infection de plusieurs virus win32:trojan-gen + win32:agent-jyn+ win32jzc

Parachutiste, encore quelques efforts et t'aura plus de rootkits

Sinon pour le spoiler je t'explique:




Clique sur le point d'intérogation et ensuite met ton log entre les deux Spoiler et tu verra c'est magique

[08/23/2007, 17:16:52] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\stephane\Local Settings\Temporary Internet Files\Content.IE5\6RGHZF7A\VirtumundoBeGone[1].exe" )
[08/23/2007, 17:17:02] - Detected System Information:
[08/23/2007, 17:17:02] - Windows Version: 5.1.2600, Service Pack 2
[08/23/2007, 17:17:02] - Current Username: stephane (Admin)
[08/23/2007, 17:17:02] - Windows is in NORMAL mode.
[08/23/2007, 17:17:03] - Searching for Browser Helper Objects:
[08/23/2007, 17:17:03] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[08/23/2007, 17:17:03] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/23/2007, 17:17:03] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/23/2007, 17:17:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 17:17:03] - No filename found. Continuing.
[08/23/2007, 17:17:03] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[08/23/2007, 17:17:03] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[08/23/2007, 17:17:03] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/23/2007, 17:17:03] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/23/2007, 17:17:03] - BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[08/23/2007, 17:17:03] - BHO 9: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/23/2007, 17:17:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 17:17:03] - Checking for HKLM\...\Winlogon\Notify\tmpA.tmp
[08/23/2007, 17:17:03] - Key not found: HKLM\...\Winlogon\Notify\tmpA.tmp, continuing.
[08/23/2007, 17:17:03] - BHO 10: {e4680c28-6dd9-4107-9e4d-fb1a38380a04} ()
[08/23/2007, 17:17:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 17:17:03] - Checking for HKLM\...\Winlogon\Notify\appser
[08/23/2007, 17:17:03] - Found: HKLM\...\Winlogon\Notify\appser - This is probably Virtumundo.
[08/23/2007, 17:17:03] - Assigning {e4680c28-6dd9-4107-9e4d-fb1a38380a04} MSEvents Object
[08/23/2007, 17:17:03] - BHO list has been changed! Starting over...
[08/23/2007, 17:17:03] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[08/23/2007, 17:17:03] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/23/2007, 17:17:03] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/23/2007, 17:17:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 17:17:03] - No filename found. Continuing.
[08/23/2007, 17:17:03] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[08/23/2007, 17:17:03] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[08/23/2007, 17:17:03] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/23/2007, 17:17:03] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/23/2007, 17:17:03] - BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[08/23/2007, 17:17:03] - BHO 9: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/23/2007, 17:17:03] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 17:17:03] - Checking for HKLM\...\Winlogon\Notify\tmpA.tmp
[08/23/2007, 17:17:03] - Key not found: HKLM\...\Winlogon\Notify\tmpA.tmp, continuing.
[08/23/2007, 17:17:03] - BHO 10: {e4680c28-6dd9-4107-9e4d-fb1a38380a04} (MSEvents Object)
[08/23/2007, 17:17:03] - ALERT: Found MSEvents Object!
[08/23/2007, 17:17:04] - Finished Searching Browser Helper Objects
[08/23/2007, 17:17:04] - *** Detected MSEvents Object
[08/23/2007, 17:17:04] - Trying to remove MSEvents Object...
[08/23/2007, 17:17:05] - Terminating Process: IEXPLORE.EXE
[08/23/2007, 17:17:05] - Terminating Process: RUNDLL32.EXE
[08/23/2007, 17:17:06] - Disabling Automatic Shell Restart
[08/23/2007, 17:17:06] - Terminating Process: EXPLORER.EXE
[08/23/2007, 17:17:06] - Suspending the NT Session Manager System Service
[08/23/2007, 17:17:06] - Terminating Windows NT Logon/Logoff Manager
[08/23/2007, 17:17:07] - Re-enabling Automatic Shell Restart
[08/23/2007, 17:17:07] - File to disable: C:\WINDOWS\system32\appser.dll
[08/23/2007, 17:17:07] - Renaming C:\WINDOWS\system32\appser.dll -> C:\WINDOWS\system32\appser.dll.vir
[08/23/2007, 17:17:09] - File successfully renamed!
[08/23/2007, 17:17:09] - Removing HKLM\...\Browser Helper Objects\{e4680c28-6dd9-4107-9e4d-fb1a38380a04}
[08/23/2007, 17:17:09] - Removing HKCR\CLSID\{e4680c28-6dd9-4107-9e4d-fb1a38380a04}
[08/23/2007, 17:17:09] - Adding Kill Bit for ActiveX for GUID: {e4680c28-6dd9-4107-9e4d-fb1a38380a04}
[08/23/2007, 17:17:10] - Deleting ATLEvents/MSEvents Registry entries
[08/23/2007, 17:17:10] - Removing HKLM\...\Winlogon\Notify\appser
[08/23/2007, 17:17:10] - Searching for Browser Helper Objects:
[08/23/2007, 17:17:10] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[08/23/2007, 17:17:10] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/23/2007, 17:17:10] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/23/2007, 17:17:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 17:17:10] - No filename found. Continuing.
[08/23/2007, 17:17:10] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[08/23/2007, 17:17:10] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[08/23/2007, 17:17:10] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/23/2007, 17:17:10] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/23/2007, 17:17:10] - BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[08/23/2007, 17:17:10] - BHO 9: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/23/2007, 17:17:10] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 17:17:10] - Checking for HKLM\...\Winlogon\Notify\tmpA.tmp
[08/23/2007, 17:17:10] - Key not found: HKLM\...\Winlogon\Notify\tmpA.tmp, continuing.
[08/23/2007, 17:17:10] - Finished Searching Browser Helper Objects
[08/23/2007, 17:17:10] - Finishing up...
[08/23/2007, 17:17:10] - A restart is needed.
[08/23/2007, 17:17:16] - Attempting to Restart via STOP error (Blue Screen!)

