"urgent" probleme malware protectore 2008

Salut, voila, j'ai un pti souci avec mon pc, depusi ce matin il y a malware protectore 2008 d installé, et j'ai vraiment besoin de mon pc pour travailler.
Si qq'un pouvait m'aider a nettoyer mon pc svp.. voici le rapport fait avec hijack this, Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:17:45, on 10/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\Explorer.EXE
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\eHome\ehRecvr.exe
D:\WINDOWS\eHome\ehSched.exe
D:\WINDOWS\System32\FTRTSVC.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\ehome\ehtray.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
D:\PROGRA~1\Wanadoo\TaskBarIcon.exe
D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
D:\WINDOWS\system32\dllhost.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\WINDOWS\eHome\ehmsas.exe
D:\Program Files\Skype\Phone\Skype.exe
D:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
D:\WINDOWS\system32\wscntfy.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Documents and Settings\Administrateur\Mes documents\mal\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wanadoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.generation-nt.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - D:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Popper Class - {C16B013D-9408-4465-BFEB-716EFBB14946} - D:\WINDOWS\system32\mmocr0.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - D:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - D:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll
O4 - HKLM\..\Run: [ehTray] D:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [WOOWATCH] D:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] D:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [NeroCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Glock Suite 1.1] D:\WINDOWS\system32\glock32.exe
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WOOKIT] D:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - D:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - http://www.wanadoo.fr (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=www.generation-nt.com
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1201628726609
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://fichiers.touslesdrivers.com/fichiers/hardwaredetection/hardwaredetection_2_0_4_13.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - Winlogon Notify: ioczqe - D:\WINDOWS\SYSTEM32\ioczqe.dll
O20 - Winlogon Notify: LogCrypt - D:\WINDOWS\SYSTEM32\LogCrypt.dll
O20 - Winlogon Notify: WinCtrl32 - D:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Audio Windows AudioSrvDhcpusnjsvc (AudioSrvDhcpusnjsvc) - Unknown owner - .exe (file missing)
O23 - Service: Audio Windows AudioSrvseclogon (AudioSrvseclogon) - Unknown owner - .exe (file missing)
O23 - Service: Audio Windows AudioSrvseclogon AudioSrvseclogonW32Time (AudioSrvseclogonW32Time) - Unknown owner - .exe (file missing)
O23 - Service: Service de transfert intelligent en arrière-plan BITSEventSystem (BITSEventSystem) - Unknown owner - .exe (file missing)
O23 - Service: Service de transfert intelligent en arrière-plan BITSWmiApSrv (BITSWmiApSrv) - Unknown owner - .exe (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Explorateur d'ordinateur Browserstisvc (Browserstisvc) - Unknown owner - .exe (file missing)
O23 - Service: Explorateur d'ordinateur Browserstisvc BrowserstisvcLmHosts (BrowserstisvcLmHosts) - Unknown owner - .exe (file missing)
O23 - Service: Explorateur d'ordinateur Browserstisvc BrowserstisvcRemoteAccess (BrowserstisvcRemoteAccess) - Unknown owner - .exe (file missing)
O23 - Service: Explorateur d'ordinateur Browserstisvc BrowserstisvcTermService (BrowserstisvcTermService) - Unknown owner - .exe (file missing)
O23 - Service: Client DHCP DhcpehSched (DhcpehSched) - Unknown owner - .exe (file missing)
O23 - Service: Client DHCP Dhcpusnjsvc (Dhcpusnjsvc) - Unknown owner - .exe (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique dmadminMSDTC (dmadminMSDTC) - Unknown owner - .exe (file missing)
O23 - Service: Client DNS DnscacheRSVP (DnscacheRSVP) - Unknown owner - .exe (file missing)
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - D:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Aide et support helpsvclanmanserverxmlprov (helpsvclanmanserverxmlprov) - Unknown owner - .exe (file missing)
O23 - Service: Aide et support helpsvcNetDDE (helpsvcNetDDE) - Unknown owner - .exe (file missing)
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Serveur lanmanserverxmlprov (lanmanserverxmlprov) - Unknown owner - .exe (file missing)
O23 - Service: Station de travail lanmanworkstationlanmanserverxmlprov (lanmanworkstationlanmanserverxmlprov) - Unknown owner - .exe (file missing)
O23 - Service: MHN MHNSamSs (MHNSamSs) - Unknown owner - .exe (file missing)
O23 - Service: DSDM DDE réseau NetDDEdsdmseclogon (NetDDEdsdmseclogon) - Unknown owner - .exe (file missing)
O23 - Service: DSDM DDE réseau NetDDEdsdmseclogon NetDDEdsdmseclogonProtectedStorage (NetDDEdsdmseclogonProtectedStorage) - Unknown owner - .exe (file missing)
O23 - Service: Connexions réseau NetmanRemoteAccess (NetmanRemoteAccess) - Unknown owner - .exe (file missing)
O23 - Service: Gestionnaire de connexions d'accès distant RasManFTRTSVC (RasManFTRTSVC) - Unknown owner - .exe (file missing)
O23 - Service: Appel de procédure distante (RPC) RpcSsSENS (RpcSsSENS) - Unknown owner - .exe (file missing)
O23 - Service: QoS RSVP RSVPDnscache (RSVPDnscache) - Unknown owner - .exe (file missing)
O23 - Service: Pare-feu Windows / Partage de connexion Internet SharedAccessBrowserstisvc (SharedAccessBrowserstisvc) - Unknown owner - .exe (file missing)
O23 - Service: Détection matériel noyau ShellHWDetectionDhcp (ShellHWDetectionDhcp) - Unknown owner - .exe (file missing)
O23 - Service: Détection matériel noyau ShellHWDetectionSamSs (ShellHWDetectionSamSs) - Unknown owner - .exe (file missing)
O23 - Service: Détection matériel noyau ShellHWDetectionSamSs ShellHWDetectionSamSsClipSrv (ShellHWDetectionSamSsClipSrv) - Unknown owner - .exe (file missing)
O23 - Service: WebClient WebClientTlntSvr (WebClientTlntSvr) - Unknown owner - .exe (file missing)
O23 - Service: Infrastructure de gestion Windows winmgmtwscsvc (winmgmtwscsvc) - Unknown owner - .exe (file missing)
O23 - Service: Windows Live Setup Service WLSetupSvcSamSs (WLSetupSvcSamSs) - Unknown owner - .exe (file missing)
O23 - Service: Carte de performance WMI WmiApSrvWmi (WmiApSrvWmi) - Unknown owner - .exe (file missing)

