module introuvable : wfdvapjb.dll

Question

Bonjour,
j'ai un problème avec mon pc (dell I6400).
Lorsque je l'allume un message Rundll s'affiche:
"Erreur de chargement de C:\WINDOWS\system32\wfdvapjb.dll Le module spécifié est introuvable"
De plus je ne sais pas si cela a un rapport avec ce module mais lorsque j'installe un nouveau logiciel et que je le lance un message s'affiche:
".exe n'est pas une application valide de Win32"
Je ne sais pas du tout quoi faire aidez moi s'il vous plait.
Merci d'avance!

V-X · Answer

Salut,

Probablement un "BEAGLE".

Télécharges FindyKill de Chiquitine29

&#x25B6 Fais un clique droit sur le lien et choisis ( "enregistrer la cible sous ...." )( , destination le bureau .

&#x25B6 ( Note importante : si tu as le prg Elibagla sur ton PC , supprimes le ( risque de conflit entre les deux outils )(  .

&#x25B6 Entre dans le dossier " FindyKill "

&#x25B6 Double clic sur " FindyKill.bat " (et pas sur autre chose!) pour lancer l'outil .

&#x25B6 Choisis ( l'option 1(  . Puis laisses travailler ...

&#x25B6 Une fois terminé, postes le rapport FindyKill.txt qui est généré ...

( Note : le rapport est sauvegardé à la racine du disque -> C:\FindyKill.txt )

Les-risques-securitaires-du-peer-to-peer

Si un rapport ne passe pas faire une alerte à la conciergerie avec le /!\ jaune.

filly44 · Answer

ok je vais essayer.
merci!

filly44 · Answer

Voici le rapport:

----------------- FindyKill V4.710 ------------------

* User : Vincent  FOURAGE - VINCENT
* executed from : C:\Program Files\FindyKill
* Update on 21/12/08 par Chiquitine29
* Start at 13:49:22 the 23/12/2008
* Windows XP - Internet Explorer 6.0.2900.2180
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\PROGRA~1\McAfee\MSC\mcregist.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
c:\program files\mcafee\msc\mcoemmgr.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\WINDOWS 
 
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
 
»»»» Supression files in C:\WINDOWS\system32 
 
 
»»»» Supression files in C:\WINDOWS\system32\config\systemprofile\AppData\Roaming 
 
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
 
»»»» Supression files in C:\Documents and Settings\Vincent  FOURAGE\Application Data 
 
 
»»»» Supression files in C:\DOCUME~1\VINCEN~1\LOCALS~1\Temp 
 
 
»»»» Supression files in C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Temporary Internet Files\Content.IE5 
 
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_CURRENT_CONFIG\System\CurrentControlSet\Enum\ROOT\LEGACY_SROSA   
 
--------------- [ States / Restarting of services ] ---------------- 
 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

 Ndisuio - Type of startup  = 3 
 
 Ip6Fw - Type of startup  = 2 
 
 SharedAccess - Type of startup  = 2 
 
 wuauserv - Type of startup  = 2 
 
 wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
Deleted ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5ac247a7-4c31-11dc-a646-0019b986c0f2}\Shell\AutoRun\command  
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\diver\keygen.exe
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\+100VirtualDJSamples-mosconet.com.rar
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\+35VirtualDJSkins-mosconet.com.rar
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\desktop-alt.ini
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\desktop.ini
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\setup 2.6.exe
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\update_virtualdj_v3.0.exe
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\Virtual DJ 3.01 + Crack
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\Virtual DJ.lnk
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\VirtualDJ-Video-Effects-mosconet.com.rar
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\VirtualDJ2.06ACT-mosconet.com.rar
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\virtualdj301act-mosconet.com.rar
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\desktop-alt.ini
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\desktop.ini
C:\Documents and Settings\Vincent  FOURAGE\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\virtualdj.exe
 
 
---------------- ! End of report ! ------------------

filly44 · Answer

Si j'ai bien compris ce problème viendrait de mes logiciels téléchargé en peer to peer ?

Destrio5 · Answer

Salut,

Oui, Bagle s'attrape dans les cracks infectés téléchargés en P2P.

Tu es également infecté par Vundo à mon avis.

- Télécharge HijackThis v2.0.2 sur ton Bureau.

- Double-clique sur HJTInstall afin de lancer l'installation.

- Clique sur Install ensuite sur I Accept.

- Clique sur Do a system scan and save a logfile.

