petit probleme avec"alerte de securité window

Question

Bonjour,

j ai un probleme

le centre de securité windows ne peut (ou veut) plus telecharger les nouvelles mise à jour automatiques
il me dit de le faire manuellement dans le systeme (ca ne fonctionne pas bien evidemment)

auparavant j ai un un virus 
mon anti virus (avast devrait l avoir supprimer mais j en suis pas sur)
je pense que mon probleme vient de la 

depuis ce virus il y a des fenetres de publicité d internet qui arrive (internet est fermé mais pas la connexion)


une idée ???

merci  tous

Utilisateur anonyme · Answer

Bonjour, Telecharges sur ton bureau Hijackthis : http://www.trendsecure.com/portal/en-US/tools/Security_tools/hijackthis Fermes tous les programmes en cours et double-cliques sur hijackthis Executes le en cliquant sur ( Do a scan and save a logfile) >> le rapport s'ouvre sur le bloc-note Enregistres le et postes le sur le forum stp...

ADDX · Answer

http://img1.imagilive.com/1208/bug.jpg

il y a aussi ca qui apparait

regarder aussi en bas a droite la petite fenetre

ADDX · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:39:39, on 22.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\ADDX\Application Data\gadcom\gadcom.exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O3 - Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [18e6b8aa] rundll32.exe "C:\WINDOWS\system32	pvutgum.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\ADDX\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: fcieav.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

Utilisateur anonyme · Answer

Telecharges Navilog1 sur ton bureau : http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe Desactives ton antivirus le temps de la recherche, tu le reactiveras apres.... Double cliques sur le raccourci de ton bureau et lances l'installation... celle-ci fini, fermes toutes les applications en cours et double cliques sur Navilog1.exe Choisis la langue et valides avec ' entree'>> double cliques ensuite sur Navilog1.bat ( il se peut qu'il n'apparraisse pas et que tu n'aies que Navilog1) appuies sur 1 touche pour passer aux etapes suivantes... le menu du fix s'ouvre, choisis l'option1 et presses la touche ENTREE de ton clavier... laisses le fix travailler, a la fin, un rapport sera genere, postes le stp Note : ( le rapport Fixnavi.txt se trouve a la racine du disque dur )

ADDX · Answer

voila,


Search Navipromo version 3.7.0 commencé le 22.12.2008 à 12:10:13.45

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     E6850  @ 3.00GHz )
BIOS : BIOS Date: 09/01/07 12:30:15 Ver: 08.00.12
USER : ADDX ( Administrator )
BOOT : Normal boot

Antivirus : avast! antivirus 4.8.1296 [VPS 081221-0] 4.8.1296 (Not Activated)


A:\ (USB)
C:\ (Local Disk) - NTFS - Total:465 Go (Free:347 Go)
D:\ (CD or DVD) - CDFS - Total:6 Go (Free:0 Go)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\ADDX\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\ADDX\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\ADDX\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\ADDX\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\ADDX\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :

C:\WINDOWS\system32\mWHjPqru.ini2 trouvé ! Infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 22.12.2008 à 12:13:23.06 ***

Utilisateur anonyme · Answer

Ok. laisses tomber Navilog >>> lop Telecharges lopsd sur ton bureau: https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 Fermes tou les programmes en cours et lances l'installation en executant le fichier telecharge.. Desactives ton antivirus... double-cliques sur le raccourci de ton bureau Selectionnes la langue et valide par entree... Le menu apparait, choisis l'option1 ( recherche) ne touche pas au pc pendant la recherche, a la fin un rapport est genere, postes le... Note : le rapport Lopsd.txt se trouve a la racine du disque dur ...

ADDX · Answer

Merci pour tous aide
  

 --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     E6850  @ 3.00GHz )
   BIOS : BIOS Date: 09/01/07 12:30:15 Ver: 08.00.12
   USER : ADDX ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1296 [VPS 081221-0] 4.8.1296 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:465 Go (Free:347 Go)
   D:\ (CD or DVD) - CDFS - Total:6 Go (Free:0 Go)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 22.12.2008|12:31 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [19.01.2008|22:15] C:\DOCUME~1\ADDX\APPLIC~1\Adobe
   [01.03.2008|11:22] C:\DOCUME~1\ADDX\APPLIC~1\Ahead
   [06.09.2008|22:40] C:\DOCUME~1\ADDX\APPLIC~1\Apple Computer
   [20.01.2008|00:00] C:\DOCUME~1\ADDX\APPLIC~1\Command & Conquer 3 Les guerres du Tiberium
   [30.04.2008|15:09] C:\DOCUME~1\ADDX\APPLIC~1\DAEMON Tools
   [17.05.2008|11:21] C:\DOCUME~1\ADDX\APPLIC~1\Desktopicon
   [20.01.2008|22:32] C:\DOCUME~1\ADDX\APPLIC~1\DivX
   [22.12.2008|10:51] C:\DOCUME~1\ADDX\APPLIC~1\gadcom
   [10.02.2008|09:21] C:\DOCUME~1\ADDX\APPLIC~1\Google
   [06.09.2008|22:50] C:\DOCUME~1\ADDX\APPLIC~1\Help
   [19.01.2008|18:25] C:\DOCUME~1\ADDX\APPLIC~1\Identities
   [09.02.2008|10:05] C:\DOCUME~1\ADDX\APPLIC~1\InstallShield
   [20.01.2008|00:41] C:\DOCUME~1\ADDX\APPLIC~1\InstallShield Installation Information
   [08.02.2008|19:33] C:\DOCUME~1\ADDX\APPLIC~1\LimeWire
   [06.07.2008|09:58] C:\DOCUME~1\ADDX\APPLIC~1\Locktime
   [09.02.2008|10:09] C:\DOCUME~1\ADDX\APPLIC~1\Logitech
   [20.01.2008|21:26] C:\DOCUME~1\ADDX\APPLIC~1\Macromedia
   [27.04.2008|13:52] C:\DOCUME~1\ADDX\APPLIC~1\Media Player Classic
   [10.10.2008|18:14] C:\DOCUME~1\ADDX\APPLIC~1\Microsoft
   [05.04.2008|18:26] C:\DOCUME~1\ADDX\APPLIC~1\Microsoft Web Folders
   [12.10.2008|14:11] C:\DOCUME~1\ADDX\APPLIC~1\MSN6
   [03.02.2008|21:21] C:\DOCUME~1\ADDX\APPLIC~1\MSNInstaller
   [25.02.2008|14:37] C:\DOCUME~1\ADDX\APPLIC~1\Notepad++
   [25.01.2008|18:44] C:\DOCUME~1\ADDX\APPLIC~1\Real
   [19.01.2008|23:28] C:\DOCUME~1\ADDX\APPLIC~1\SecuROM
   [22.12.2008|12:14] C:\DOCUME~1\ADDX\APPLIC~1\Skype
   [22.12.2008|09:09] C:\DOCUME~1\ADDX\APPLIC~1\skypePM
   [01.02.2008|22:06] C:\DOCUME~1\ADDX\APPLIC~1\Sun
   [28.09.2008|15:45] C:\DOCUME~1\ADDX\APPLIC~1	eamspeak2
   [25.05.2008|07:37] C:\DOCUME~1\ADDX\APPLIC~1\TuneUp Software
   [22.12.2008|09:47] C:\DOCUME~1\ADDX\APPLIC~1\vghd
   [12.05.2008|19:20] C:\DOCUME~1\ADDX\APPLIC~1\WinRAR
   [29.07.2008|16:56] C:\DOCUME~1\ADDX\APPLIC~1\Xfire
   [19.01.2008|23:20] C:\DOCUME~1\ADDX\APPLIC~1\Yahoo!