--
End of file - 11416 bytes


merci d'avance!!! nico

salut fait ceci
Télécharger sur le bureau

Malwarebyte's Anti-Malware

= double-clic sur mbam-setup pour lancer l'installation
= Installer simplement sans rien modifier
= Quand le programme lancé ==> cocher Exécuter un examen complet
= Clic Rechercher
= Eventuellement décocher les disque à ne pas analyser
= Clic Lancer l'examen
= Enfin de scan , si infection trouvée
==> Clic Afficher réslutat
= Fermer vos applications en cours
= Vérifier si tout est coché et clic Supprimer la sélection

Télécharger et enregistrer sur le bureau
Combofix

=Double-clic sur Combofix
= Presser 1 quand demandé
= Attendre la fermeture de l’outil ( 5 à 10 mn)
=Copier/coller le rapport dans la réponse
Un rapport dans C:\Combofix.txt à mettre dans la réponse
ComboFix-quarantined-files + Qoobox sont eux à supprimer


un rapport s'ouvre le copier et le coller dans la réponse
=======================================================
merci de mettre tous les rapports sous Spoiler

pour cela sélectionner la totalité de chaque rapport mis dans la case réponse
et clic sur le point d'interrogation en bas à droite de cette case
(à coté de TeX

Merci de ton aide, voici mon rapport,

ComboFix 08-07-09.5 - Administrateur 2008-07-10 16:15:01.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.32 [GMT 2:00]
Endroit: D:\Documents and Settings\Administrateur\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

[color=red]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

D:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel
D:\Documents and Settings\All Users\Bureau\Malware Protector 2008.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\How to Register Malware Protector 2008.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\License Agreement.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Malware Protector 2008.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Register Malware Protector 2008.lnk
D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Malware Protector 2008\Uninstall.lnk
D:\Program Files\shctj1j0egel
D:\WINDOWS\system32\blphcrj1j0egel.scr
D:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
d:\windows\system32\Drivers\Jpu27.sys
D:\WINDOWS\system32\drivers\Winio84.sys
D:\WINDOWS\system32\drivers\Winlr05.sys
D:\WINDOWS\system32\drivers\Winot86.sys
D:\WINDOWS\system32\drivers\Winrx84.sys
D:\WINDOWS\system32\drivers\Winta51.sys
D:\WINDOWS\system32\drivers\Winvc41.sys
D:\WINDOWS\system32\drivers\Winvc52.sys
D:\WINDOWS\system32\drivers\Winvc84.sys
d:\windows\system32\Drivers\Winwd84.sys
D:\WINDOWS\system32\drivers\Winxf62.sys
D:\WINDOWS\system32\lphcrj1j0egel.exe
D:\WINDOWS\system32\phcrj1j0egel.bmp
D:\WINDOWS\system32\WinCtrl32.dll
D:\WINDOWS\system32\WinNt64.dll . . . . Echec de suppression

