\273593.EXE-1E14152E.pf
Deleted ! C:\WINDOWS\Prefetch\289250.EXE-15FC5DF2.pf
Deleted ! C:\WINDOWS\Prefetch\325562.EXE-0688E9DC.pf
Deleted ! C:\WINDOWS\Prefetch\339093.EXE-2B668751.pf
Deleted ! C:\WINDOWS\Prefetch\462281.EXE-0005461C.pf
Deleted ! C:\WINDOWS\Prefetch\516484.EXE-01FDF228.pf
Deleted ! C:\WINDOWS\Prefetch\528390.EXE-07C30BC2.pf
Deleted ! C:\WINDOWS\Prefetch\83906.EXE-22FBFE10.pf
Deleted ! C:\WINDOWS\Prefetch\986453.EXE-335AD8E1.pf
Deleted ! C:\WINDOWS\Prefetch\FLEC006.EXE-19B51067.pf
Deleted ! C:\WINDOWS\Prefetch\MDELK.EXE-1D176F91.pf
Deleted ! C:\WINDOWS\Prefetch\WINTEMS.EXE-2A563F9B.pf
Deleted ! C:\WINDOWS\Prefetch\WINUPGRO.EXE-17681AA8.pf
Deleted ! C:\WINDOWS\system32\ban_list.txt
Deleted ! C:\WINDOWS\system32\mdelk.exe
Deleted ! C:\WINDOWS\system32\wintems.exe
Deleted ! "C:\Documents and Settings\Clode\Application Data\drivers\srosa2.sys"
Deleted ! "C:\Documents and Settings\Clode\Application Data\drivers\wfsintwq.sys"
Deleted ! "C:\Documents and Settings\Clode\Application Data\drivers\winupgro.exe"
Deleted ! "C:\Documents and Settings\Clode\Application Data\m\data.oct"
Deleted ! "C:\Documents and Settings\Clode\Application Data\m\flec006.exe"
Deleted ! "C:\Documents and Settings\Clode\Application Data\m\list.oct"
Deleted ! "C:\Documents and Settings\Clode\Application Data\m\srvlist.oct"
Deleted ! "C:\Documents and Settings\Clode\Application Data\drivers\downld"
Deleted ! "C:\Documents and Settings\Clode\Application Data\drivers"
Deleted ! "C:\Documents and Settings\Clode\Application Data\m\shared"
Deleted ! "C:\Documents and Settings\Clode\Application Data\m"

################## [ Infected Temp Files ]

Deleted ! C:\DOCUME~1\Clode\LOCALS~1\Temp\44555\AUTORUN.EXE
Deleted ! C:\Documents and Settings\Clode\Local Settings\Temporary Internet Files\Content.IE5\E1034LWR\b640440019_98422065019_518[1].jpg
Deleted ! C:\Documents and Settings\Clode\Local Settings\Temporary Internet Files\Content.IE5\OLKHY7OH\mxd[1].jpg

################## [ Registry / Infected keys ]

Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\srosa
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SROSA
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sK9Ou0s
Deleted ! HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_SK9OU0S
Deleted ! HKEY_CURRENT_USER\Software\bisoft
Deleted ! HKEY_CURRENT_USER\Software\DateTime4
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\install_patch
Deleted ! HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro
Deleted ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\FFC
Deleted ! HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\MuleAppData
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"drvsyskit"
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"german.exe"
Deleted ! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\"mule_st_key"

################## [ Cleaning Removable drives ]


################## [ Registry / Mountpoint2 ]

# -> Not found !

################## [ States / Restarting of services ]

# Services : [ Auto=2 / Request=3 / Disable=4 ]

# Ndisuio -> # Type of startup =3
# EapHost -> # Type of startup =2
# Ip6Fw -> # Type of startup =2
# SharedAccess -> # Type of startup =2
# wuauserv -> # Type of startup =2
# wscsvc -> # Type of startup =2
# Safe boot mode restored !

