Mon ordinateur est infecte

merci pour ton aide gen-hackman,

l'outil est entrain de travailler, je posterai le résultat dans quelques minutes je crois

gean hackman j'arrive pas à poster le scan sur le forum
qu'est ce que je fais?

ÇA FAIT UNE HEURE QUE J4ESSAYE ET J'ARRIVE PAS

je viens de le poster sur ci-joint.fr

avec beaucoup de retard

Voici le lien et merci de ta patience

http://www.cijoint.fr/cjlink.php?file=cj201005/cijH1VESrF.pdf

Kill'em by g3n-h@ckm@n 1.7.3.0

User : aissa (Administrateurs)
Update on 04/05/2010 by g3n-h@ckm@n ::::: 04.50
Start at: 20:25:21 | 04/05/2010

Intel(R) Pentium(R) Dual CPU E2180 @ 2.00GHz
Microsoft® Windows Vista(TM) Édition Familiale Premium (6.0.6001 32-bit) # Service Pack 1
Internet Explorer 7.0.6001.18000
Windows Firewall Status : Enabled

C:\ -> Disque fixe local | 286,09 Go (198,21 Go free) [HDD] | NTFS
D:\ -> Disque CD-ROM


¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤ Processes running

C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\runonce.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Windows\system32\FsUsbExService.Exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\PC Tools\sMonitor\StartManSvc.exe
C:\Windows\system32\IoctlSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Calendar\wincal.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\List_Kill'em\ERUNT.EXE
C:\Program Files\List_Kill'em\pv.exe

¤¤¤¤¤¤¤¤¤¤ Files/folders :


Quarantined & Deleted !! : C:\Windows\Temp\367b51e8911e473f5640b6b5.tmp
Quarantined & Deleted !! : C:\Windows\Temp\37cac0bfebefd1c4c164d7f.tmp
Quarantined & Deleted !! : C:\Windows\Temp\3e84c5f44ceebb6775259bde.tmp
Quarantined & Deleted !! : C:\Windows\Temp\59499dc789edb410eff44cc.tmp
Quarantined & Deleted !! : C:\Windows\Temp\6b2f76af59eef7ebd131e772.tmp
Quarantined & Deleted !! : C:\Windows\Temp\775cbaa91ad245649e187dc8.tmp
Quarantined & Deleted !! : C:\Windows\Temp\8f9245569cd9312aac579c6b.tmp
Quarantined & Deleted !! : C:\Windows\Temp\9c711b0d3eb762d3620fcb24.tmp
Quarantined & Deleted !! : C:\Windows\Temp\a3835330d2be8354b8b2c538.tmp
Quarantined & Deleted !! : C:\Windows\Temp\b427d8a677399b3ef5f6a9a3.tmp
Quarantined & Deleted !! : C:\Windows\Temp\c63cb3df6b47e22a2346c4ac.tmp
Quarantined & Deleted !! : C:\Windows\Temp\c84fe13c17a50919392821f6.tmp
Quarantined & Deleted !! : C:\Windows\Temp\ddde54d8bf98f376b8da992e.tmp
Quarantined & Deleted !! : C:\Users\aissa\AppData\Local\GDIPFONTCACHEV1.DAT

=======
Hosts :
=======

127.0.0.1 localhost

========
Registry
========

=================
Internet Explorer
=================

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Default_Search_URL REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
Default_Page_URL REG_SZ https://www.msn.com/fr-fr/?ocid=iehp
Search Page REG_SZ https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
Start Page REG_SZ https://www.google.com/?gws_rd=ssl
Local Page REG_SZ C:\WINDOWS\system32\blank.htm
Search Page REG_SZ http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

===============
Security Center
===============

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
cval REG_DWORD 1 (0x1)
UacDisableNotify REG_DWORD 1 (0x1)
InternetSettingsDisableNotify REG_DWORD 1 (0x1)
AutoUpdateDisableNotify REG_DWORD 1 (0x1)
FirewallDisableNotify REG_DWORD 0 (0x0)
FirstRunDisabled REG_DWORD 1 (0x1)
AntiVirusDisableNotify REG_DWORD 0 (0x0)
UpdatesDisableNotify REG_DWORD 0 (0x0)
AntiVirusOverride REG_DWORD 1 (0x1)
FirewallOverride REG_DWORD 1 (0x1)

========
Services
=========

Ndisuio : Start = 3
EapHost : Start = 2
Wlansvc : Start = 2
SharedAccess : Start = 2
windefend : Start = 2
wuauserv : Start = 2
wscsvc : Start = 2

============
Disk Cleaned
anti-ver blaster : OK
Prefetch cleaned
================



¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤( EOF )¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

c'est le rapport que j'ai obtenu

oui

j'ai posté le rapport GMER sur ci-joint, le lien est:
http://www.cijoint.fr/cjlink.php?file=cj201005/cijFfhQq6Q.txt

J'ai fais le scan 2 fois aussi, pas exprès

je n'ai pas de rapport?
J'ai du me gourer quelque part.

j'ai refais gmer mon ordinateur beug

sinon je viens de télécharger combofix et voici le rapport si tu peux regarder, merci

ComboFix 10-05-04.06 - aissa 05/05/2010 14:08:48.3.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6001.1.1252.33.1036.18.2815.1736 [GMT 2:00]
Lancé depuis: c:\users\aissa\Downloads\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-149746169-325228829-2604569920-1000
c:\$recycle.bin\S-1-5-21-2595506030-2279488623-1466756031-500
c:\programdata\Microsoft\Network\Downloader\qmgr0.dat
c:\programdata\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Il y a peut-être des sites infectés -----

hxxp://ads1.msads.net
.
((((((((((((((((((((((((((((( Fichiers créés du 2010-04-05 au 2010-05-05 ))))))))))))))))))))))))))))))))))))
.

2010-05-05 12:16 . 2010-05-05 12:16 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-05-05 11:21 . 2010-05-05 11:21 75168 ----a-w- c:\users\aissa\AppData\Local\GDIPFONTCACHEV1.DAT
2010-05-04 07:23 . 2010-05-04 17:47 -------- d-----w- C:\Kill'em
2010-05-04 07:23 . 2010-05-05 11:11 -------- d-----w- c:\program files\List_Kill'em
2010-05-03 20:44 . 2010-05-03 20:44 103004 ---ha-w- c:\windows\system32\mlfcache.dat
2010-04-23 20:30 . 2010-05-02 18:33 -------- d-----w- c:\programdata\Norton
2010-04-23 20:30 . 2010-04-23 20:30 -------- d-----w- c:\programdata\NortonInstaller
2010-04-17 08:39 . 2010-04-17 08:39 -------- d-----w- c:\program files\Conduit
2010-04-17 08:39 . 2010-04-17 08:39 -------- d-----w- c:\program files\mywebsites.pro-FR
2010-04-14 05:10 . 2010-02-23 11:32 212992 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys
2010-04-14 05:10 . 2010-02-23 11:32 78848 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys
2010-04-14 05:10 . 2010-02-23 11:32 105984 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2010-04-14 05:08 . 2010-02-18 14:49 3598216 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-04-14 05:08 . 2010-02-18 14:49 3545992 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-04-14 05:08 . 2010-03-04 18:54 430080 ----a-w- c:\windows\system32\vbscript.dll
2010-04-14 05:07 . 2010-02-18 14:49 898952 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-04-14 05:07 . 2010-02-18 14:11 190464 ----a-w- c:\windows\system32\iphlpsvc.dll
2010-04-14 05:07 . 2010-02-18 11:52 25088 ----a-w- c:\windows\system32\drivers\tunnel.sys
2010-04-14 05:06 . 2009-12-23 12:43 171520 ----a-w- c:\windows\system32\wintrust.dll
2010-04-14 05:06 . 2010-01-15 00:04 98304 ----a-w- c:\windows\system32\cabview.dll
2010-04-09 19:08 . 2010-04-09 19:08 653576 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-05 12:01 . 2008-04-18 06:48 669328 ----a-w- c:\windows\system32\perfh00C.dat
2010-05-05 12:01 . 2008-04-18 06:48 123350 ----a-w- c:\windows\system32\perfc00C.dat
2010-05-05 12:01 . 2009-02-07 16:26 -------- d-----w- c:\users\aissa\AppData\Roaming\OpenOffice.org2
2010-05-04 10:28 . 2009-02-07 16:28 1 ----a-w- c:\users\aissa\AppData\Roaming\OpenOffice.org2\user\uno_packages\cache\stamp.sys
2010-05-04 06:16 . 2008-11-22 21:03 15502 ----a-w- c:\users\aissa\AppData\Roaming\wklnhst.dat
2010-05-02 18:34 . 2009-07-31 18:42 -------- d-----w- c:\program files\Samsung
2010-05-02 18:32 . 2008-04-17 21:21 -------- d-----w- c:\programdata\Symantec
2010-05-02 16:00 . 2008-04-17 21:21 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-05-01 15:10 . 2010-01-07 16:55 -------- d-----w- c:\users\aissa\AppData\Roaming\Winamp
2010-04-29 06:14 . 2010-03-23 13:54 443912 ----a-w- c:\users\aissa\AppData\Roaming\Real\Update\setup3.10\setup.exe
2010-04-23 17:30 . 2010-04-23 17:29 -------- d-----w- c:\programdata\DivX
2010-03-24 21:45 . 2009-03-17 21:28 -------- d-----w- c:\users\aissa\AppData\Roaming\NBPROF
2010-03-21 06:26 . 2008-04-17 21:30 -------- d-----w- c:\program files\Picasa2
2010-03-11 11:11 . 2009-02-02 18:07 -------- d-----w- c:\users\aissa\AppData\Roaming\Image Zone Express
2010-03-09 16:57 . 2009-03-23 20:22 -------- d-----w- c:\programdata\HP Product Assistant
2010-03-09 16:36 . 2008-04-17 21:11 -------- d-----w- c:\program files\Common Files\InstallShield
2010-03-09 16:36 . 2008-04-17 21:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-09 16:28 . 2010-03-31 07:00 833024 ----a-w- c:\windows\system32\wininet.dll
2010-03-09 16:25 . 2010-03-31 07:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2010-03-09 14:01 . 2010-03-31 07:00 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2010-03-07 09:35 . 2010-01-11 15:57 588472 ----a-w- c:\windows\system32\ezsvc7x.dll
2010-02-26 13:53 . 2009-12-24 08:48 439816 ----a-w- c:\users\aissa\AppData\Roaming\Real\Update\setup3.09\setup.exe
2010-02-24 08:16 . 2009-10-03 02:21 181632 ------w- c:\windows\system32\MpSigStub.exe
2010-02-20 23:39 . 2010-03-11 07:29 24064 ----a-w- c:\windows\system32\nshhttp.dll
2010-02-20 23:37 . 2010-03-11 07:29 31232 ----a-w- c:\windows\system32\httpapi.dll
2010-02-20 21:18 . 2010-03-11 07:29 411136 ----a-w- c:\windows\system32\drivers\http.sys
2010-02-19 23:47 . 2010-02-19 23:47 3604480 ----a-w- c:\windows\system32\GPhotos.scr
2010-02-12 10:48 . 2010-03-29 08:49 293376 ----a-w- c:\windows\system32\browserchoice.exe
2008-02-06 21:05 . 2008-09-19 12:52 324976 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll
2009-11-20 13:41 . 2009-11-20 13:41 119808 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2008-04-18 06:52 . 2008-04-18 06:52 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2009-05-06 1262888]
"{33727f97-486d-4d19-97c3-23f432ef93fc}"= "c:\program files\mywebsites.pro-FR\tbmywe.dll" [2009-11-09 2331672]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CLASSES_ROOT\clsid\{33727f97-486d-4d19-97c3-23f432ef93fc}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33727f97-486d-4d19-97c3-23f432ef93fc}]
2009-11-09 16:38 2331672 ----a-w- c:\program files\mywebsites.pro-FR\tbmywe.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{33727f97-486d-4d19-97c3-23f432ef93fc}"= "c:\program files\mywebsites.pro-FR\tbmywe.dll" [2009-11-09 2331672]