   [22.11.2008|11:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [23.02.2008|15:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [19.01.2008|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [13.02.2008|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [13.02.2008|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [20.01.2008|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [06.07.2008|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Locktime
   [19.01.2008|22:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
   [09.02.2008|10:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [17.05.2008|17:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Media Center Programs
   [12.10.2008|14:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [12.10.2008|14:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [19.01.2008|22:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [07.09.2008|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [29.06.2008|15:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [25.05.2008|07:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [31.05.2008|18:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [12.10.2008|14:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [24.04.2008|15:15] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [19.01.2008|18:18] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [29.07.2008|16:56] C:\DOCUME~1\LOCALS~1\APPLIC~1\Xfire

   [19.01.2008|18:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [22.12.2008 12:00][--a------] C:\WINDOWS	asks\peekbudz.job
   [22.12.2008 12:00][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [09.11.2008 11:43][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [22.12.2008 11:13][--ah-----] C:\WINDOWS	asks\SA.DAT
   [02.03.2006 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [05.07.2008|08:08] C:\Program Files\Adobe
   [11.04.2008|17:56] C:\Program Files\Alwil Software
   [19.01.2008|22:29] C:\Program Files\Analog Devices
   [09.11.2008|11:44] C:\Program Files\Apple Software Update
   [19.01.2008|22:35] C:\Program Files\ASUS WiFi-AP Solo
   [09.11.2008|11:32] C:\Program Files\Bonjour
   [23.02.2008|18:04] C:\Program Files\Bullfrog
   [23.05.2008|17:45] C:\Program Files\CCleaner
   [19.01.2008|18:16] C:\Program Files\ComPlus Applications
   [23.10.2008|17:38] C:\Program Files\Conduit
   [25.03.2008|21:40] C:\Program Files\directx
   [14.07.2008|18:06] C:\Program Files\DivX
   [19.08.2008|18:47] C:\Program Files\EA Games
   [28.06.2008|11:27] C:\Program Files\Electronic Arts
   [25.02.2008|14:37] C:\Program Files\eMule
   [26.07.2008|09:32] C:\Program Files\Fichiers communs
   [23.10.2008|17:38] C:\Program Files\free-downloads.net
   [23.04.2008|16:04] C:\Program Files\GameSpy
   [10.10.2008|20:33] C:\Program Files\GameSpy Arcade
   [13.08.2008|10:53] C:\Program Files\Gas Powered Games
   [10.02.2008|09:21] C:\Program Files\Google
   [10.10.2008|20:34] C:\Program Files\GTA2 Game Hunter
   [24.10.2008|08:30] C:\Program Files\InstallShield Installation Information
   [19.01.2008|22:21] C:\Program Files\Intel
   [12.12.2008|22:33] C:\Program Files\Internet Explorer
   [22.11.2008|11:43] C:\Program Files\iPod
   [22.11.2008|11:43] C:\Program Files\iTunes
   [25.05.2008|12:26] C:\Program Files\Java
   [28.11.2008|20:34] C:\Program Files\JoWooD
   [09.02.2008|10:08] C:\Program Files\Logitech
   [19.01.2008|22:32] C:\Program Files\Marvell
   [13.10.2008|16:29] C:\Program Files\Messenger
   [19.01.2008|18:19] C:\Program Files\microsoft frontpage
   [28.11.2008|21:07] C:\Program Files\Microsoft Games
   [05.04.2008|18:26] C:\Program Files\Microsoft Office
   [03.02.2008|21:27] C:\Program Files\Microsoft SQL Server Compact Edition
   [12.10.2008|13:45] C:\Program Files\Movie Maker
   [14.11.2008|18:34] C:\Program Files\Mozilla Firefox
   [05.07.2008|18:11] C:\Program Files\MSBuild
   [12.10.2008|14:11] C:\Program Files\MSN
   [19.01.2008|18:16] C:\Program Files\MSN Gaming Zone
   [20.12.2008|23:09] C:\Program Files\MSN Messenger
   [25.01.2008|19:55] C:\Program Files\MSXML 4.0
   [22.12.2008|12:13] C:\Program Files\Navilog1
   [15.11.2008|16:32] C:\Program Files\Neoact
   [19.01.2008|22:41] C:\Program Files\Nero
   [12.10.2008|13:43] C:\Program Files\NetMeeting
   [25.02.2008|14:37] C:\Program Files\Notepad++
   [19.01.2008|18:16] C:\Program Files\Online Services
   [12.10.2008|13:43] C:\Program Files\Outlook Express
   [22.11.2008|15:43] C:\Program Files\PurFlirt
   [22.11.2008|11:42] C:\Program Files\QuickTime
   [25.01.2008|18:43] C:\Program Files\Real
   [05.07.2008|18:10] C:\Program Files\Reference Assemblies
   [16.02.2008|11:15] C:\Program Files\RegCleaner
   [27.04.2008|21:47] C:\Program Files\Rockstar Games
   [22.11.2008|11:34] C:\Program Files\Safari
   [07.09.2008|09:03] C:\Program Files\Samurize
   [06.09.2008|15:37] C:\Program Files\Satsuki Decoder Pack
   [19.01.2008|18:17] C:\Program Files\Services en ligne
   [29.06.2008|15:30] C:\Program Files\Skype
   [07.09.2008|09:02] C:\Program Files\SpeedFan
   [28.06.2008|11:28] C:\Program Files\Teamspeak2_RC2
   [17.05.2008|17:02] C:\Program Files\THQ
   [24.05.2008|11:12] C:\Program Files\Tremulous
   [22.12.2008|11:39] C:\Program Files\Trend Micro
   [21.12.2008|15:26] C:\Program Files\TryMedia
   [24.10.2008|08:30] C:\Program Files\Ubisoft
   [19.01.2008|18:25] C:\Program Files\Uninstall Information
   [25.05.2008|12:52] C:\Program Files\Unlocker
   [22.12.2008|10:51] C:\Program Files\vghd
   [30.11.2008|16:47] C:\Program Files\VS Revo Group
   [29.11.2008|10:17] C:\Program Files\Widelands
   [12.10.2008|14:17] C:\Program Files\Windows Live
   [10.10.2008|20:36] C:\Program Files\Windows Live Toolbar
   [08.06.2008|16:45] C:\Program Files\Windows Media Connect 2
   [14.11.2008|21:55] C:\Program Files\Windows Media Player
   [12.10.2008|13:43] C:\Program Files\Windows NT
   [19.01.2008|18:17] C:\Program Files\WindowsUpdate
   [12.05.2008|19:19] C:\Program Files\WinRAR
   [19.01.2008|18:19] C:\Program Files\xerox
   [29.07.2008|16:46] C:\Program Files\Xfire
   [10.10.2008|20:35] C:\Program Files\Yahoo!
   [21.12.2008|00:43] C:\Program Files\YesMessenger