################## [ Searching Other Infections ]

# Références de comparaison Bagle MD5 :

File ... : C:\Documents and Settings\Clode\Application Data\drivers\winupgro.exe
CRC32 .. : e4ed0649
MD5 .... : bdd6331141d561d22a00b832ce6f6327

Deleted ! : C:\Program Files\eMule\Incoming\eOffice Professional Edition 3.200.028\install_patch.exe
# Taille : 880640 # MD5 : BDD6331141D561D22A00B832CE6F6327

Deleted ! : C:\Program Files\eMule\Incoming\eOffice Professional Edition 3.200.028.zip
Contain install_patch.exe [880640] with Bagle CRC32 : E4ED0649

Deleted ! : C:\Program Files\Messenger\msmsgs.exe
# Taille : 880640 # MD5 : BDD6331141D561D22A00B832CE6F6327


################## [ Corrupted files # Re-Installation required ]

C:\Program Files\Alwil Software\Avast4\ashAvast.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashLogV.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashPopWz.exe
C:\Program Files\Alwil Software\Avast4\ashQuick.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Alwil Software\Avast4\ashSimp2.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Alwil Software\Avast4\ashSkPcc.exe
C:\Program Files\Alwil Software\Avast4\ashSkPck.exe
C:\Program Files\Alwil Software\Avast4\ashUpd.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\aswRegSvr.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\sched.exe
C:\Program Files\Alwil Software\Avast4\VisthLic.exe
C:\Program Files\Alwil Software\Avast4\VisthUpd.exe

################################### [ Cracks / Keygens / Serials ]

# -> Nothing found !

################## [ ! End of Report # FindyKill V4.727 ! ]

ComboFix 09-04-29.07 - Clode 30/04/2009 19:28.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.1790.1262 [GMT 2:00]
Lancé depuis: c:\documents and settings\Clode\Bureau\Combo-Fix.exe
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\cfgdll.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-05-28 au 2009-4-30 ))))))))))))))))))))))))))))))))))))
.