[HKEY_CLASSES_ROOT\clsid\{33727f97-486d-4d19-97c3-23f432ef93fc}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{33727F97-486D-4D19-97C3-23F432EF93FC}"= "c:\program files\mywebsites.pro-FR\tbmywe.dll" [2009-11-09 2331672]

[HKEY_CLASSES_ROOT\clsid\{33727f97-486d-4d19-97c3-23f432ef93fc}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 2153472]
"RegistryMechanic"="c:\program files\Registry Mechanic\RMTray.exe" [2009-11-25 292824]
"AutoStartNPSAgent"="c:\program files\Samsung\Samsung New PC Studio\NPSAgent.exe" [2009-04-02 102400]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-29 4911104]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-11-20 30192]
"toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-04-03 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-04-03 92704]
"Athan"="c:\program files\Athan\Athan.exe" [2009-07-29 1138688]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2009-12-21 39424]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-09 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-07 198160]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344]
"SSDMonitor"="c:\program files\Common Files\PC Tools\sMonitor\SSDMonitor.exe" [2009-11-25 104408]
"PCSuiteTrayApplication"="c:\program files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 271360]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088]

c:\users\aissa\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-1-21 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"FilterAdministratorToken"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)
"HideFastUserSwitching"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
2008-01-21 02:25 125952 ----a-w- c:\windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R2 gupdate1c9ff19e58a130b;Service Google Update (gupdate1c9ff19e58a130b);c:\program files\Google\Update\GoogleUpdate.exe [2009-07-07 133104]
R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-11-20 30192]
S0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-06-19 28544]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-11-24 20560]
S2 aswMonFlt;aswMonFlt;c:\windows\system32\DRIVERS\aswMonFlt.sys [2009-11-24 53328]
S2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504]
S2 FsUsbExService;FsUsbExService;c:\windows\system32\FsUsbExService.Exe [2009-03-31 233472]
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\Common Files\PC Tools\sMonitor\StartManSvc.exe [2009-11-25 583640]
S3 FsUsbExDisk;FsUsbExDisk;c:\windows\system32\FsUsbExDisk.SYS [2009-03-31 36608]