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [23.02.2008|15:33] C:\Program Files\Fichiers communs\Adobe
   [19.01.2008|22:44] C:\Program Files\Fichiers communs\Ahead
   [22.11.2008|11:43] C:\Program Files\Fichiers communs\Apple
   [05.04.2008|18:28] C:\Program Files\Fichiers communs\Designer
   [19.01.2008|22:35] C:\Program Files\Fichiers communs\InstallShield
   [09.02.2008|10:08] C:\Program Files\Fichiers communs\LogiShared
   [26.07.2008|09:32] C:\Program Files\Fichiers communs\Logishrd
   [26.07.2008|09:32] C:\Program Files\Fichiers communs\Logitech
   [05.04.2008|18:27] C:\Program Files\Fichiers communs\Microsoft Shared
   [19.01.2008|18:17] C:\Program Files\Fichiers communs\MSSoap
   [20.01.2008|02:02] C:\Program Files\Fichiers communs\ODBC
   [25.01.2008|18:43] C:\Program Files\Fichiers communs\Real
   [19.01.2008|18:17] C:\Program Files\Fichiers communs\Services
   [29.06.2008|15:30] C:\Program Files\Fichiers communs\Skype
   [20.01.2008|02:02] C:\Program Files\Fichiers communs\SpeechEngines
   [12.10.2008|13:43] C:\Program Files\Fichiers communs\System
   [03.02.2008|21:25] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [25.01.2008|18:43] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 47 Processes )

   IEXPLORE.EXE ~ [PID:1124]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\ADDX\Cookies\addx@advertstream[1].txt
   C:\DOCUME~1\ADDX\Cookies\addx@advertising[1].txt
   C:\DOCUME~1\ADDX\Cookies\addx@www.advertising365[1].txt
   C:\DOCUME~1\ADDX\Cookies\addx@adopt.euroclick[2].txt
   C:\DOCUME~1\ADDX\Cookies\addx@partypoker[2].txt
   C:\DOCUME~1\ADDX\Cookies\addx@partypoker[3].txt
   C:\DOCUME~1\ADDX\Cookies\addx@888[2].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-12-22 12:37:16
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\mWHjPqru.ini
   C:\WINDOWS\system32\mWHjPqru.ini2
   C:\WINDOWS\system32\urqPjHWm.dll
   [b]==> VUNDO <==/b
 
   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FarCry2.exe
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FC2.dll


   [F:152][D:2]-> C:\DOCUME~1\ADDX\LOCALS~1\Temp
   [F:163][D:0]-> C:\DOCUME~1\ADDX\Cookies
   [F:1822][D:8]-> C:\DOCUME~1\ADDX\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 22.12.2008|12:39 - Option : [1]

   --------------------\  Fin du rapport a 12:39:20

Utilisateur anonyme · Answer

Ok, relances Lopsd et choisis maintenant l'option2 >>> nettoyage <<<< un rapport sera genere postes... Ensuite avant de continuer il va falloir virer tes cracks >> sinon l'infection ne pourra pas etre supprimer... Fais le et dis moi si tu es d'accord... Apres avoi passe Lopsd, fais ToolBarSD>>> Telecharges ToolBarSd sur ton bureau https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 Fermes toutes les applications en cours et lances l'installation en executant le fichier telecharge... Double-cliques sur le raccourci de ton bureau et selectionnes la langue puis valide avec Entree>> choisis dans le menu, l'option1 et patientes jusqu'a la fin un rapport sera genere, postes le stp...+ un nouveau rapport hijackthis...

ADDX · Answer

comment je fais pour retrouver le(s) crack(s) si je ne le(s) trouve pas ? ( c'est possible que je l'aie deja supprimé)

ADDX · Answer

pourquoi "tans que tu est d accord" ?

le rapport de Lopsd

   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     E6850  @ 3.00GHz )
   BIOS : BIOS Date: 09/01/07 12:30:15 Ver: 08.00.12
   USER : ADDX ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1296 [VPS 081221-0] 4.8.1296 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:465 Go (Free:347 Go)
   D:\ (CD or DVD) - CDFS - Total:6 Go (Free:0 Go)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 22.12.2008|13:22 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\ADDX\Cookies\addx@advertstream[1].txt
   Supprime! - C:\DOCUME~1\ADDX\Cookies\addx@advertising[1].txt
   Supprime! - C:\DOCUME~1\ADDX\Cookies\addx@www.advertising365[1].txt
   Supprime! - C:\DOCUME~1\ADDX\Cookies\addx@adopt.euroclick[2].txt
   Supprime! - C:\DOCUME~1\ADDX\Cookies\addx@partypoker[2].txt
   Supprime! - C:\DOCUME~1\ADDX\Cookies\addx@partypoker[3].txt
   Supprime! - C:\DOCUME~1\ADDX\Cookies\addx@888[2].txt
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [19.01.2008|22:15] C:\DOCUME~1\ADDX\APPLIC~1\Adobe
   [01.03.2008|11:22] C:\DOCUME~1\ADDX\APPLIC~1\Ahead
   [06.09.2008|22:40] C:\DOCUME~1\ADDX\APPLIC~1\Apple Computer
   [20.01.2008|00:00] C:\DOCUME~1\ADDX\APPLIC~1\Command & Conquer 3 Les guerres du Tiberium
   [30.04.2008|15:09] C:\DOCUME~1\ADDX\APPLIC~1\DAEMON Tools
   [17.05.2008|11:21] C:\DOCUME~1\ADDX\APPLIC~1\Desktopicon
   [20.01.2008|22:32] C:\DOCUME~1\ADDX\APPLIC~1\DivX
   [22.12.2008|10:51] C:\DOCUME~1\ADDX\APPLIC~1\gadcom
   [10.02.2008|09:21] C:\DOCUME~1\ADDX\APPLIC~1\Google
   [06.09.2008|22:50] C:\DOCUME~1\ADDX\APPLIC~1\Help
   [19.01.2008|18:25] C:\DOCUME~1\ADDX\APPLIC~1\Identities
   [09.02.2008|10:05] C:\DOCUME~1\ADDX\APPLIC~1\InstallShield
   [20.01.2008|00:41] C:\DOCUME~1\ADDX\APPLIC~1\InstallShield Installation Information
   [08.02.2008|19:33] C:\DOCUME~1\ADDX\APPLIC~1\LimeWire
   [06.07.2008|09:58] C:\DOCUME~1\ADDX\APPLIC~1\Locktime
   [09.02.2008|10:09] C:\DOCUME~1\ADDX\APPLIC~1\Logitech
   [20.01.2008|21:26] C:\DOCUME~1\ADDX\APPLIC~1\Macromedia
   [27.04.2008|13:52] C:\DOCUME~1\ADDX\APPLIC~1\Media Player Classic
   [10.10.2008|18:14] C:\DOCUME~1\ADDX\APPLIC~1\Microsoft
   [05.04.2008|18:26] C:\DOCUME~1\ADDX\APPLIC~1\Microsoft Web Folders
   [12.10.2008|14:11] C:\DOCUME~1\ADDX\APPLIC~1\MSN6
   [03.02.2008|21:21] C:\DOCUME~1\ADDX\APPLIC~1\MSNInstaller
   [25.02.2008|14:37] C:\DOCUME~1\ADDX\APPLIC~1\Notepad++
   [25.01.2008|18:44] C:\DOCUME~1\ADDX\APPLIC~1\Real
   [19.01.2008|23:28] C:\DOCUME~1\ADDX\APPLIC~1\SecuROM
   [22.12.2008|13:17] C:\DOCUME~1\ADDX\APPLIC~1\Skype
   [22.12.2008|09:09] C:\DOCUME~1\ADDX\APPLIC~1\skypePM
   [01.02.2008|22:06] C:\DOCUME~1\ADDX\APPLIC~1\Sun
   [28.09.2008|15:45] C:\DOCUME~1\ADDX\APPLIC~1	eamspeak2
   [25.05.2008|07:37] C:\DOCUME~1\ADDX\APPLIC~1\TuneUp Software
   [22.12.2008|09:47] C:\DOCUME~1\ADDX\APPLIC~1\vghd
   [12.05.2008|19:20] C:\DOCUME~1\ADDX\APPLIC~1\WinRAR
   [29.07.2008|16:56] C:\DOCUME~1\ADDX\APPLIC~1\Xfire
   [19.01.2008|23:20] C:\DOCUME~1\ADDX\APPLIC~1\Yahoo!