2009-04-30 17:15 . 2009-04-30 17:15 -------- d-----w c:\windows\LastGood
2009-04-30 17:14 . 2009-04-30 17:14 -------- d-----w c:\windows\system32\KB905474
2009-04-30 17:14 . 2009-03-10 20:26 1438080 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-30 17:14 . 2009-03-10 20:18 454024 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-30 05:40 . 2009-04-30 17:14 -------- d-----w C:\FindyKill
2009-04-26 06:56 . 2009-04-26 06:56 -------- d-----w c:\documents and settings\Clode\Application Data\Research In Motion
2009-04-26 06:55 . 2009-04-26 06:55 -------- d-----w c:\documents and settings\Clode\Application Data\Blackberry Desktop
2009-04-26 06:55 . 2009-04-26 06:55 -------- d-----w c:\program files\Fichiers communs\Research In Motion
2009-04-26 06:55 . 2009-04-26 06:55 -------- d-----w c:\program files\Research In Motion
2009-04-22 18:41 . 2009-04-22 18:41 -------- d-----w c:\documents and settings\Clode\Application Data\InstallShield
2009-04-22 14:53 . 2009-04-22 18:41 -------- d-----w c:\program files\ABBYY FineReader 6.0 Sprint
2009-04-22 14:50 . 2007-04-10 10:06 8192 ----a-w c:\windows\system32\E_DCINST.DLL
2009-04-22 14:50 . 2007-12-07 11:01 78848 ----a-w c:\windows\system32\E_FD4BEDE.DLL
2009-04-22 14:50 . 2007-12-07 11:08 86528 ----a-w c:\windows\system32\E_FLBEDE.DLL
2009-04-22 14:50 . 2009-04-22 14:50 -------- d-----w c:\documents and settings\All Users\Application Data\EPSON
2009-04-22 14:50 . 2009-04-22 18:41 -------- d-----w c:\program files\epson
2009-04-22 14:47 . 2007-07-12 22:00 71680 ----a-w c:\windows\system32\escwiad.dll
2009-04-18 06:13 . 2001-05-16 15:54 309616 ----a-w c:\windows\system32\wmv8dmod.dll
2009-04-18 06:13 . 2001-05-11 11:18 420240 ----a-w c:\windows\system32\mpg4c32.dll
2009-04-17 17:24 . 2009-04-17 17:24 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-04-17 06:03 . 2009-04-17 06:03 -------- d-sh--w c:\documents and settings\Default User\IETldCache
2009-04-17 05:33 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 05:33 . 2009-03-06 14:20 286720 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-17 05:33 . 2009-02-09 11:23 111104 ------w c:\windows\system32\dllcache\services.exe
2009-04-17 05:33 . 2009-02-09 10:53 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 05:33 . 2009-02-09 10:53 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 05:33 . 2009-02-09 10:53 685568 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 05:33 . 2009-02-09 10:53 735744 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-04-17 05:33 . 2009-02-09 10:53 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-17 05:33 . 2009-02-09 10:53 739840 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-17 05:30 . 2008-12-16 12:31 354304 ------w c:\windows\system32\dllcache\winhttp.dll
2009-04-17 05:30 . 2008-04-21 21:15 219136 ------w c:\windows\system32\dllcache\wordpad.exe
2009-04-13 18:39 . 2009-04-13 18:39 -------- d-sh--w c:\documents and settings\Clode\IECompatCache
2009-04-11 07:03 . 2009-04-11 07:03 -------- d-----w c:\documents and settings\Clode\Application Data\Windows Live Writer
2009-04-11 07:03 . 2009-04-11 07:03 -------- d-----w c:\documents and settings\Clode\Local Settings\Application Data\Windows Live Writer
2009-04-11 06:21 . 2009-04-11 06:21 -------- d-----w c:\program files\Windows Live SkyDrive
2009-04-11 06:06 . 2009-04-11 06:06 -------- d-sh--w c:\documents and settings\Clode\PrivacIE
2009-04-11 05:59 . 2009-04-11 05:59 -------- d-sh--w c:\documents and settings\Clode\IETldCache
2009-04-11 05:56 . 2009-04-11 05:56 -------- d--h--w c:\windows\msdownld.tmp
2009-04-11 05:56 . 2009-04-11 05:56 -------- d-----w c:\windows\ie8updates
2009-04-11 05:55 . 2009-04-11 05:56 -------- dc-h--w c:\windows\ie8
2009-04-11 05:54 . 2009-02-28 04:55 105984 ------w c:\windows\system32\dllcache\iecompat.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-28 16:53 . 2008-08-23 19:58 -------- d-----w c:\program files\Alwil Software
2009-04-22 11:42 . 2009-01-07 15:12 70528 ----a-w c:\documents and settings\Clode\Application Data\GDIPFONTCACHEV1.DAT
2009-04-22 07:21 . 2008-08-25 14:29 -------- d-----w c:\program files\eMule
2009-04-22 06:41 . 2008-12-08 16:11 -------- d-----w c:\program files\Fichiers communs\InstallShield
2009-04-22 06:41 . 2008-11-21 16:26 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-17 16:07 . 2004-08-24 08:38 85936 ----a-w c:\windows\system32\perfc00C.dat
2009-04-17 16:07 . 2004-08-24 08:38 513910 ----a-w c:\windows\system32\perfh00C.dat
2009-04-13 03:44 . 2008-11-10 16:50 -------- d-----w c:\program files\Java
2009-04-12 06:16 . 2008-08-24 19:31 70528 ----a-w c:\documents and settings\Clode\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-11 21:35 . 2008-08-24 07:33 -------- d-----w c:\program files\Microsoft ActiveSync
2009-04-11 06:22 . 2008-08-23 20:12 -------- d-----w c:\program files\Windows Live
2009-03-21 07:09 . 2009-03-21 07:09 -------- d-----w c:\program files\Fichiers communs\xing shared
2009-03-21 07:09 . 2008-08-26 15:13 -------- d-----w c:\program files\Fichiers communs\Real
2009-03-09 03:19 . 2008-11-10 16:50 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-08 02:34 . 2004-08-24 08:37 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 02:34 . 2004-08-24 08:37 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 02:33 . 2004-08-24 08:37 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 02:33 . 2004-08-24 08:37 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 02:32 . 2004-08-24 08:37 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 02:32 . 2004-08-24 08:37 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 02:31 . 2004-08-24 08:37 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 02:31 . 2004-08-24 08:37 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 02:31 . 2004-08-24 08:37 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 02:22 . 2004-08-24 08:37 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:20 . 2004-08-24 08:37 286720 ----a-w c:\windows\system32\pdh.dll
2009-03-06 07:38 . 2009-03-06 07:38 -------- d-----w c:\program files\BarreConfCMCIC
2009-02-28 09:17 . 2009-02-28 09:17 57632 ----a-w C:\StiImg.dat
2009-02-09 14:05 . 2004-08-24 08:37 1846912 ----a-w c:\windows\system32\win32k.sys
2009-02-09 11:23 . 2004-08-04 00:48 2025984 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:23 . 2004-08-24 08:37 2147328 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-09 11:23 . 2004-08-24 08:37 111104 ----a-w c:\windows\system32\services.exe
2009-02-09 10:53 . 2004-08-24 08:37 735744 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:53 . 2004-08-24 08:37 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:53 . 2004-08-24 08:37 739840 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:53 . 2004-08-24 08:37 685568 ----a-w c:\windows\system32\advapi32.dll
2009-02-06 17:39 . 2009-02-06 17:39 308600 ----a-w c:\windows\WLXPGSS.SCR
2009-02-06 16:52 . 2009-02-06 16:52 49504 ----a-w c:\windows\system32\sirenacm.dll
2009-02-06 10:39 . 2004-08-24 08:37 35328 ----a-w c:\windows\system32\sc.exe
2009-02-03 19:58 . 2004-08-24 08:37 56832 ----a-w c:\windows\system32\secur32.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2}]
2008-08-24 19:29 66912 ----a-w c:\program files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Neuf Media Center"="c:\program files\SFR\Media Center\MediaCenter.exe" [2008-10-10 726336]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"EPSON SX100 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIEDE.EXE" [2008-02-05 188928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-01-26 8491008]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2009-03-21 198160]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-04-30 81000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Azureus\\Azureus.exe"=
"c:\\Program Files\\eMule\\emule.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\program files\SFR\Media Center\httpd\httpd.exe"= c:\program files\SFR\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0,192.168.1.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player SFR)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"86:TCP"= 86:TCP:BroadCam Web Server