- Le bloc-notes s'ouvrira, fais un copier/coller de tout son contenu ici dans ton prochain message.

filly44 · Answer

voici le rapport:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:20:47, on 23/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\lxcrcoms.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafeeedirsvcedirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Lexmark Fax Solutions\fm3032.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\System32egsvr32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=3070710
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.fr/ig/dell?hl=fr&client=dell-row&channel=fr&ibd=3070710
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {085034FB-208A-435E-842A-39A0FDFCA5BC} - C:\WINDOWS\system32\qoMfdeDU.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: {d667955e-a03f-184a-ef04-5f4d9f4f8bc4} - {4cb8f4f9-d4f5-40fe-a481-f30ae559766d} - C:\WINDOWS\system32\yzokwq.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: innbanner browser enhancer - {836FCC7A-1553-BBAD-64BE-D090E5E39619} - C:\WINDOWS\system32\olkuryuwpwzorzm.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {E0DA6733-5C9A-46BC-BA1F-7F4998A173D5} - C:\WINDOWS\system32
nnlllIa.dll (file missing)
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Veoh Web Player Video Finder - {0FBB9689-D3D7-4f7a-A2E2-585B10099BFC} - C:\Program Files\Veoh Networks\VeohWebPlayer\VeohIEToolbar.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\Quickset.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [LXCRCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [%PROVIDERID%] "bin\sprtcmd.exe" /P %PROVIDERID%
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe
O4 - HKLM\..\Run: [28a155f9] rundll32.exe "C:\WINDOWS\system32\wfdvapjb.dll",b
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Base road long save] C:\Documents and Settings\All Users\Application Data\File dvd base road\Knob math.exe
O4 - HKLM\..\Run: [qbwrokbkauhnt] C:\WINDOWS\System32egsvr32.exe /s "C:\WINDOWS\system32\olkuryuwpwzorzm.dll"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BibBarb] C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\Blue Camp.exe
O4 - HKCU\..\Run: [Real Desktop] "C:\Program Files\Real Desktop\Real Desktop.exe"
O4 - HKCU\..\Run: [PMCLoader] C:\Program Files\Pinnacle\TVCenter Pro\PMCLoader.exe -checktasks
O4 - HKCU\..\Run: [VeohPlugin] "C:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: IMVU.lnk = C:\Program Files\IMVU\IMVUClient.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &Recherche AOL Toolbar - res://C:\Program Files\AOL Toolbar	oolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Vincent  FOURAGE\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,yzokwq.dll,avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: nnnlllIa - nnnlllIa.dll (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: lxcr_device -   - C:\WINDOWS\system32\lxcrcoms.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafeeedirsvcedirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

Destrio5 · Answer

Tu es infecté par Lop aussi (Pubs CiD).

---> Télécharge Lop S&D sur ton Bureau.
---> Double-clique dessus pour lancer l'installation.
---> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
---> Sélectionne la langue souhaitée, puis choisis l'option 1 (Recherche).
---> Patiente jusqu'à la fin du scan.
---> Poste le rapport généré (C:\lopR.txt).