[08/23/2007, 21:01:59] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\stephane\Local Settings\Temporary Internet Files\Content.IE5\6RGHZF7A\VirtumundoBeGone[1].exe" )
[08/23/2007, 21:02:01] - Detected System Information:
[08/23/2007, 21:02:01] - Windows Version: 5.1.2600, Service Pack 2
[08/23/2007, 21:02:01] - Current Username: stephane (Admin)
[08/23/2007, 21:02:01] - Windows is in NORMAL mode.
[08/23/2007, 21:02:01] - Searching for Browser Helper Objects:
[08/23/2007, 21:02:02] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[08/23/2007, 21:02:02] - BHO 2: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/23/2007, 21:02:02] - BHO 3: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[08/23/2007, 21:02:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 21:02:02] - No filename found. Continuing.
[08/23/2007, 21:02:02] - BHO 4: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Windows Live Sign-in Helper)
[08/23/2007, 21:02:02] - BHO 5: {9394EDE7-C8B5-483E-8773-474BF36AF6E4} (ST)
[08/23/2007, 21:02:02] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/23/2007, 21:02:02] - BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[08/23/2007, 21:02:02] - BHO 8: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} (MSNToolBandBHO)
[08/23/2007, 21:02:02] - BHO 9: {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} ()
[08/23/2007, 21:02:02] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/23/2007, 21:02:02] - Checking for HKLM\...\Winlogon\Notify\tmpA.tmp
[08/23/2007, 21:02:02] - Key not found: HKLM\...\Winlogon\Notify\tmpA.tmp, continuing.
[08/23/2007, 21:02:02] - Finished Searching Browser Helper Objects
[08/23/2007, 21:02:02] - Finishing up...
[08/23/2007, 21:02:02] - Nothing found! Exiting...




merci de votre patience je ne saia pas si j'ai bien fais tous ce que vous m'avais dit reprenais moi si il le faut

Non, ça c'est VirtumondoBegone. Il faut Vundofix

Rapport Vundofix ==> C:\vundofix.txt

--------


Pour le spoiler, il faut que tu sélectionne tout le texte que tu veux mettre dessous

je ne trouve plus vundofix il faut que je le reface!!!?????????