R1 aswSP;avast! Self Protection; [x]
R2 aswFsBlk;aswFsBlk; [x]
R3 Egatebus;Egatebus; [x]
R3 Egaterdr;Egaterdr; [x]
S3 PAC207;VideoCAM GF112;c:\windows\system32\DRIVERS\pfc027.sys [2005-04-08 162176]


--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - EAPHOST
*NewlyCreated* - IP6FW
.
Contenu du dossier 'Tâches planifiées'

2009-04-30 c:\windows\Tasks\HPpromotions psc 2350 series.job
- c:\program files\HP\Digital Imaging\bin\HP Promotions\AiOMVC\HPpromo.exe [2005-04-22 16:36]

2009-04-30 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-30 20:18]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-MSMSGS - c:\program files\Messenger\msmsgs.exe
HKLM-Run-DXDllRegExe - dxdllreg.exe


.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.neufportail.fr/
IE: E&xporter vers Microsoft Excel - c:\progra~1\Office\Office12\EXCEL.EXE/3000
Trusted Zone: cic.fr\www
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-30 19:29
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...


c:\docume~1\Clode\LOCALS~1\Temp\Perflib_Perfdata_150.dat 16384 bytes

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-2474506415-3661383049-3125663284-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Heure de fin: 2009-04-30 19:30
ComboFix-quarantined-files.txt 2009-04-30 17:30

Avant-CF: 35 055 239 168 octets libres
Après-CF: 35 240 169 472 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect

184 --- E O F --- 2009-04-30 17:14 

[Geronimo]

- Le rapport de Combofix nous apprends pas mal de choses notamment une infection par une toolbar indésirable.