--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - FSUSBEXDISK
*Deregistered* - uqkoyrs

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LPDService REG_MULTI_SZ LPDSVC
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ezSharedSvc
.
Contenu du dossier 'Tâches planifiées'

2010-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-07 15:44]

2010-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-07-07 15:44]

2008-09-19 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 09:20]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://www.google.com/
mWindow Title =
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &Winamp Search - c:\programdata\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\aissa\AppData\Roaming\Mozilla\Firefox\Profiles\m46xiyxc.default\
FF - component: c:\program files\Real\RealPlayer\browserrecord\components\nprpbrowserrecordplugin.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Picasa2\npPicasa3.dll
FF - plugin: c:\users\aissa\AppData\Local\Yahoo!\BrowserPlus\2.6.0\Plugins\npybrowserplus_2.6.0.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-NPSStartup - (no file)
MSConfigStartUp-PC Suite Tray - c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe
AddRemove-Athan - c:\windows\iun6002.exe
AddRemove-HijackThis - c:\users\aissa\AppData\Local\Temp\Rar$EX02.768\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-05 14:16
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\uqkoyrs]

.
Heure de fin: 2010-05-05 14:19:37
ComboFix-quarantined-files.txt 2010-05-05 12:19
ComboFix2.txt 2009-02-22 21:35
ComboFix3.txt 2009-02-22 18:45

Avant-CF: 215 593 132 032 octets libres
Après-CF: 219 771 752 448 octets libres

Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - C578C10747C32DFEC21AE25511C478D2

qu'est ce que tu veux dire par toutes les protections j'ai juste avast
tu veux que je désinstalle combofix

desactive le resident de Avast

c'est fait

voici mon rapport j'emmene ma petite au cours de musique je serai de retour à 18h merci encore

voici le lien sur ci-joint
http://www.cijoint.fr/cjlink.php?file=cj201005/cijQCsqsLh.txt

la réponse pour le premier bloc note est
an error 0x0000001 occured during the delection of file: C:\WINDOWS\system32\drivers\uqkoyrs.sys accés refusé

voici les informations du 3eme bloc note:
File deleted !! : C:\WINDOWS\system32\drivers\uqkoyrs.sys

c'est parti pour le gmer

gmer a cesse de fonctionné, c'est la réponse que j'ai eu après plusieurs tentatives;
le chargement commence normalement et s'arrête après un moment et j'ai le message cité ci-dessus.

même démarche même réponse, il est plus que coriace celui la

rien ne se passe pour moi, j'ai refait encore une fois de plus

j'ai refait un GMER, je te poste le lien sur ci-joint
je ne sais pas si ca va t'aider pour pouvoir m'aider merci jean hackman
http://www.cijoint.fr/cjlink.php?file=cj201005/cijCfttGhO.txt

voici le lien sur ci-joint du rapport de combofix:
http://www.cijoint.fr/cjlink.php?file=cj201005/cijgv1ERn4.txt

le tool n'a pas beaucoup bossé, regarde le rapport:
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤ Rootkit ¤¤¤¤¤¤¤¤¤¤
¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤¤

¤¤¤¤¤ Services :

¤ Service stopped !! : uqkoyrs
¤ Service Deleted !! : uqkoyrs

¤¤¤¤¤ Files :

¤ File deleted !! : C:\Windows\System32\Drivers\uqkoyrs.sys

¤¤¤¤¤ Keys | Root


¤¤¤¤¤ Keys | Services

je te souhaite une bonne soirée et une bonne nuit à demain, car je tombe de sommeil

j'en attendais pas plus :)

Bonjour,

tu veux dire que le fichier est vraiment parti?
C'est super, tu es génial, milleeeeeeeeeeeeeeeeeeeeeeees merci.
SARAH

voici le lien du rapport de gmer après avoir redémarrer mon ordi comme tu me l'as conseillé:
http://www.cijoint.fr/cjlink.php?file=cj201005/cij4MBkk2e.txt