filly44 · Answer

voici le rapport de LopSD: --------------------\ Lop S&D 4.2.5-0 XP/Vista Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2 X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M CPU 520 @ 1.60GHz ) BIOS : Phoenix ROM BIOS PLUS Version 1.10 A17 USER : Vincent FOURAGE ( Administrator ) BOOT : Normal boot Antivirus : McAfee VirusScan (Activated) Firewall : McAfee Personal Firewall (Activated) C:\ (Local Disk) - NTFS - Total:69 Go (Free:27 Go) D:\ (CD or DVD) "C:\Lop SD" ( MAJ : 19-12-2008|23:40 ) Option : [1] ( 23/12/2008|16:49 ) --------------------\ Listing des dossiers dans APPLIC~1 [24/06/2008|09:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe [11/09/2007|17:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL [24/11/2008|14:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8 [21/02/2008|15:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY [18/02/2008|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative Labs [10/07/2007|09:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink [06/09/2008|08:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Dell [28/10/2008|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink [01/09/2007|20:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FaxCtr [06/12/2008|08:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\File dvd base road [06/11/2007|23:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Gameeel [10/07/2007|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google [10/07/2007|09:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GTek [10/07/2007|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield [20/12/2008|09:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft [10/07/2007|09:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee [17/12/2008|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft [09/08/2008|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle [09/08/2008|13:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle Studio [09/09/2007|14:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime [20/08/2004|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI [09/08/2008|13:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc [03/11/2008|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Softdisk LLC [10/07/2007|09:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft [02/11/2008|20:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP [21/08/2007|17:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint [02/07/2008|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage [22/11/2008|14:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller [10/07/2007|09:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Gtek [20/08/2004|10:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities [10/07/2007|09:02] C:\DOCUME~1\DEFAUL~1\APPLIC~1\InstallShield [20/08/2004|10:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft [24/11/2008|14:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft [21/12/2008|16:09] C:\DOCUME~1\moi\APPLIC~1\AVGTOOLBAR [21/12/2008|16:09] C:\DOCUME~1\moi\APPLIC~1\FaxCtr [21/12/2008|16:10] C:\DOCUME~1\moi\APPLIC~1\Google [10/07/2007|09:10] C:\DOCUME~1\moi\APPLIC~1\Gtek [21/12/2008|16:06] C:\DOCUME~1\moi\APPLIC~1\Identities [10/07/2007|09:02] C:\DOCUME~1\moi\APPLIC~1\InstallShield [21/12/2008|16:11] C:\DOCUME~1\moi\APPLIC~1\Microsoft [24/11/2008|14:05] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft [24/06/2008|09:47] C:\DOCUME~1\VINCEN~1\APPLIC~1\Adobe [24/06/2008|09:50] C:\DOCUME~1\VINCEN~1\APPLIC~1\AdobeUM [06/03/2008|19:28] C:\DOCUME~1\VINCEN~1\APPLIC~1\Anuman Interactive [11/09/2007|17:41] C:\DOCUME~1\VINCEN~1\APPLIC~1\AOL [24/11/2008|15:03] C:\DOCUME~1\VINCEN~1\APPLIC~1\AVGTOOLBAR [12/08/2007|20:52] C:\DOCUME~1\VINCEN~1\APPLIC~1\CyberLink [06/12/2008|08:45] C:\DOCUME~1\VINCEN~1\APPLIC~1\deadmetakind [01/09/2007|09:12] C:\DOCUME~1\VINCEN~1\APPLIC~1\Decorateur de plinthes frises et corniches [02/12/2007|17:14] C:\DOCUME~1\VINCEN~1\APPLIC~1\DivX [30/08/2007|16:01] C:\DOCUME~1\VINCEN~1\APPLIC~1\EASYTools [01/09/2007|20:48] C:\DOCUME~1\VINCEN~1\APPLIC~1\FaxCtr [20/08/2007|09:50] C:\DOCUME~1\VINCEN~1\APPLIC~1\Google [10/07/2007|09:10] C:\DOCUME~1\VINCEN~1\APPLIC~1\Gtek [23/08/2007|12:33] C:\DOCUME~1\VINCEN~1\APPLIC~1\Help [20/08/2004|10:41] C:\DOCUME~1\VINCEN~1\APPLIC~1\Identities [10/07/2007|09:02] C:\DOCUME~1\VINCEN~1\APPLIC~1\InstallShield [13/08/2007|20:33] C:\DOCUME~1\VINCEN~1\APPLIC~1\Leadertech [13/11/2008|19:13] C:\DOCUME~1\VINCEN~1\APPLIC~1\Learn2.com [24/11/2008|13:49] C:\DOCUME~1\VINCEN~1\APPLIC~1\LimeWire [03/05/2008|09:40] C:\DOCUME~1\VINCEN~1\APPLIC~1\Macromedia [17/12/2008|19:32] C:\DOCUME~1\VINCEN~1\APPLIC~1\Microsoft [28/08/2008|23:15] C:\DOCUME~1\VINCEN~1\APPLIC~1\Mozilla [06/10/2008|17:31] C:\DOCUME~1\VINCEN~1\APPLIC~1\MP-Manager [28/10/2008|13:52] C:\DOCUME~1\VINCEN~1\APPLIC~1\Participatory Culture Foundation [13/08/2007|20:33] C:\DOCUME~1\VINCEN~1\APPLIC~1\Sonic [25/06/2008|13:40] C:\DOCUME~1\VINCEN~1\APPLIC~1\Sun [13/08/2007|21:15] C:\DOCUME~1\VINCEN~1\APPLIC~1\Template [22/11/2008|01:50] C:\DOCUME~1\VINCEN~1\APPLIC~1\vghd [01/09/2008|22:30] C:\DOCUME~1\VINCEN~1\APPLIC~1\Viewpoint [06/09/2008|13:54] C:\DOCUME~1\VINCEN~1\APPLIC~1\vlc [16/05/2008|14:49] C:\DOCUME~1\VINCEN~1\APPLIC~1\WinRAR [21/08/2007|17:16] C:\DOCUME~1\VINCEN~1\APPLIC~1\You've Got Pictures Screensaver --------------------\ Tâches planifiées dans C:\WINDOWS asks [23/12/2008 15:00][--ah-----] C:\WINDOWS asks\B3541DC9906F8C99.job [10/07/2007 09:04][--a------] C:\WINDOWS asks\McDefragTask.job [01/08/2008 00:00][--a------] C:\WINDOWS asks\McQcTask.job [23/12/2008 13:48][--ah-----] C:\WINDOWS asks\SA.DAT [05/08/2004 12:00][-r-h-----] C:\WINDOWS asks\desktop.ini ( B3541DC9906F8C99.job )=( c:\docume~1\vincen~1\applic~1\deadme~1\ProxyAdminByte.exe ) --------------------\ Listing des dossiers dans C:\Program Files [11/02/2008|23:38] C:\Program Files\Abbyy FineReader 6.0 Sprint [10/07/2007|09:03] C:\Program Files\Adobe [22/07/2008|20:15] C:\Program Files\Aspyr [24/11/2008|14:07] C:\Program Files\AVG [10/07/2007|09:09] C:\Program Files\BAE [10/07/2007|09:02] C:\Program Files\Broadcom [25/11/2008|21:36] C:\Program Files\Cadsoft [27/08/2008|21:59] C:\Program Files\Chameleon Clock [02/12/2007|16:56] C:\Program Files\COD V2.0 BETA [21/12/2008|15:40] C:\Program Files\ComPlus Applications [10/07/2007|09:00] C:\Program Files\CONEXANT [10/07/2007|09:03] C:\Program Files\Creative [06/12/2008|08:40] C:\Program Files\deadmetakind [10/07/2007|09:10] C:\Program Files\Dell [18/08/2007|22:31] C:\Program Files\Dell Support [10/07/2007|09:08] C:\Program Files\Dell Support Center [20/11/2008|21:55] C:\Program Files\Dictionnaire [10/07/2007|09:02] C:\Program Files\Digital Line Detect [29/05/2008|18:10] C:\Program Files\DivX [28/10/2008|11:26] C:\Program Files\DVD Shrink [01/09/2008|23:00] C:\Program Files\DVDVideoSoft [24/07/2008|21:18] C:\Program Files\EA GAMES [02/11/2008|19:54] C:\Program Files\EA SPORTS [20/12/2008|10:35] C:\Program Files\Fichiers communs [23/12/2008|14:05] C:\Program Files\FindyKill [28/10/2008|13:22] C:\Program Files\Free Audio Pack [28/10/2008|13:47] C:\Program Files\Google [19/12/2008|15:10] C:\Program Files\InstallShield Installation Information [22/12/2008|22:46] C:\Program Files\Internet Explorer [28/02/2008|11:47] C:\Program Files\Inventel [09/08/2008|16:17] C:\Program Files\iSofter [10/07/2007|08:57] C:\Program Files\Java [20/12/2008|09:32] C:\Program Files\Lavasoft [21/08/2007|17:16] C:\Program Files\Learn2.com [02/09/2007|15:09] C:\Program Files\Lexmark 2400 Series [01/09/2007|20:08] C:\Program Files\Lexmark Fax Solutions [20/12/2008|23:37] C:\Program Files\lx_cats [10/07/2007|09:11] C:\Program Files\MAKEMSI Package Documentation [10/11/2008|08:35] C:\Program Files\McAfee [10/07/2007|09:04] C:\Program Files\McAfee.com [21/08/2008|13:21] C:\Program Files\Messenger [21/02/2008|15:27] C:\Program Files\Micro Application [17/12/2008|12:39] C:\Program Files\Microsoft [20/08/2004|10:37] C:\Program Files\microsoft frontpage [18/08/2007|11:34] C:\Program Files\Microsoft Office [27/10/2008|23:27] C:\Program Files\Microsoft Silverlight [07/05/2008|17:54] C:\Program Files\Microsoft SQL Server Compact Edition [17/12/2008|12:57] C:\Program Files\Microsoft Sync Framework [18/08/2007|11:34] C:\Program Files\Microsoft Visual Studio [20/09/2008|08:33] C:\Program Files\Microsoft Works [02/05/2008|09:54] C:\Program Files\Modem Helper [20/08/2004|10:35] C:\Program Files\Movie Maker [23/12/2008|16:47] C:\Program Files\Mozilla Firefox [20/08/2004|10:34] C:\Program Files\MSN [20/08/2004|10:34] C:\Program Files\MSN Gaming Zone [05/05/2008|04:25] C:\Program Files\MSXML 4.0 [20/08/2004|10:35] C:\Program Files\NetMeeting [20/08/2004|10:34] C:\Program Files\Online Services [02/05/2008|09:56] C:\Program Files\OpenFX [10/07/2007|09:11] C:\Program Files\Orange [21/12/2008|15:41] C:\Program Files\Outlook Express [28/10/2008|13:50] C:\Program Files\Participatory Culture Foundation [13/11/2008|18:41] C:\Program Files\Pawsoft [23/08/2008|13:09] C:\Program Files\Pinnacle [16/06/2008|08:45] C:\Program Files\PowerArchiver [09/02/2008|10:24] C:\Program Files\ppModeler [21/08/2007|17:15] C:\Program Files\QuickTime [21/08/2007|17:15] C:\Program Files\Real [05/05/2008|06:33] C:\Program Files\Rockstar Games [28/02/2008|12:05] C:\Program Files\Securitoo [21/12/2008|15:41] C:\Program Files\Services en ligne [10/07/2007|09:00] C:\Program Files\Sigmatel [09/08/2008|13:35] C:\Program Files\SmartSound Software [09/02/2008|10:25] C:\Program Files\Sonic [10/07/2007|09:01] C:\Program Files\Synaptics [20/12/2008|10:50] C:\Program Files\The Cleaner Demo [23/12/2008|15:20] C:\Program Files\Trend Micro [30/08/2007|15:05] C:\Program Files\Uninstall Information [16/12/2008|00:50] C:\Program Files\Veoh Networks [21/08/2007|17:16] C:\Program Files\Viewpoint [17/12/2008|12:58] C:\Program Files\Windows Live [18/08/2008|21:50] C:\Program Files\Windows Live Favorites [17/12/2008|12:38] C:\Program Files\Windows Live SkyDrive [17/12/2008|12:58] C:\Program Files\Windows Live Toolbar [13/11/2008|19:03] C:\Program Files\Windows Media Connect 2 [21/12/2008|15:41] C:\Program Files\Windows Media Player [20/08/2004|10:34] C:\Program Files\Windows NT [21/12/2008|15:42] C:\Program Files\WindowsUpdate [09/08/2008|11:39] C:\Program Files\WinRAR [25/11/2008|21:49] C:\Program Files\xerox [11/11/2008|15:06] C:\Program Files\ZikiTranslator --------------------\ Listing des dossiers dans C:\Program Files\Fichiers communs [24/06/2008|09:53] C:\Program Files\Fichiers communs\Adobe [02/05/2008|09:54] C:\Program Files\Fichiers communs\AOL [21/08/2007|17:16] C:\Program Files\Fichiers communs\aolback [21/02/2008|15:42] C:\Program Files\Fichiers communs\BOONTY Shared [11/02/2008|23:28] C:\Program Files\Fichiers communs\Creative Labs Shared [18/08/2007|11:34] C:\Program Files\Fichiers communs\Designer [20/08/2007|13:01] C:\Program Files\Fichiers communs\DirectX [01/09/2008|23:00] C:\Program Files\Fichiers communs\DVDVideoSoft [23/07/2008|22:33] C:\Program Files\Fichiers communs\InstallShield [10/07/2007|08:57] C:\Program Files\Fichiers communs\Java [10/07/2007|09:05] C:\Program Files\Fichiers communs\McAfee [17/12/2008|12:38] C:\Program Files\Fichiers communs\Microsoft Shared [20/08/2004|10:35] C:\Program Files\Fichiers communs\MSSoap [21/08/2007|17:15] C:\Program Files\Fichiers communs\Nullsoft [29/05/2008|18:11] C:\Program Files\Fichiers communs\ODBC [21/08/2007|17:15] C:\Program Files\Fichiers communs\Real [20/08/2004|10:35] C:\Program Files\Fichiers communs\Services [10/07/2007|09:09] C:\Program Files\Fichiers communs\Sonic Shared [20/08/2004|10:30] C:\Program Files\Fichiers communs\SpeechEngines [10/07/2007|09:07] C:\Program Files\Fichiers communs\supportsoft [21/12/2008|15:41] C:\Program Files\Fichiers communs\System [10/07/2007|09:08] C:\Program Files\Fichiers communs\TiVo Shared [17/12/2008|11:41] C:\Program Files\Fichiers communs\Windows Live [07/05/2008|17:50] C:\Program Files\Fichiers communs\WindowsLiveInstaller --------------------\ Process ( 71 Processes ) iexplore.exe ~ [PID:2572] iexplore.exe ~ [PID:3324] iexplore.exe ~ [PID:3236] --------------------\ Recherche avec S_Lop C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1 C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\Blue Camp.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\bteykmhx.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\hezivtjt.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\mwyltwit.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\ProxyAdminByte.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\uoaauqyh.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\uwuewpgs.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\wwphxcid.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\zjybbhte.exe --------------------\ Recherche de Fichiers / Dossiers Lop C:\DOCUME~1\ALLUSE~1\APPLIC~1\File dvd base road C:\DOCUME~1\ALLUSE~1\APPLIC~1\File dvd base road\Knob math.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1 C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\Blue Camp.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\bteykmhx.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\hezivtjt.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\mwyltwit.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\ProxyAdminByte.