Télécharge ToolBar-S&D depuis-ce lien : http://eric.71.mespages.googlepages.com/ToolBarSD.exe

- Double clic sur ToolBar-SD.exe afin de lancer l'installation, un raccourci sera ajouté sur le Bureau.

- Double sur le raccourci de ToolBar-S&D qui sur le sur bureau choisis la langue.


- Tape 1 puis valide par Entrée afin de lancer la recherche.
- Patiente jusqu'à la fin de la recherche.

- À la fin du scan, le rapport s'ouvrira dans le Bloc-notes.
- Poste la totalité du contenu du bloc notes dans ta prochaine réponse.
- Le rapport se trouve également sous : C:\TB.txt 

[claudiojoli]

et encore un rapport...
pour la tool bar


-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz )
BIOS : Version 6.00 R1.02.2740.A2
USER : Clode ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:49 Go (Free:32 Go)
D:\ (Local Disk) - NTFS - Total:415 Go (Free:347 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [1] ( 30/04/2009|20:14 )

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar
C:\Program Files\AskSBar\SrchAstt
C:\Program Files\AskSBar\bar\1.bin
C:\Program Files\AskSBar\bar\Cache
C:\Program Files\AskSBar\bar\History
C:\Program Files\AskSBar\bar\Settings
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
C:\Program Files\AskSBar\bar\Cache\008D5517
C:\Program Files\AskSBar\bar\Cache\008D56DC
C:\Program Files\AskSBar\bar\Cache\008D5805.bin
C:\Program Files\AskSBar\bar\Cache\008D596C.bin
C:\Program Files\AskSBar\bar\Cache\008D5AA5.bin
C:\Program Files\AskSBar\bar\Cache\008D5BCE.bin
C:\Program Files\AskSBar\bar\Cache\008D5D16.bin
C:\Program Files\AskSBar\bar\Cache\008D5E6E.bin
C:\Program Files\AskSBar\bar\Cache\files.ini
C:\Program Files\AskSBar\bar\History\search2
C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
C:\Program Files\AskSBar\SrchAstt\1.bin
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.neufportail.fr/"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://go.microsoft.com/fwlink/?LinkId=69157"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 30/04/2009|20:15 - Option : [1]

-----------\\ Fin du rapport a 20:15:07,75 

[Geronimo]

1/

- Relance Toolbar-S&D en double-cliquant sur le raccourci qui est sur le bureau.

- Tape sur 2 puis valide en appuyant sur Entrée

Ne touche ni au clavier ni à la souris pendant la phase de suppression !

- Un rapport sera généré, poste son contenu dans ta prochaine réponse

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
- Rends-toi sur l'onglet Processus Clique en haut à gauche sur Fichier et choisis Exécuter...
Tape explorer puis valide.


2/

- Je te fais passer un scan avec un antimalware.

[*] Télécharge MalwareBytes' Anti-Malware à partir de l'un de ces liens :
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
http://malwarebytes.gt500.org/
http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html


- Enregistre ce fichier sur le bureau

- Le téléchargement terminé ferme ton navigateur ainsi que toutes les applications en cours
- Fais un double-clic sur mbam-setup.exe afin de lancer l'installation

- Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées.

- MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse. Comme MBAM se met automatiquement à jour en fin d'installation, clique sur OK pour fermer la boite de dialogue.

- La mise à jour faite quitte Malwarebyte's

[*] Redémarre ton PC en mode sans échec

N'utilise pas Msconfig pour redémarrer ton pc en mode sans échec

[claudiojoli]

j'en connais des ouf de l'ordi, mais toi tu bats tous les records !!!
grand respect MÔssieu
je m'y colle et je reviens apres la manip 

[claudiojoli]

voila le rapport du 2em passage de ToolBar



-----------\\ ToolBar S&D 1.2.8 XP/Vista

Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU E4600 @ 2.40GHz )
BIOS : Version 6.00 R1.02.2740.A2
USER : Clode ( Administrator )
BOOT : Normal boot
C:\ (Local Disk) - NTFS - Total:49 Go (Free:32 Go)
D:\ (Local Disk) - NTFS - Total:415 Go (Free:347 Go)
E:\ (CD or DVD)
F:\ (CD or DVD)