   [22.11.2008|11:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [23.02.2008|15:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [19.01.2008|22:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [13.02.2008|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [13.02.2008|12:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [20.01.2008|17:57] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [06.07.2008|09:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Locktime
   [19.01.2008|22:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\LogiShrd
   [09.02.2008|10:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [17.05.2008|17:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Media Center Programs
   [12.10.2008|14:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [12.10.2008|14:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
   [19.01.2008|22:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Nero
   [07.09.2008|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [29.06.2008|15:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [25.05.2008|07:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
   [31.05.2008|18:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [12.10.2008|14:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [24.04.2008|15:15] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [19.01.2008|18:18] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [29.07.2008|16:56] C:\DOCUME~1\LOCALS~1\APPLIC~1\Xfire

   [19.01.2008|18:18] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [22.12.2008 13:00][--a------] C:\WINDOWS	asks\peekbudz.job
   [22.12.2008 13:00][--a------] C:\WINDOWS	asks\Maintenance en 1 clic.job
   [09.11.2008 11:43][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [22.12.2008 11:13][--ah-----] C:\WINDOWS	asks\SA.DAT
   [02.03.2006 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [05.07.2008|08:08] C:\Program Files\Adobe
   [11.04.2008|17:56] C:\Program Files\Alwil Software
   [19.01.2008|22:29] C:\Program Files\Analog Devices
   [09.11.2008|11:44] C:\Program Files\Apple Software Update
   [19.01.2008|22:35] C:\Program Files\ASUS WiFi-AP Solo
   [09.11.2008|11:32] C:\Program Files\Bonjour
   [23.02.2008|18:04] C:\Program Files\Bullfrog
   [23.05.2008|17:45] C:\Program Files\CCleaner
   [19.01.2008|18:16] C:\Program Files\ComPlus Applications
   [23.10.2008|17:38] C:\Program Files\Conduit
   [25.03.2008|21:40] C:\Program Files\directx
   [14.07.2008|18:06] C:\Program Files\DivX
   [19.08.2008|18:47] C:\Program Files\EA Games
   [28.06.2008|11:27] C:\Program Files\Electronic Arts
   [25.02.2008|14:37] C:\Program Files\eMule
   [26.07.2008|09:32] C:\Program Files\Fichiers communs
   [23.10.2008|17:38] C:\Program Files\free-downloads.net
   [23.04.2008|16:04] C:\Program Files\GameSpy
   [10.10.2008|20:33] C:\Program Files\GameSpy Arcade
   [13.08.2008|10:53] C:\Program Files\Gas Powered Games
   [10.02.2008|09:21] C:\Program Files\Google
   [10.10.2008|20:34] C:\Program Files\GTA2 Game Hunter
   [24.10.2008|08:30] C:\Program Files\InstallShield Installation Information
   [19.01.2008|22:21] C:\Program Files\Intel
   [12.12.2008|22:33] C:\Program Files\Internet Explorer
   [22.11.2008|11:43] C:\Program Files\iPod
   [22.11.2008|11:43] C:\Program Files\iTunes
   [25.05.2008|12:26] C:\Program Files\Java
   [28.11.2008|20:34] C:\Program Files\JoWooD
   [09.02.2008|10:08] C:\Program Files\Logitech
   [19.01.2008|22:32] C:\Program Files\Marvell
   [13.10.2008|16:29] C:\Program Files\Messenger
   [19.01.2008|18:19] C:\Program Files\microsoft frontpage
   [28.11.2008|21:07] C:\Program Files\Microsoft Games
   [05.04.2008|18:26] C:\Program Files\Microsoft Office
   [03.02.2008|21:27] C:\Program Files\Microsoft SQL Server Compact Edition
   [12.10.2008|13:45] C:\Program Files\Movie Maker
   [14.11.2008|18:34] C:\Program Files\Mozilla Firefox
   [05.07.2008|18:11] C:\Program Files\MSBuild
   [12.10.2008|14:11] C:\Program Files\MSN
   [19.01.2008|18:16] C:\Program Files\MSN Gaming Zone
   [20.12.2008|23:09] C:\Program Files\MSN Messenger
   [25.01.2008|19:55] C:\Program Files\MSXML 4.0
   [22.12.2008|12:13] C:\Program Files\Navilog1
   [15.11.2008|16:32] C:\Program Files\Neoact
   [19.01.2008|22:41] C:\Program Files\Nero
   [12.10.2008|13:43] C:\Program Files\NetMeeting
   [25.02.2008|14:37] C:\Program Files\Notepad++
   [19.01.2008|18:16] C:\Program Files\Online Services
   [12.10.2008|13:43] C:\Program Files\Outlook Express
   [22.11.2008|15:43] C:\Program Files\PurFlirt
   [22.11.2008|11:42] C:\Program Files\QuickTime
   [25.01.2008|18:43] C:\Program Files\Real
   [05.07.2008|18:10] C:\Program Files\Reference Assemblies
   [16.02.2008|11:15] C:\Program Files\RegCleaner
   [27.04.2008|21:47] C:\Program Files\Rockstar Games
   [22.11.2008|11:34] C:\Program Files\Safari
   [07.09.2008|09:03] C:\Program Files\Samurize
   [06.09.2008|15:37] C:\Program Files\Satsuki Decoder Pack
   [19.01.2008|18:17] C:\Program Files\Services en ligne
   [29.06.2008|15:30] C:\Program Files\Skype
   [07.09.2008|09:02] C:\Program Files\SpeedFan
   [28.06.2008|11:28] C:\Program Files\Teamspeak2_RC2
   [17.05.2008|17:02] C:\Program Files\THQ
   [24.05.2008|11:12] C:\Program Files\Tremulous
   [22.12.2008|11:39] C:\Program Files\Trend Micro
   [21.12.2008|15:26] C:\Program Files\TryMedia
   [24.10.2008|08:30] C:\Program Files\Ubisoft
   [19.01.2008|18:25] C:\Program Files\Uninstall Information
   [25.05.2008|12:52] C:\Program Files\Unlocker
   [22.12.2008|10:51] C:\Program Files\vghd
   [30.11.2008|16:47] C:\Program Files\VS Revo Group
   [29.11.2008|10:17] C:\Program Files\Widelands
   [12.10.2008|14:17] C:\Program Files\Windows Live
   [10.10.2008|20:36] C:\Program Files\Windows Live Toolbar
   [08.06.2008|16:45] C:\Program Files\Windows Media Connect 2
   [14.11.2008|21:55] C:\Program Files\Windows Media Player
   [12.10.2008|13:43] C:\Program Files\Windows NT
   [19.01.2008|18:17] C:\Program Files\WindowsUpdate
   [12.05.2008|19:19] C:\Program Files\WinRAR
   [19.01.2008|18:19] C:\Program Files\xerox
   [29.07.2008|16:46] C:\Program Files\Xfire
   [10.10.2008|20:35] C:\Program Files\Yahoo!
   [21.12.2008|00:43] C:\Program Files\YesMessenger