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\uoaauqyh.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\uwuewpgs.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\wwphxcid.exe C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\zjybbhte.exe C:\Program Files\deadme~1 C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@advertising[1].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@bigpoint[1].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@bigpoint[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@fr.xblaster.bigpoint[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@fr.xblaster.bigpoint[3].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@banner.cotedazurpalace[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@banner.cotedazurpalace[3].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@cotedazurpalace[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@www.cotedazurpalace[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@adopt.euroclick[1].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@adopt.euroclick[3].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@pacificpoker[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@partypoker[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@32vegas[2].txt C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@banner.32vegas[2].txt C:\WINDOWS\Tasks\B3541DC9906F8C99.job --------------------\ Verification du Registre [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\FOR LIES VIEW] "DisplayName"="CiD Help" "UninstallString"="C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\Blue Camp.exe -uninstall" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BibBarb"="C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\Blue Camp.exe" "BibBarb"="C:\DOCUME~1\VINCEN~1\APPLIC~1\DEADME~1\Blue Camp.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Base road long save"="C:\Documents and Settings\All Users\Application Data\File dvd base road\Knob math.exe" --------------------\ Verification du fichier Hosts Fichier Hosts PROPRE --------------------\ Recherche de fichiers avec Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-23 16:54:50 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.dat 4107 bytes C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.exe 217088 bytes executable C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_nav.dat 312617 bytes C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_navps.dat 2401 bytes scan completed successfully hidden processes: 0 hidden files: 21 --------------------\ Recherche d'autres infections C:\WINDOWS\System32 vs2.inf C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.dat C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.exe C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_nav.dat C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_navps.dat [b]==> EGDACCESS <==/b C:\WINDOWS\system32\UDedfMoq.ini C:\WINDOWS\system32\UDedfMoq.ini2 [b]==> VUNDO <==/b --------------------\ Cracks & Keygens .. C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects C:\DOCUME~1\VINCEN~1\Mes documents\diver\keygen.exe C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\+100VirtualDJSamples-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\+35VirtualDJSkins-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1 C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\desktop-alt.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\desktop.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\setup 2.6.exe C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\update_virtualdj_v3.0.exe C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\Virtual DJ 3.01 + Crack C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\Virtual DJ.lnk C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\VirtualDJ-Video-Effects-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\VirtualDJ2.06ACT-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\virtualdj301act-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\desktop-alt.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\desktop.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\virtualdj.exe [F:4][D:3]-> C:\DOCUME~1\VINCEN~1\LOCALS~1\Temp [F:299][D:0]-> C:\DOCUME~1\VINCEN~1\Cookies [F:833][D:7]-> C:\DOCUME~1\VINCEN~1\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - 23/12/2008|16:58 - Option : [1] --------------------\ Fin du rapport a 16:58:40