"C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
Option : [2] ( 30/04/2009|20:36 )

-----------\\ SUPPRESSION

Supprime! - C:\Program Files\AskSBar\bar
Echec ! - C:\Program Files\AskSBar\SrchAstt
Echec ! - C:\Program Files\AskSBar\SrchAstt\1.bin
Echec ! - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
Echec ! - C:\Program Files\AskSBar

-----------\\ DEUXIEME PASSAGE

Echec ! - C:\Program Files\AskSBar\SrchAstt
Echec ! - C:\Program Files\AskSBar\SrchAstt\1.bin
Echec ! - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
Echec ! - C:\Program Files\AskSBar

-----------\\ Recherche de Fichiers / Dossiers ...

C:\Program Files\AskSBar
C:\Program Files\AskSBar\SrchAstt
C:\Program Files\AskSBar\SrchAstt\1.bin
C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL

-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.neufportail.fr/"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157"
"Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896"
"Local Page"="C:\\WINDOWS\\system32\\blank.htm"
"Start Page"="http://www.msn.com/"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 30/04/2009|20:15 - Option : [1]
2 - "C:\ToolBar SD\TB_2.txt" - 30/04/2009|20:36 - Option : [2]

-----------\\ Fin du rapport a 20:36:26,54 

[claudiojoli]

voila le 2eme rapport de Malware

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2062
Windows 5.1.2600 Service Pack 3

30/04/2009 21:08:38
mbam-log-2009-04-30 (21-08-3.txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 188597
Temps écoulé: 22 minute(s), 53 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 42

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\EoRezo (Rogue.Eorezo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP213\A0036999.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP213\A0037049.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP213\A0037077.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP213\A0037127.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP215\A0038132.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP215\A0039127.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP215\A0040127.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP215\A0040152.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP216\A0040262.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP216\A0040927.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP216\A0041030.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP217\A0041097.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP218\A0041126.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP218\A0041164.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP218\A0041189.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP218\A0041221.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP218\A0041245.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP219\A0041286.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP219\A0041327.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP219\A0041358.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP219\A0041391.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP219\A0041432.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP220\A0041473.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP220\A0041758.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP220\A0041800.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP221\A0041834.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0042175.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043178.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043205.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043243.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043270.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043298.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043325.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043351.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043376.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043412.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043438.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043544.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043589.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043649.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043677.sys (Rootkit.Bagle) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{9B08B945-5FE8-4A8D-B5D0-31B3BB497D7F}\RP223\A0043615.sys (Rootkit.Bagle) -> Quarantined and deleted successfully. 

[Geronimo]

Tu as fait du bon boulot nous pouvons continuer.


- Avast les Helpers Sécu dont je fais partie ne le recommandent pas.

- Imprime cette réponse tu en auras besoin.

- Télécharge aswClear.exe le fichier de désinstallation d'Avast : http://www.avast.com/eng/avast-uninstall-utility.html enregistre le sur le bureau.


- Télécharge le fichier d'installation d'Avira AntiVir Personal - FREE Antivirus, Version 9 en français http://dlce.antivir.com/package/wks_avira/win32/fr/pecl/avira_antivir_personal_fr.exe

- Les fichiers téléchargés quitte ton navigateur ainsi que toutes les applications en cours

- Désinstalle Avast en mode sans échec et en utilisant aswClear.exe


- Redémarre ton PC.

- Installe : Antivir Personal Edition Classic


- Antivir installé, redémarre ton PC en mode sans échec
- Fais un scan total de ton systéme avec Antivir

- Redémarre en mode normal poste le rapport d'Antivir.

- Aide pour Antivir http://www.libellules.ch/tuto_antivir.php 

[claudiojoli]

antivir en cours d'exec
ca va etre long
je laisse tourner cette nuit
rapport demain matin
merci du GROS coup de main