Regarde, je t'ai marqué où est le rapport:

Rapport Vundofix ==> C:\vundofix.txt

VundoFix V6.5.7

Checking Java version...

Scan started at 21:07:53 23/08/2007

Listing files found while scanning....

C:\WINDOWS\system32\tmp2.tmp.dll
C:\WINDOWS\System32\tmp21.tmp.dll
C:\WINDOWS\system32\tmpA.tmp.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\tmp2.tmp.dll
C:\WINDOWS\system32\tmp2.tmp.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\tmp21.tmp.dll
C:\WINDOWS\System32\tmp21.tmp.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tmpA.tmp.dll
C:\WINDOWS\system32\tmpA.tmp.dll Has been deleted!

Performing Repairs to the registry.
Done!



Ajout du 23-08-2007 à 22:04:


VundoFix V6.5.7

Checking Java version...

Scan started at 21:07:53 23/08/2007

Listing files found while scanning....

C:\WINDOWS\system32\tmp2.tmp.dll
C:\WINDOWS\System32\tmp21.tmp.dll
C:\WINDOWS\system32\tmpA.tmp.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\tmp2.tmp.dll
C:\WINDOWS\system32\tmp2.tmp.dll Has been deleted!

Attempting to delete C:\WINDOWS\System32\tmp21.tmp.dll
C:\WINDOWS\System32\tmp21.tmp.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tmpA.tmp.dll
C:\WINDOWS\system32\tmpA.tmp.dll Has been deleted!

Performing Repairs to the registry.
Done!

Supprime le log qui ne serre a rien ...(tu en as mis deux)

Sinon refait un Hijackthis maintenant.

[spoiler][Logfile of HijackThis v1.99.1
Scan saved at 16:42:03, on 23/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\Canon\MULTIP~1\MPTBox.exe
C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\BRMFRSMG.EXE
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Canon\MultiPASS4\MPDBMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\stephane\Local Settings\Temporary Internet Files\Content.IE5\KX0DMPKP\hijackthis[1]\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://recherche.neuf.fr/ie/default.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neufportail.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://C:\APPS\IE\offline\fr.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.sweetim.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\apps\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmpA.tmp.dll
O2 - BHO: (no name) - {e4680c28-6dd9-4107-9e4d-fb1a38380a04} - C:\WINDOWS\system32\appser.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [MPTBox] C:\PROGRA~1\Canon\MULTIP~1\MPTBox.exe
O4 - HKLM\..\Run: [Omnipage] C:\Program Files\ScanSoft\OmniPageSE\opware32.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1179928957671
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1180038379937
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_fr_dl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: appser - C:\WINDOWS\SYSTEM32\appser.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: MpService - Canon Inc. - C:\Program Files\Canon\MultiPASS4\MPSERVIC.EXE

/spoiler]

Infection vundo toujours présente, fait ça:

=> Télécharger Cumbofix
=> Enregistre le sur le bureau et n'y touche pas.
=> Fais : Démarrer ==> executer
=> Et copie/colle ceci dans la case qui apparaît :


"%userprofile%\Bureau\combofix.exe" /v kbdson

=> Clic sur OK.
= Un tableau s’ouvre sur le bureau ( = Combofix se lance seul)
=> A la demande :Type 1 to continue or 2 to abort
taper 1 puis Entrée
=> Attendre le rapport dans le bloc note sur le bureau. Puis le poster.

Télécharger sur le bureau
ComboFix
(En dessou du titre Téléchargement Clic "sUBS" qui est en rose"

* Enregistre le sur le bureau et n'y touche pas.

* Fais : Démarrer ==> executer

et copie/colle ceci dans la case qui apparaît :


"%userprofile%\Bureau\combofix.exe" /v kbdson


* Clic sur OK.
Un tableau s’ouvre sur le bureau ( = Combofix se lance seul)

* A la demande :Type Y to continue or N to abort
taper Y puis Entrée

Attendre le rapport dans le bloc note sur le bureau. Puis le poster.