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [23.02.2008|15:33] C:\Program Files\Fichiers communs\Adobe
   [19.01.2008|22:44] C:\Program Files\Fichiers communs\Ahead
   [22.11.2008|11:43] C:\Program Files\Fichiers communs\Apple
   [05.04.2008|18:28] C:\Program Files\Fichiers communs\Designer
   [19.01.2008|22:35] C:\Program Files\Fichiers communs\InstallShield
   [09.02.2008|10:08] C:\Program Files\Fichiers communs\LogiShared
   [26.07.2008|09:32] C:\Program Files\Fichiers communs\Logishrd
   [26.07.2008|09:32] C:\Program Files\Fichiers communs\Logitech
   [05.04.2008|18:27] C:\Program Files\Fichiers communs\Microsoft Shared
   [19.01.2008|18:17] C:\Program Files\Fichiers communs\MSSoap
   [20.01.2008|02:02] C:\Program Files\Fichiers communs\ODBC
   [25.01.2008|18:43] C:\Program Files\Fichiers communs\Real
   [19.01.2008|18:17] C:\Program Files\Fichiers communs\Services
   [29.06.2008|15:30] C:\Program Files\Fichiers communs\Skype
   [20.01.2008|02:02] C:\Program Files\Fichiers communs\SpeechEngines
   [12.10.2008|13:43] C:\Program Files\Fichiers communs\System
   [03.02.2008|21:25] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [25.01.2008|18:43] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 46 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-12-22 13:28:02
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\mWHjPqru.ini
   C:\WINDOWS\system32\mWHjPqru.ini2
   C:\WINDOWS\system32\urqPjHWm.dll
   [b]==> VUNDO <==/b
 
   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FarCry2.exe
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FC2.dll


   [F:152][D:2]-> C:\DOCUME~1\ADDX\LOCALS~1\Temp
   [F:156][D:0]-> C:\DOCUME~1\ADDX\Cookies
   [F:1932][D:8]-> C:\DOCUME~1\ADDX\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 22.12.2008|12:39 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 22.12.2008|13:29 - Option : [2]

   --------------------\  Fin du rapport a 13:29:55

Utilisateur anonyme · Answer

>>> pour virer les cracks !

ADDX · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     E6850  @ 3.00GHz )
   BIOS : BIOS Date: 09/01/07 12:30:15 Ver: 08.00.12
   USER : ADDX ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1296 [VPS 081221-0] 4.8.1296 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:465 Go (Free:347 Go)
   D:\ (CD or DVD) - CDFS - Total:6 Go (Free:0 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [1] ( 22.12.2008|13:35 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.ch/?gws_rd=ssl"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\mWHjPqru.ini
   C:\WINDOWS\system32\mWHjPqru.ini2
   C:\WINDOWS\system32\urqPjHWm.dll
   [b]==> VUNDO <==/b
 
   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FarCry2.exe
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FC2.dll



   1 - "C:\ToolBar SD\TB_1.txt" - 22.12.2008|13:37 - Option : [1]

   -----------\  Fin du rapport a 13:37:19.78

ADDX · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:38:24, on 22.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Documents and Settings\ADDX\Application Data\gadcom\gadcom.exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O3 - Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [18e6b8aa] rundll32.exe "C:\WINDOWS\system32	pvutgum.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\ADDX\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: fcieav.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

Utilisateur anonyme · Answer

Ok, j'avais pas vu le rapport Toolbar SD, relances le et choisis l'option 2 nettoyage, poste le rapport stp... je prepare la suite...

ADDX · Answer

-----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 Duo CPU     E6850  @ 3.00GHz )
   BIOS : BIOS Date: 09/01/07 12:30:15 Ver: 08.00.12
   USER : ADDX ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1296 [VPS 081221-0] 4.8.1296 (Not Activated)
   A:\ (USB)
   C:\ (Local Disk) - NTFS - Total:465 Go (Free:347 Go)
   D:\ (CD or DVD) - CDFS - Total:6 Go (Free:0 Go)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 22.12.2008|14:06 )

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://www.google.ch/?gws_rd=ssl"
   "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"
   "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"


   --------------------\  Recherche d'autres infections

   C:\WINDOWS\system32\mWHjPqru.ini
   C:\WINDOWS\system32\mWHjPqru.ini2
   C:\WINDOWS\system32\urqPjHWm.dll
   [b]==> VUNDO <==/b
 
   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FarCry2.exe
   C:\DOCUME~1\ADDX\Mes documents
o_cd\crack ok\FC2.dll



   1 - "C:\ToolBar SD\TB_1.txt" - 22.12.2008|13:37 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 22.12.2008|14:09 - Option : [2]

   -----------\  Fin du rapport a 14:09:22.29

Utilisateur anonyme · Answer

Ok, on va d'abord passer par Malwarebyte et on sortira l'artillerie lourde ensuite... Telecharges Malwarebytes ici : http://www.malwarebytes.org/mbam/program/mbam-setup.exe A la fin de l'installation mbam se met automatiquement a jour, laisses le faire... ceci fait, fermes tous les programmes et redemarre ton pc en mode sans echec... (tapotes sur la touche F8 de ton clavier au demarrage du pc, jusqu'a l'apparition d'un ecran noir avec plusieurs options, choisis >> mode sans echec et valides... Lances Mbam et clique sur recherche >> analyse complete du pc a la fin du scan, cliques sur ' Afficher les Resultats ' et ensuite sur ' supprimer la selection ', mbam te demandera surement de redemarrer le pc afin de finir la desinfection >>> fais le <<< postes le rapport stp...