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_JPU27
-------\Legacy_TCPSR
-------\Legacy_WINIO84
-------\Legacy_WINLR05
-------\Legacy_WINOT86
-------\Legacy_WINRX84
-------\Legacy_WINTA51
-------\Legacy_WINVC41
-------\Legacy_WINVC52
-------\Legacy_WINVC84
-------\Legacy_WINWD84
-------\Legacy_WINXF62
-------\Service_Jpu27
-------\Service_tcpsr
-------\Service_Winio84
-------\Service_Winlr05
-------\Service_Winot86
-------\Service_Winrx84
-------\Service_Winta51
-------\Service_Winvc41
-------\Service_Winvc52
-------\Service_Winvc84
-------\Service_Winwd84
-------\Service_Winxf62


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-10 to 2008-07-10 ))))))))))))))))))))))))))))))))))))
.

2008-07-10 14:53 . 2008-07-10 14:53 <REP> d-------- D:\Program Files\Malwarebytes' Anti-Malware
2008-07-10 14:53 . 2008-07-10 14:53 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-07-10 14:53 . 2008-07-10 14:53 <REP> d-------- D:\Documents and Settings\Administrateur\Application Data\Malwarebytes
2008-07-10 14:53 . 2008-07-07 17:35 34,296 --a------ D:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-07-10 14:53 . 2008-07-07 17:35 17,144 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-07-10 13:40 . 2008-07-10 13:40 25,154,969 --a------ D:\WINDOWS\LPT$VPN.399
2008-07-10 13:39 . 2008-07-10 13:40 <REP> d-------- D:\WINDOWS\AU_Temp
2008-07-10 13:39 . 2008-07-10 13:40 25,154,969 --a------ D:\WINDOWS\VPTNFILE.399
2008-07-10 09:57 . 2008-07-10 09:47 60,928 --a------ D:\WINDOWS\system32\33.tmp
2008-07-07 11:39 . 2008-07-07 11:39 <REP> d-------- D:\Documents and Settings\Administrateur\Application Data\Quark
2008-07-07 11:36 . 2008-07-07 11:38 <REP> d-------- D:\Documents and Settings\All Users\Application Data\Quark
2008-07-07 11:34 . 2008-07-07 11:36 <REP> d-------- D:\Program Files\Quark
2008-07-05 11:14 . 2008-07-05 11:14 <REP> d-------- D:\WINDOWS\system32\repository
2008-06-25 23:29 . 2008-07-10 16:09 0 --a------ D:\WINDOWS\system32\12520850e.sys
2008-06-24 10:31 . 2008-07-10 16:13 37,246,063 --ahs---- D:\WINDOWS\system32\1041b.sys
2008-06-24 10:31 . 2008-06-24 10:31 21,504 --ahs---- D:\WINDOWS\system32\actmoviec.dll
2008-06-18 03:05 . 2008-06-18 03:05 268 --ah----- D:\sqmdata02.sqm
2008-06-18 03:05 . 2008-06-18 03:05 244 --ah----- D:\sqmnoopt02.sqm
2008-06-14 10:58 . 2008-07-10 09:53 335 --a-s---- D:\WINDOWS\system32\816125296.dat
2008-06-13 00:40 . 2008-06-13 00:40 <REP> d-------- D:\Program Files\Fichiers communs\Adobe AIR
2008-06-13 00:40 . 2008-06-13 00:40 <REP> d-------- D:\Program Files\Adobe Media Player
2008-06-12 12:15 . 2008-07-02 11:04 30,208 --a------ D:\WINDOWS\system32\drivers\Pvc05.sys
2008-06-11 00:44 . 2008-07-10 16:25 13,824 --------- D:\WINDOWS\system32\WinNt64.dll
2008-06-11 00:44 . 2008-06-11 00:44 13,824 --a------ D:\WINDOWS\system32\WinNt64.dl_

