agrigento05

Svp, quelqu'un pourrait-il m'aider je suis vraiment sans idée pour enlever ce trojan

Bonjour à tous, en espérant trouver remède, je vous expose mon problème, depuis ce matin, mon portable était horriblement lent j'ai scan avec norton et là je vois qui passe en aveugle devant Hacktool.unreal.a , tracking cookies, ... je regarde sur symantec et me dise de regarder le registre ce que je fais mais pas de trace dans le registre dans local_machine ainsi que les sous dossier ennoncer... Navigate to and delete the following registry subkeys: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Unreal HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_UNREAL Vu qu'il n'était pas la, très étrange, je décide de formater une première, étant confiant et au démarrage je vois de nouveau Haktool.unreal.a Je reformate et de nouveau la mm histoire, je suis un petit peu décourager jai telecharger combofix et le rapport est fait en esperant que vous puissiez m'aider pour la marche a suivre ! Voilà le rapport de combo: ComboFix 10-03-07.05 - Admin1 08/03/2010 13:24:01.1.2 - x86 Microsoft® Windows Vista™ Édition Familiale Basique 6.0.6001.1.1252.32.1036.18.3000.1919 [GMT 1:00] Lancé depuis: c:\users\Admin1\Desktop\ComboFix.exe SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\$recycle.bin\S-1-5-21-2762926084-2370550536-3046207400-500 c:\windows\system32\Install.cmd . ((((((((((((((((((((((((((((( Fichiers créés du 2010-02-08 au 2010-03-08 )))))))))))))))))))))))))))))))))))) . 2010-03-08 12:28 . 2010-03-08 12:28 -------- d-----w- c:\users\Default\AppData\Local\temp 2010-03-08 11:58 . 2010-03-08 11:58 -------- d-----w- c:\program files\Microsoft 2010-03-08 11:54 . 2010-03-08 12:02 -------- d-----w- c:\users\Admin1\Tracing 2010-03-08 11:51 . 2010-03-08 11:51 -------- d-----w- c:\users\Admin1\AppData\Local\Symantec 2010-03-08 11:50 . 2009-01-10 12:59 25136 ----a-r- c:\windows\system32\drivers\SymIMV.sys 2010-03-08 11:50 . 2010-03-08 11:50 124464 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS 2010-03-08 11:50 . 2010-03-08 11:52 -------- d-----w- c:\program files\Common Files\Symantec Shared 2010-03-08 11:50 . 2010-03-08 11:50 -------- d-----w- c:\program files\Symantec 2010-03-08 11:50 . 2010-03-08 11:50 -------- d-----w- c:\users\Admin1\AppData\Local\Google 2010-03-08 11:49 . 2010-03-08 11:49 71256 ----a-w- c:\users\Admin1\AppData\Local\GDIPFONTCACHEV1.DAT 2010-03-08 11:49 . 2010-03-08 11:49 -------- d-----w- c:\users\Admin1\AppData\Local\Packard Bell 2010-03-08 11:49 . 2010-03-08 11:49 -------- d-----w- c:\users\Admin1\AppData\Local\VirtualStore 2010-03-08 11:47 . 2010-03-08 11:47 56 ---ha-w- c:\windows\system32\ezsidmv.dat 2010-03-08 11:47 . 2008-02-03 11:00 290248 ----a-w- c:\windows\system32\ezsvc7x.dll 2010-03-08 11:47 . 2008-02-03 11:00 129992 ----a-w- c:\windows\system32\ezsvc7.dll 2010-03-08 11:47 . 2010-03-08 11:47 8172 ----a-w- c:\windows\system32\ezdigsgn.dat 2010-03-08 11:47 . 2010-03-08 11:47 91136 ----a-w- c:\windows\system32\ezUninst.exe 2010-03-08 11:47 . 2010-03-08 11:47 49152 ----a-w- c:\windows\system32\ezUPBHook.dll 2010-03-08 11:47 . 2010-03-08 11:47 268288 ----a-w- c:\windows\system32\ezSetup.exe 2010-03-08 11:47 . 2010-03-08 11:47 15872 ----a-w- c:\windows\system32\ezMAPIHelper.exe 2010-03-08 11:47 . 2010-03-08 11:47 111104 ----a-w- c:\windows\system32\ezShellStart.exe 2010-03-08 11:47 . 2010-03-08 11:47 157168 ----a-w- c:\programdata\Partner\partner.dll 2010-03-08 11:47 . 2010-03-08 11:47 110576 ----a-w- c:\programdata\Partner\partner.exe 2010-03-08 11:47 . 2010-03-08 11:47 -------- d-----w- c:\programdata\Partner 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\users\Default\Voisinage réseau 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\users\Default\Voisinage d'impression 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\users\Default\Modèles 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\users\Default\Mes documents 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\users\Default\Menu Démarrer 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\users\Default\AppData\Local\Historique 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\programdata\Modèles 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\programdata\Menu Démarrer 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\programdata\Favoris 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\programdata\Bureau 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\program files\Fichiers communs 2010-03-08 11:38 . 2010-03-08 11:38 -------- d-----w- c:\windows\system32\Lang 2010-03-08 11:38 . 2008-08-12 03:02 920088 ----a-w- c:\windows\system32\igxpun.exe 2010-03-08 11:38 . 2006-11-10 01:25 319456 ----a-w- c:\windows\system32\difxapi.dll 2010-03-07 09:00 . 2010-03-07 09:00 84912 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\NAVENG.SYS 2010-03-07 09:00 . 2010-03-07 09:00 371248 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\EECTRL.SYS 2010-03-07 09:00 . 