ADDX · Answer

deso pour le retard je devais faire les courses


Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1531
Windows 5.1.2600 Service Pack 3

22.12.2008 19:18:23
mbam-log-2008-12-22 (19-18-22).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 107525
Temps écoulé: 1 hour(s), 22 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 20
Valeur(s) du Registre infectée(s): 6
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 12

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\urqPjHWm.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\yayyWpOe.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f4da4751-41e4-4f45-8d8a-dbacdd7b5885} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{f4da4751-41e4-4f45-8d8a-dbacdd7b5885} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\yayywpoe (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\Typelib\{9233c3c0-1472-4091-a505-5580a23bb4ac} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{018b7ec3-eeca-11d3-8e71-0000e82c6c0d} (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Somefox (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SystemInit (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\18e6b8aa (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gadcom (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\xdsfass (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqpjhwm -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqpjhwm  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Documents and Settings\ADDX\Application Data\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\urqPjHWm.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mWHjPqru.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\mWHjPqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32	pvutgum.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mugtuvpt.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\ADDX\Application Data\gadcom\gadcom.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yayyWpOe.dll (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\ADDX\Application Data\Desktopicon\eBayShortcuts.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{75F4699E-002E-4A00-B8E7-949D0A73C130}\RP60\A0017209.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{75F4699E-002E-4A00-B8E7-949D0A73C130}\RP64\A0017551.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\prunnet.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hgGaxvvu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Utilisateur anonyme · Answer

Re, si le pc a bien ete redemarre lors de la suppression, supprimes la quarantaine >> ouvres Malwarebytes et cliques sur quarantaine, puis cliques sur supprimer... Ensuite supprimes ta version hijackthis et retelecharges la ici : http://www.trendsecure.com/portal/en-US/tools/Security_tools/hijackthis et renommes la en " ceketuve.exe " >>> fais un clic droitsur le fichier hijackthis.exe et choisis renommer dans la liste >> tapes " ceketuve.exe " et tu valides avec la touche entree de ton clavier... Double-cliques ensuite sur ceketuve.exe et executes le en cliquant sur " do a scan and save a logfile "... Postes ensuite le rapport....

ADDX · Answer

quelqu un peu venir continuer svp c est chiant ce virus de m....

ADDX · Answer

deso j avais pas vu que t avais posté


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:36:55, on 23.12.2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.ch/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: {ffcea180-4bbd-c1cb-4544-49801f43eab7} - {7bae34f1-0894-4454-bc1c-dbb4081aecff} - C:\WINDOWS\system32\fcieav.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: (no name) - {ecdee021-0d17-467f-a1ff-c7a115230949} - (no file)
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ASUS WiFi-AP Solo.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: fcieav.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

ADDX · Answer

----------------- FindyKill V4.710 ------------------ * User : ADDX - ADRIEN * Emplacement : C:\Program Files\FindyKill * Outils Mis a jours le 21/12/08 par Chiquitine29 * Recherche effectuée à 17:46:22 le 23.12.2008 * Windows XP - Internet Explorer 7.0.5730.13 ((((((((((((((((( *** Recherche *** )))))))))))))))))) --------------- [ Processus actifs ] ---------------- C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32 vsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32 undll32.exe C:\Program Files\Skype\Phone\Skype.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\MSN Messenger\MsnMsgr.Exe C:\Program Files\ASUS WiFi-AP Solo\RtWLan.exe C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe C:\Program Files\Logitech\SetPoint\SetPoint.exe C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32 undll32.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe --------------- [ Fichiers/Dossiers infectieux ] ---------------- »»»» Presence des fichiers dans C: »»»» Presence des fichiers dans C:\WINDOWS »»»» Presence des fichiers dans C:\WINDOWS\Prefetch Found ! - C:\WINDOWS\prefetch\9129837.EXE-391AE89C.pf »»»» Presence des fichiers dans C:\WINDOWS\system32 »»»» Presence des fichiers dans C:\WINDOWS\system32\config\systemprofile\AppData\Roaming »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers »»»» Presence des fichiers dans C:\Documents and Settings\ADDX\Application Data »»»» Presence des fichiers dans C:\DOCUME~1\ADDX\LOCALS~1\Temp »»»» Presence des fichiers dans C:\Documents and Settings\ADDX\Local Settings\Temporary Internet Files\Content.IE5 Found ! [23.03.2007 18:01] - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Album inconnu\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Large.jpg Found ! [23.03.2007 18:01] - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Album inconnu\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Small.jpg Found ! [27.01.2008 19:41] - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Violator\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Large.jpg Found ! [27.01.2008 19:41] - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Violator\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Small.jpg Found ! [29.06.2008 15:33] - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg --------------- [ Registre / Startup ] ---------------- [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion un] ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe Skype="C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background MsnMsgr="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion un] TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup NeroFilterCheck=C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe Kernel and Hardware Abstraction Layer=KHALMNPR.EXE JMB36X IDE Setup=C:\WINDOWS\RaidTool\xInsIDE.exe 36X Raid Configurer=C:\WINDOWS\system32\xRaidSetup.exe boot avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe SoundMax="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray nwiz=nwiz.exe /install IMJPMIG8.1="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit SoundMAXPnP=C:\Program Files\Analog Devices\Core\smax4pnp.exe AppleSyncNotifier=C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe" HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents= = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\IMAIL= Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MAPI= NoChange=1 Installed=1 = HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un\OptionalComponents\MSFS= Installed=1 = --------------- [ Registre / Clés infectieuses ] ---------------- Found ! - HKEY_USERS\S-1-5-21-1417001333-1390067357-725345543-1004\Software\Ubisoft --------------- [ Etat / Services ] ---------------- +- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] Ndisuio - Type de démarrage = 3 EapHost - Type de démarrage = 3 Ip6Fw - Type de démarrage = 3 /!\ SharedAccess - Type de démarrage = 4 wuauserv - Type de démarrage = 2 /!\ wscsvc - Type de démarrage = 4 --------------- [ Recherche dans supports amovibles] ---------------- +- Informations : C: - Lecteur fixe D: - Lecteur de CD-ROM +- Contenu de l'autorun : D:\autorun.inf [autorun] open=AutoRunCD.exe icon=AutoRunCD.exe, 0 +- presence des fichiers : Found ! [19.07.2007 15:53][-r-------] - D:\autorun.inf --------------- [ Registre / Mountpoint2 ] ---------------- -> Not found ! ------------------- ! Fin du rapport ! --------------------

Utilisateur anonyme · Answer

Ok. branches tes disques amovible sur ton Pc ( cles Usb, Disques dur externe...) sans les ouvrir... Double clique ensuite sur FindyKill et au menu, choisis cette fois l'option2 ( desinfection) --->> ne touches a rien pendant la suppression, jusqu'a l'apparition du message >> nettoyage effectue <<<. Appuies ensuite sur une touche pour faire apparaitre le rapport, postes le....