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-10 14:27 --------- d-----w D:\Program Files\Wanadoo
2008-07-10 14:23 --------- d-----w D:\Documents and Settings\Administrateur\Application Data\Skype
2008-07-10 11:40 91,744 ----a-w D:\WINDOWS\BPMNT.dll
2008-07-10 11:40 71,749 ----a-w D:\WINDOWS\hcextoutput.dll
2008-07-10 11:40 333,576 ----a-w D:\WINDOWS\tsc.exe
2008-07-10 11:40 1,213,784 ----a-w D:\WINDOWS\vsapi32.dll
2008-06-10 22:44 29,696 ----a-w D:\WINDOWS\system32\drivers\Pvc84.sys
2008-05-28 09:46 21,504 ----a-w D:\WINDOWS\system32\ioczqe.dll
2008-05-19 22:49 21,504 ----a-w D:\WINDOWS\system32\ioczqe32.dll
2008-04-24 08:08 77,824 ----a-w D:\WINDOWS\system32\mmocr0.dll
2008-01-29 22:40 15,397 ----a-w D:\Program Files\settings.dat
.

------- Sigcheck -------

2004-08-10 13:00 359040 1745b00fc1141404b28f4b94f69a8871 D:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-10 13:00 359040 1745b00fc1141404b28f4b94f69a8871 D:\WINDOWS\system32\drivers\tcpip.sys

2004-11-25 23:20 506368 048cb871e6f98e41f072b85c67c30925 D:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"WOOKIT"="D:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 15:50 122880]
"MsnMsgr"="D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-12-07 16:58 21687592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="D:\WINDOWS\ehome\ehtray.exe" [2004-08-10 05:04 59392]
"WOOWATCH"="D:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 15:49 20480]
"WOOTASKBARICON"="D:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 17:55 32768]
"Adobe Reader Speed Launcher"="D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06 40048]
"QuickTime Task"="D:\Program Files\QuickTime\QTTask.exe" [2008-01-10 16:27 385024]
"iTunesHelper"="D:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 04:22 267048]
"HPDJ Taskbar Utility"="D:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-28 15:43 188416]
"NeroCheck"="D:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Glock Suite 1.1"="D:\WINDOWS\system32\glock32.exe" [2004-08-10 13:00 13312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="D:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= D:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= D:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)
"NoDispScrSavPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ioczqe]
2008-05-28 11:46 21504 D:\WINDOWS\system32\ioczqe.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Jpu27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvc05.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pvc84.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"D:\\Program Files\\iTunes\\iTunes.exe"=
"D:\\WEB\\apache\\apache.exe"=
"D:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Pvc05;Pvc05;D:\WINDOWS\system32\Drivers\Pvc05.sys [2008-07-02 11:04]
R0 Pvc84;Pvc84;D:\WINDOWS\system32\Drivers\Pvc84.sys [2008-06-11 00:44]
R3 P1130VID;Creative WebCam NX Pro;D:\WINDOWS\system32\DRIVERS\P1130Vid.sys [2003-05-08 03:00]
R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;D:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 17:37]
S3 ZDCndis5;ZDCndis5 Protocol Driver;D:\WINDOWS\system32\ZDCndis5.SYS []

*Newly Created Service* - POLICYAGENTAUDIOSRV
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-07-03 20:21:05 D:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- D:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-lphcrj1j0egel - D:\WINDOWS\system32\lphcrj1j0egel.exe
HKLM-Run-SMshctj1j0egel - D:\Program Files\shctj1j0egel\shctj1j0egel.exe
Notify-WgaLogon - (no file)


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-10 16:26:32
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AudioSrvDhcpusnjsvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AudioSrvseclogon]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\AudioSrvseclogonW32Time]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSEventSystem]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BITSWmiApSrv]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Browserstisvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserstisvcLmHosts]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserstisvcRemoteAccess]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\BrowserstisvcTermService]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DhcpehSched]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Dhcpusnjsvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dmadminMSDTC]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\DnscacheRSVP]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\helpsvclanmanserverxmlprov]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\helpsvcNetDDE]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lanmanserverxmlprov]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\lanmanworkstationlanmanserverxmlprov]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MHNSamSs]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmseclogon]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetDDEdsdmseclogonProtectedStorage]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NetmanRemoteAccess]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\PolicyAgentAudioSrv]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RasManFTRTSVC]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RpcSsSENS]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\RSVPDnscache]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SharedAccessBrowserstisvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ShellHWDetectionDhcp]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ShellHWDetectionSamSs]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\ShellHWDetectionSamSsClipSrv]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WebClientTlntSvr]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\winmgmtwscsvc]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WLSetupSvcSamSs]
"ImagePath"=" srv"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\WmiApSrvWmi]
"ImagePath"=" srv"
.
--------------------- DLLs a charg‚ sous des processus courants ---------------------