2010-03-07 09:00 2747440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\CCERASER.DLL 2010-03-07 09:00 . 2010-03-07 09:00 259440 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\ECMSVR32.DLL 2010-03-07 09:00 . 2010-03-07 09:00 177520 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\NAVENG32.DLL 2010-03-07 09:00 . 2010-03-07 09:00 1647984 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\NAVEX32A.DLL 2010-03-07 09:00 . 2010-03-07 09:00 1324720 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\NAVEX15.SYS 2010-03-07 09:00 . 2010-03-07 09:00 102448 ----a-w- c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100307.022\ERASER.SYS . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2010-03-08 12:01 . 2009-01-10 12:54 -------- d-----w- c:\program files\Windows Live 2010-03-08 11:52 . 2009-01-10 12:45 -------- d-----w- c:\program files\Google 2010-03-08 11:52 . 2009-01-10 12:59 -------- d-----w- c:\programdata\Norton 2010-03-08 11:50 . 2010-03-08 11:50 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF 2010-03-08 11:50 . 2010-03-08 11:50 10635 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT 2010-03-08 11:47 . 2009-01-10 20:12 -------- d-----w- c:\program files\PACKARD BELL 2010-03-08 11:47 . 2008-01-21 07:23 669566 ----a-w- c:\windows\system32\perfh00C.dat 2010-03-08 11:47 . 2008-01-21 07:23 123556 ----a-w- c:\windows\system32\perfc00C.dat 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\programdata\Modèles 2010-03-08 11:42 . 2010-03-08 11:42 -------- d-sh--we c:\programdata\Menu Démarrer . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-21 2153472] "SmpcSys"="c:\program files\Packard Bell\SetupmyPC\SmpSys.exe" [2008-07-07 1038136] "msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184] "RtHDVCpl"="RtHDVCpl.exe" [2008-08-04 6265376] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-08 894512] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-01-10 30192] "SmpcSys"="c:\program files\Packard Bell\SetupMyPC\SmpSys.exe" [2008-07-07 1038136] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-08-12 150040] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-08-12 170520] "Persistence"="c:\windows\system32\igfxpers.exe" [2008-08-12 145944] "Trigger New Acer AlaunchX"="c:\acer\Preload\Command\AlaunchX\AppInRun.exe" [2008-12-05 204800] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "New Acer AlaunchX"="c:\acer\Preload\Command\AlaunchX\LaunchAlaunchX.exe" [2008-07-17 200704] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=wdmaud.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend] @="Service" R2 ezSharedSvc;Easybits Shared Services for Windows;c:\windows\system32\svchost.exe [2008-01-21 21504] R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2009-01-10 30192] R3 KWRV;KWRV;c:\users\Admin1\AppData\Local\Temp\KWRV.exe [x] R3 NETw5v32;Pilote de carte Intel® Wireless WiFi Link pour Windows Vista 32 bits ;c:\windows\system32\DRIVERS\NETw5v32.sys [2008-04-27 3658752] R3 PIO;PIO;c:\users\Admin1\AppData\Local\Temp\PIO.exe [x] S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1000000.07D\SYMEFA.SYS [2009-01-10 309296] S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1000000.07D\BHDrvx86.sys [2009-01-10 254512] S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1000000.07D\ccHPx86.sys [2009-01-10 362544] S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20080826.006\IDSVix86.sys [2009-01-10 289840] S2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [2009-01-10 115560] S3 netr28;Ralink 802.11n Wireless Driver for Windows Vista;c:\windows\system32\DRIVERS\netr28.sys [2008-07-29 418816] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - BHDRVX86 *NewlyCreated* - CCHP *NewlyCreated* - EECTRL *NewlyCreated* - ERASERUTILDRV10822 *NewlyCreated* - IDSVIX86 *NewlyCreated* - SYMDNS *NewlyCreated* - SYMEFA *NewlyCreated* - SYMEVENT *NewlyCreated* - SYMFW *NewlyCreated* - SYMIM *NewlyCreated* - SYMNDISV *NewlyCreated* - SYMREDRV *NewlyCreated* - SYMTDI *NewlyCreated* - VOLSNAP *Deregistered* - EraserUtilDrv10822 *Deregistered* - SYMDNS *Deregistered* - SYMFW *Deregistered* - SYMNDISV *Deregistered* - SYMREDRV [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs ezSharedSvc . . ------- Examen supplémentaire ------- . uStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=080c&s=2&o=vb32&d=0310&m=easynote_mh36 mStart Page = hxxp://homepage.packardbell.com/rdr.aspx?b=ACPW&l=080c&s=2&o=vb32&d=0310&m=easynote_mh36 . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-03-08 13:28 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security] "ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1" . Heure de fin: 2010-03-08 13:30:47 ComboFix-quarantined-files.txt 2010-03-08 12:30 Avant-CF: 122.803.982.336 octets libres Après-CF: 122.883.874.816 octets libres - - End Of File - - DEC82433ED07B91B49C7037C8559EC45 bien à vous