ADDX · Answer

----------------- FindyKill V4.710 ------------------

* User : ADDX - ADRIEN
* executed from : C:\Program Files\FindyKill
* Update on 21/12/08 par Chiquitine29
* Start at 18:22:28 the 23.12.2008
* Windows XP - Internet Explorer 7.0.5730.13
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\userinit.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
Deleted ! - C:\WINDOWS\prefetch\9129837.EXE-391AE89C.pf 
 
»»»» Supression files in C:\WINDOWS\system32 
 
 
»»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming 
 
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
 
»»»» Supression files in C:\Documents and Settings\ADDX\Application Data 
 
 
»»»» Supression files in C:\DOCUME~1\ADDX\LOCALS~1\Temp 
 
 
»»»» Supression files in C:\Documents and Settings\ADDX\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Album inconnu\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Large.jpg    
Deleted ! - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Album inconnu\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Small.jpg    
Deleted ! - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Violator\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Large.jpg    
Deleted ! - C:\Documents and Settings\ADDX\Mes documents\Music\Depeche Mode\Violator\AlbumArt_{9863CB64-AE2A-4D74-BCF0-BF8C5FE241D2}_Small.jpg    
Deleted ! - C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Local Cache\D3987B641C134048B815DB578D607F42_more.jpg    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA   
Deleted ! - HKEY_USERS\S-1-5-21-1417001333-1390067357-725345543-1004\Software\Ubisoft   
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

 Ndisuio - Type of startup  = 3 
 
 EapHost - Type of startup  = 2 
 
 Ip6Fw - Type of startup  = 2 
 
 SharedAccess - Type of startup  = 2 
 
 wuauserv - Type of startup  = 2 
 
 wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

D: - Lecteur de CD-ROM

E: - Lecteur amovible

 
+- deleting files : 
 
Not deleted !! - D:\autorun.inf  
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Documents and Settings\ADDX\Mes documents
o_cd\crack ok
C:\Documents and Settings\ADDX\Mes documents
o_cd\crack ok\FarCry2.exe
C:\Documents and Settings\ADDX\Mes documents
o_cd\crack ok\FC2.dll
 
 
---------------- ! End of report ! ------------------

Utilisateur anonyme · Answer

Re, Far Cry 2, ca ne te dis rien ? >> le Jeu <<, il faut virer tous les cracks avant de passer a la suite...

ADDX · Answer

voila effacer

Utilisateur anonyme · Answer

Ok, il va falloir faire tres attention aux instructions donnees, ce Fix est puissant.. Telecharge Combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe >>> Deconnectes toi du Net et fermes toutes les applications en cours Antivirus, Antispyware compris <<< cela pourrais gener fortement le scan... Double-cliques ensuite sur ComboFix.exe >> un pop up apparait -->> clique sur oui.. Je te conseille d'installer la console de recuperation... Choisis ensuite la langue et tapes sur la touche '' 1 '' ( Yes) pour demarrer le scan. >>> ATTENTION, ne touches a rien pendant le scan ( ni clavier, ni souris ...) >> Cela pourrait figer l'ordi... il se peut que Combofix ait besoin de redemarrer le pc, laisses faire pour finir la desinfection... une fois fini, combofix affiche un rapport, postes le ! Reactives la protection de ton pc ( antivirus, antispyware avant de te reconnecter au net )...