PROCESS: D:\WINDOWS\system32\winlogon.exe
-> D:\WINDOWS\system32\ioczqe.dll
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\WINDOWS\ehome\ehRecvr.exe
D:\WINDOWS\ehome\ehSched.exe
D:\WINDOWS\system32\FTRTSVC.exe
D:\WINDOWS\system32\dllhost.exe
D:\WINDOWS\system32\wscntfy.exe
D:\PROGRA~1\Wanadoo\TaskBarIcon.exe
D:\WINDOWS\ehome\ehmsas.exe
D:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-07-10 16:30:45 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-10 14:29:39

Pre-Run: 43,324,162,048 octets libres
Post-Run: 45,640,380,416 octets libres

267


(Modifié par looping74 le 10-07-2008 à 16:46)

Le rapport de Malwarebyte's?

non, celui de combofix.

Je sais Je te demandais de mettre le rapport de Malwarebyte's

Il me semble pas que je l'ai, riderman ne ma pas demander de le mettre, je suppose donc qu'il n'ai pas important... Mon PC est il soigné??

Ouais dans sa manip il manque de faire poster le rapport

Mais met le
Si tu as fermer Malwarebyte's et son rapport fait ça:

=> Lance Malwarebyte's
=> Onglet rapports/log
=> Sélectionner le dernier effectuer, c'est à dire celui d'en bas
=> Le poster

le voici,

Malwarebytes' Anti-Malware 1.20
Version de la base de données: 935
Windows 5.1.2600 Service Pack 2

16:05:23 10/07/2008
mbam-log-7-10-2008 (16-05-23).txt

Type de recherche: Examen complet (D:\|)
Eléments examinés: 153543
Temps écoulé: 1 hour(s), 8 minute(s), 48 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 12
Fichier(s) infecté(s): 76

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
D:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Unloaded module successfully.
D:\WINDOWS\system32\LogCrypt.dll (Trojan.Downloader) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\usb2_04 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\usb2_04 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\usb2_04 (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\winctrl32 (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tcpsr (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logcrypt (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\runtime (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RUNTIME (Rootkit.Agent) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
D:\Program Files\shctj1j0egel (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\shctj1j0egel\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
D:\Documents and Settings\Administrateur\Local Settings\Temp\~nsu.tmp\Au_.exe (Rogue.Installer) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\Uninstall.exe (Rogue.Installer) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP102\A0006028.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP103\A0006052.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP103\A0006077.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP104\A0006085.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP104\A0006093.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP110\A0008258.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP115\A0008343.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP83\A0004762.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP85\A0004864.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP85\snapshot\MFEX-1.DAT (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP86\A0005864.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP86\snapshot\MFEX-1.DAT (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP87\A0005872.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP87\A0005894.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{AE7FFE10-C148-4644-985B-353B449CB084}\RP87\snapshot\MFEX-1.DAT (Trojan.Vundo) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\drivers\nkv2.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN1A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN1D.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN1E.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN1F.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN20.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN22.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN23.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN25.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN26.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\shctj1j0egel.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\shctj1j0egel.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\shctj1j0egel\shctj1j0egelSkin.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Application Data\Microsoft\Internet Explorer\Quick Launch\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Delete on reboot.
D:\WINDOWS\system32\WinData.cab (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Administrateur\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\LogCrypt.dll (Trojan.Downloader) -> Delete on reboot.
D:\WINDOWS\system32\blphcrj1j0egel.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\lphcrj1j0egel.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\phcrj1j0egel.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\3_exception.nls (Trojan.Tibs) -> Quarantined and deleted successfully.
D:\Documents and Settings\All Users\Bureau\Malware Protector 2008.lnk (Rogue.MalwareProtector2008) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN10.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN11.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN12.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN13.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN14.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN16.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN17.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN18.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN19.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN1B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN1C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN21.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN24.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN27.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN28.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN29.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN2A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN2B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN2C.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN2D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN2E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN2F.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN30.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN31.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\Temp\BN3A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.



Merci de votre aide.

Va falloir effacer les points de restaurations il sont infecter, mais fais d'abbord un rapport Hijack pour voir si tout est clean