ADDX · Answer

ComboFix 08-12-23.01 - ADDX 2008-12-23 19:57:23.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.33.1036.18.2047.1545 [GMT 1:00] Lancé depuis: c:\documents and settings\ADDX\Mes documents\ComboFix.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\ADDX\LOCALS~1\Temp mp1.tmp c:\documents and settings\ADDX\Local Settings\Temporary Internet Files\fbk.sts c:\windows ew_drv.sys c:\windows\system32\fcieav.dll c:\windows\system32 xrvwknu.dll c:\windows\system32\wvUoPffe.dll . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NEW_DRV -------\Service_new_drv ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-23 au 2008-12-23 )))))))))))))))))))))))))))))))))))) . 2008-12-23 17:45 . 2008-12-23 18:24 d-------- c:\program files\FindyKill 2008-12-22 14:18 . 2008-12-22 14:18 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-12-22 14:18 . 2008-12-22 14:18 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2008-12-22 14:18 . 2008-12-22 14:18 d-------- c:\documents and settings\ADDX\Application Data\Malwarebytes 2008-12-22 14:18 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-22 14:18 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2008-12-22 13:33 . 2008-12-22 14:09 d-------- C:\ToolBar SD 2008-12-22 12:30 . 2008-12-22 13:29 d-------- C:\Lop SD 2008-12-22 12:06 . 2008-12-22 12:13 d-------- c:\program files\Navilog1 2008-12-22 11:39 . 2008-12-22 11:39 d-------- c:\program files\Trend Micro 2008-12-22 09:34 . 2008-12-22 09:42 3 --a------ c:\windows\sbacknt.bin 2008-12-22 09:31 . 2008-12-22 10:51 d-------- c:\program files\vghd 2008-12-22 09:31 . 2008-12-22 09:47 d-------- c:\documents and settings\ADDX\Application Data\vghd 2008-12-22 09:31 . 2008-12-22 09:31 152,904 --a------ c:\windows\system32\vghd.scr 2008-12-21 15:26 . 2008-12-21 15:26 d-------- c:\program files\TryMedia 2008-12-20 23:09 . 2008-12-20 23:09 d-------- c:\program files\MSN Messenger 2008-12-06 14:23 . 2004-11-29 18:51 d-------- C:\SAVE 2008-12-06 14:23 . 2004-11-29 18:51 d-------- C:\DATA 2008-11-30 17:21 . 2008-11-30 17:21 808 --a------ c:\windows\ssaver.ini 2008-11-30 17:21 . 2008-11-30 17:21 0 --a------ c:\windows oons.INI 2008-11-29 10:11 . 2008-11-29 10:17 d-------- c:\program files\Widelands 2008-11-28 21:07 . 2008-11-28 21:07 d-------- c:\program files\Microsoft Games 2008-11-28 20:34 . 2008-11-28 20:34 d-------- c:\program files\JoWooD . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-23 18:55 --------- d-----w c:\documents and settings\ADDX\Application Data\Skype 2008-12-23 18:53 --------- d-----w c:\documents and settings\ADDX\Application Data\skypePM 2008-12-22 18:18 --------- d-----w c:\documents and settings\ADDX\Application Data\Desktopicon 2008-11-30 15:47 --------- d-----w c:\program files\VS Revo Group 2008-11-22 14:43 --------- d-----w c:\program files\PurFlirt 2008-11-22 10:43 --------- d-----w c:\program files\iTunes 2008-11-22 10:43 --------- d-----w c:\program files\iPod 2008-11-22 10:43 --------- d-----w c:\program files\Fichiers communs\Apple 2008-11-22 10:43 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-11-22 10:42 --------- d-----w c:\program files\QuickTime 2008-11-22 10:34 --------- d-----w c:\program files\Safari 2008-11-16 07:55 136,720 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-15 15:32 --------- d-----w c:\program files\Neoact 2008-11-09 10:44 --------- d-----w c:\program files\Apple Software Update 2008-11-09 10:32 --------- d-----w c:\program files\Bonjour 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-24 07:34 22,328 ----a-w c:\documents and settings\ADDX\Application Data\PnkBstrK.sys 2008-10-24 07:30 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-24 07:30 --------- d-----w c:\program files\Ubisoft 2008-10-23 21:19 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-10-23 16:38 --------- d-----w c:\program files\free-downloads.net 2008-10-23 16:38 --------- d-----w c:\program files\Conduit 2008-10-05 14:37 98,304 ----a-w c:\windows\DUMP4ca4.tmp 2008-10-05 14:31 98,304 ----a-w c:\windows\DUMP8c71.tmp 2008-10-05 14:22 98,304 ----a-w c:\windows\DUMP8915.tmp . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-05-30 21718312] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB ealsched.exe" [2008-01-25 185896] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-05-11 8429568] "NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "JMB36X IDE Setup"="c:\windows\RaidTool\xInsIDE.exe" [2007-03-20 36864] "36X Raid Configurer"="c:\windows\system32\xRaidSetup.exe" [2007-03-21 1953792] "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000] "IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2006-03-02 208952] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-05-11 81920] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352] "AppleSyncNotifier"="c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] "nwiz"="nwiz.exe" [2007-05-11 c:\windows\system32 wiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ ASUS WiFi-AP Solo.lnk - c:\program files\ASUS WiFi-AP Solo\RtWLan.exe [2008-01-19 987136] Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-02-09 67128] Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-07-26 805392] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\LBTWlgn] 2008-05-02 01:42 72208 c:\program files\Fichiers communs\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=fcieav.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.VP40"= vp4vfw.dll "VIDC.XFR1"= xfcodec.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\beep.sys] @="beep" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup] @="" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "NBService"=3 (0x3) "LiveUpdate"=3 (0x3) "Bonjour Service"=2 (0x2) "Automatic LiveUpdate Scheduler"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion un-] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" -autorun "ctfmon.exe"=c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion un-] "NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "SoundMAX"="c:\program files\Analog Devices\SoundMAX\Smax4.exe" /tray "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "nwiz"=nwiz.exe /install "QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"= "c:\Program Files\Microsoft Games\Age of Empires II\age2_x1\AGE2_X1.ICD"= "c:\Program Files\EA Games\Command & Conquer Generals - Heure H\patchget.dat"= "c:\WINDOWS\system32\PnkBstrA.exe"= "c:\WINDOWS\system32\PnkBstrB.exe"= "c:\Program Files\EA Games\Command & Conquer Generals - Heure H\game.dat"= "c:\Program Files\THQ\Gas Powered Games\Supreme Commander\bin\SupremeCommander.exe"= "c:\Program Files\THQ\Gas Powered Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe"= "c:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe"= "c:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"= "c:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"= "c:\WINDOWS\system32\dpvsetup.exe"= "c:\WINDOWS\system32\dplaysvr.exe"= "c:\Program Files\Ubisoft\Far Cry 2\bin\FarCry2.exe"= "c:\Program Files\Ubisoft\Far Cry 2\bin\FC2Launcher.exe"= "c:\Program Files\Ubisoft\Far Cry 2\bin\FC2Editor.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Program Files\iTunes\iTunes.exe"= "c:\Program Files\Microsoft Games\Age of Empires II\age2_x1\age22_x1.exe"= "c:\Program Files\MSN Messenger\msnmsgr.exe"= "c:\Program Files\MSN Messenger\livecall.exe"= "c:\Program Files\Skype\Phone\Skype.exe"= R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-06-28 111184] R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-06-28 20560] R2 nxsIO32;NextSensor Kernel I/O Driver;\??\c:\windows\System32\DRIVERS xsIO32.sys [2008-09-07 2208] R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187.sys [2008-01-19 176128] R3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys [2008-01-19 13532] . Contenu du dossier 'Tâches planifiées' 2008-11-09 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2008-12-23 c:\windows\Tasks\Maintenance en 1 clic.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [] 2008-12-23 c:\windows\Tasks\peekbudz.job - c:\windows\system32 undll32.exe [2008-04-14 03:34] . - - - - ORPHELINS SUPPRIMES - - - - URLSearchHooks-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) BHO-{7bae34f1-0894-4454-bc1c-dbb4081aecff} - c:\windows\system32\fcieav.dll Toolbar-{ecdee021-0d17-467f-a1ff-c7a115230949} - (no file) WebBrowser-{ECDEE021-0D17-467F-A1FF-C7A115230949} - (no file) . ------- Examen supplémentaire ------- . uStart Page = hxxp://www.google.ch/ mWindow Title = uInternet Settings,ProxyOverride = *.local Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-23 19:59:51 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(664) c:\program files\fichiers communs\logitech\bluetooth\LBTWlgn.dll c:\program files\fichiers communs\logitech\bluetooth\LBTServ.dll . ------------------------ Autres processus actifs ------------------------ . c:\program files\Alwil Software\Avast4\aswUpdSv.exe c:\program files\Alwil Software\Avast4\ashServ.exe c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\system32 vsvc32.exe c:\windows\system32\PnkBstrA.exe c:\windows\system32\wscntfy.exe c:\program files\iPod\bin\iPodService.exe c:\program files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.exe c:\program files\Skype\Plugin Manager\skypePM.exe . ************************************************************************** . Heure de fin: 2008-12-23 20:02:00 - La machine a redémarré ComboFix-quarantined-files.txt 2008-12-23 19:01:57 Avant-CF: 372'638'814'208 octets libres Après-CF: 372,618,850,304 octets libres WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect 233 --- E O F --- 2008-12-20 10:00:52

Petit probleme avec"alerte de securité window

27 réponses

Votre réponse

Discussions similaires

Newsletters