Destrio5 · Answer

T'es bien infecté, dis merci à tes cracks.

---> Relance Lop S&D.
---> Choisis cette fois-ci l'option 2 (Suppression).
---> Ne ferme pas la fenêtre lors de la suppression !
---> Poste le rapport généré (C:\lopR.txt).

filly44 · Answer

voici le rapport --------------------\ Lop S&D 4.2.5-0 XP/Vista Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2 X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M CPU 520 @ 1.60GHz ) BIOS : Phoenix ROM BIOS PLUS Version 1.10 A17 USER : Vincent FOURAGE ( Administrator ) BOOT : Normal boot Antivirus : McAfee VirusScan (Activated) Firewall : McAfee Personal Firewall (Activated) C:\ (Local Disk) - NTFS - Total:69 Go (Free:28 Go) D:\ (CD or DVD) "C:\Lop SD" ( MAJ : 19-12-2008|23:40 ) Option : [2] ( 23/12/2008|17:54 ) \\\\\\\\\\\\\\\ SUPPRESSION Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\File dvd base road\Knob math.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\Blue Camp.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\bteykmhx.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\hezivtjt.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\mwyltwit.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\ProxyAdminByte.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\uoaauqyh.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\uwuewpgs.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\wwphxcid.exe Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1\zjybbhte.exe Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@advertising[1].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@bigpoint[1].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@bigpoint[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@fr.xblaster.bigpoint[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@fr.xblaster.bigpoint[3].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@banner.cotedazurpalace[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@banner.cotedazurpalace[3].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@cotedazurpalace[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@www.cotedazurpalace[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@adopt.euroclick[1].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@adopt.euroclick[3].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@pacificpoker[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@partypoker[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@32vegas[2].txt Supprime! - C:\DOCUME~1\VINCEN~1\Cookies\vincent fourage@banner.32vegas[2].txt Supprime! - C:\WINDOWS\Tasks\B3541DC9906F8C99.job Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\File dvd base road Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\deadme~1 Supprime! - C:\Program Files\deadme~1 \\\\\\\\\\\\\\\ Supprime! - C:\Program Files\Viewpoint Supprime! - C:\DOCUME~1\VINCEN~1\APPLIC~1\Viewpoint Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint \\\\\\\\\\\\\\\ --------------------\ Listing des dossiers dans APPLIC~1 [24/06/2008|09:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe [11/09/2007|17:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL [24/11/2008|14:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8 [21/02/2008|15:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY [18/02/2008|22:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative Labs [10/07/2007|09:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink [06/09/2008|08:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Dell [28/10/2008|11:26] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink [01/09/2007|20:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FaxCtr [06/11/2007|23:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Gameeel [10/07/2007|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google [10/07/2007|09:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\GTek [10/07/2007|09:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield [20/12/2008|09:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft [10/07/2007|09:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee [17/12/2008|12:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft [09/08/2008|16:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle [09/08/2008|13:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle Studio [09/09/2007|14:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime [20/08/2004|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI [09/08/2008|13:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc [03/11/2008|00:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Softdisk LLC [10/07/2007|09:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SupportSoft [02/11/2008|20:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP [02/07/2008|11:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage [22/11/2008|14:39] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller [10/07/2007|09:10] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Gtek [20/08/2004|10:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities [10/07/2007|09:02] C:\DOCUME~1\DEFAUL~1\APPLIC~1\InstallShield [20/08/2004|10:30] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft [24/11/2008|14:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft [21/12/2008|16:09] C:\DOCUME~1\moi\APPLIC~1\AVGTOOLBAR [21/12/2008|16:09] C:\DOCUME~1\moi\APPLIC~1\FaxCtr [21/12/2008|16:10] C:\DOCUME~1\moi\APPLIC~1\Google [10/07/2007|09:10] C:\DOCUME~1\moi\APPLIC~1\Gtek [21/12/2008|16:06] C:\DOCUME~1\moi\APPLIC~1\Identities [10/07/2007|09:02] C:\DOCUME~1\moi\APPLIC~1\InstallShield [21/12/2008|16:11] C:\DOCUME~1\moi\APPLIC~1\Microsoft [24/11/2008|14:05] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft [24/06/2008|09:47] C:\DOCUME~1\VINCEN~1\APPLIC~1\Adobe [24/06/2008|09:50] C:\DOCUME~1\VINCEN~1\APPLIC~1\AdobeUM [06/03/2008|19:28] C:\DOCUME~1\VINCEN~1\APPLIC~1\Anuman Interactive [11/09/2007|17:41] C:\DOCUME~1\VINCEN~1\APPLIC~1\AOL [24/11/2008|15:03] C:\DOCUME~1\VINCEN~1\APPLIC~1\AVGTOOLBAR [12/08/2007|20:52] C:\DOCUME~1\VINCEN~1\APPLIC~1\CyberLink [01/09/2007|09:12] C:\DOCUME~1\VINCEN~1\APPLIC~1\Decorateur de plinthes frises et corniches [02/12/2007|17:14] C:\DOCUME~1\VINCEN~1\APPLIC~1\DivX [30/08/2007|16:01] C:\DOCUME~1\VINCEN~1\APPLIC~1\EASYTools [01/09/2007|20:48] C:\DOCUME~1\VINCEN~1\APPLIC~1\FaxCtr [20/08/2007|09:50] C:\DOCUME~1\VINCEN~1\APPLIC~1\Google [10/07/2007|09:10] C:\DOCUME~1\VINCEN~1\APPLIC~1\Gtek [23/08/2007|12:33] C:\DOCUME~1\VINCEN~1\APPLIC~1\Help [20/08/2004|10:41] C:\DOCUME~1\VINCEN~1\APPLIC~1\Identities [10/07/2007|09:02] C:\DOCUME~1\VINCEN~1\APPLIC~1\InstallShield [13/08/2007|20:33] C:\DOCUME~1\VINCEN~1\APPLIC~1\Leadertech [13/11/2008|19:13] C:\DOCUME~1\VINCEN~1\APPLIC~1\Learn2.com [24/11/2008|13:49] C:\DOCUME~1\VINCEN~1\APPLIC~1\LimeWire [03/05/2008|09:40] C:\DOCUME~1\VINCEN~1\APPLIC~1\Macromedia [17/12/2008|19:32] C:\DOCUME~1\VINCEN~1\APPLIC~1\Microsoft [28/08/2008|23:15] C:\DOCUME~1\VINCEN~1\APPLIC~1\Mozilla [06/10/2008|17:31] C:\DOCUME~1\VINCEN~1\APPLIC~1\MP-Manager [28/10/2008|13:52] C:\DOCUME~1\VINCEN~1\APPLIC~1\Participatory Culture Foundation [13/08/2007|20:33] C:\DOCUME~1\VINCEN~1\APPLIC~1\Sonic [25/06/2008|13:40] C:\DOCUME~1\VINCEN~1\APPLIC~1\Sun [13/08/2007|21:15] C:\DOCUME~1\VINCEN~1\APPLIC~1\Template [22/11/2008|01:50] C:\DOCUME~1\VINCEN~1\APPLIC~1\vghd [06/09/2008|13:54] C:\DOCUME~1\VINCEN~1\APPLIC~1\vlc [16/05/2008|14:49] C:\DOCUME~1\VINCEN~1\APPLIC~1\WinRAR [21/08/2007|17:16] C:\DOCUME~1\VINCEN~1\APPLIC~1\You've Got Pictures Screensaver --------------------\ Tâches planifiées dans C:\WINDOWS asks [10/07/2007 09:04][--a------] C:\WINDOWS asks\McDefragTask.job [01/08/2008 00:00][--a------] C:\WINDOWS asks\McQcTask.job [23/12/2008 13:48][--ah-----] C:\WINDOWS asks\SA.DAT [05/08/2004 12:00][-r-h-----] C:\WINDOWS asks\desktop.ini --------------------\ Listing des dossiers dans C:\Program Files [11/02/2008|23:38] C:\Program Files\Abbyy FineReader 6.0 Sprint [10/07/2007|09:03] C:\Program Files\Adobe [22/07/2008|20:15] C:\Program Files\Aspyr [24/11/2008|14:07] C:\Program Files\AVG [10/07/2007|09:09] C:\Program Files\BAE [10/07/2007|09:02] C:\Program Files\Broadcom [25/11/2008|21:36] C:\Program Files\Cadsoft [27/08/2008|21:59] C:\Program Files\Chameleon Clock [02/12/2007|16:56] C:\Program Files\COD V2.0 BETA [21/12/2008|15:40] C:\Program Files\ComPlus Applications [10/07/2007|09:00] C:\Program Files\CONEXANT [10/07/2007|09:03] C:\Program Files\Creative [10/07/2007|09:10] C:\Program Files\Dell [18/08/2007|22:31] C:\Program Files\Dell Support [10/07/2007|09:08] C:\Program Files\Dell Support Center [20/11/2008|21:55] C:\Program Files\Dictionnaire [10/07/2007|09:02] C:\Program Files\Digital Line Detect [29/05/2008|18:10] C:\Program Files\DivX [28/10/2008|11:26] C:\Program Files\DVD Shrink [01/09/2008|23:00] C:\Program Files\DVDVideoSoft [24/07/2008|21:18] C:\Program Files\EA GAMES [02/11/2008|19:54] C:\Program Files\EA SPORTS [20/12/2008|10:35] C:\Program Files\Fichiers communs [23/12/2008|14:05] C:\Program Files\FindyKill [28/10/2008|13:22] C:\Program Files\Free Audio Pack [28/10/2008|13:47] C:\Program Files\Google [19/12/2008|15:10] C:\Program Files\InstallShield Installation Information [22/12/2008|22:46] C:\Program Files\Internet Explorer [28/02/2008|11:47] C:\Program Files\Inventel [09/08/2008|16:17] C:\Program Files\iSofter [10/07/2007|08:57] C:\Program Files\Java [20/12/2008|09:32] C:\Program Files\Lavasoft [21/08/2007|17:16] C:\Program Files\Learn2.com [02/09/2007|15:09] C:\Program Files\Lexmark 2400 Series [01/09/2007|20:08] C:\Program Files\Lexmark Fax Solutions [20/12/2008|23:37] C:\Program Files\lx_cats [10/07/2007|09:11] C:\Program Files\MAKEMSI Package Documentation [10/11/2008|08:35] C:\Program Files\McAfee [10/07/2007|09:04] C:\Program Files\McAfee.com [21/08/2008|13:21] C:\Program Files\Messenger [21/02/2008|15:27] C:\Program Files\Micro Application [17/12/2008|12:39] C:\Program Files\Microsoft [20/08/2004|10:37] C:\Program Files\microsoft frontpage [18/08/2007|11:34] C:\Program Files\Microsoft Office [27/10/2008|23:27] C:\Program Files\Microsoft Silverlight [07/05/2008|17:54] C:\Program Files\Microsoft SQL Server Compact Edition [17/12/2008|12:57] C:\Program Files\Microsoft Sync Framework [18/08/2007|11:34] C:\Program Files\Microsoft Visual Studio [20/09/2008|08:33] C:\Program Files\Microsoft Works [02/05/2008|09:54] C:\Program Files\Modem Helper [20/08/2004|10:35] C:\Program Files\Movie Maker [23/12/2008|17:52] C:\Program Files\Mozilla Firefox [20/08/2004|10:34] C:\Program Files\MSN [20/08/2004|10:34] C:\Program Files\MSN Gaming Zone [05/05/2008|04:25] C:\Program Files\MSXML 4.0 [20/08/2004|10:35] C:\Program Files\NetMeeting [20/08/2004|10:34] C:\Program Files\Online Services [02/05/2008|09:56] C:\Program Files\OpenFX [10/07/2007|09:11] C:\Program Files\Orange [21/12/2008|15:41] C:\Program Files\Outlook Express [28/10/2008|13:50] C:\Program Files\Participatory Culture Foundation [13/11/2008|18:41] C:\Program Files\Pawsoft [23/08/2008|13:09] C:\Program Files\Pinnacle [16/06/2008|08:45] C:\Program Files\PowerArchiver [09/02/2008|10:24] C:\Program Files\ppModeler [21/08/2007|17:15] C:\Program Files\QuickTime [21/08/2007|17:15] C:\Program Files\Real [05/05/2008|06:33] C:\Program Files\Rockstar Games [28/02/2008|12:05] C:\Program Files\Securitoo [21/12/2008|15:41] C:\Program Files\Services en ligne [10/07/2007|09:00] C:\Program Files\Sigmatel [09/08/2008|13:35] C:\Program Files\SmartSound Software [09/02/2008|10:25] C:\Program Files\Sonic [10/07/2007|09:01] C:\Program Files\Synaptics [20/12/2008|10:50] C:\Program Files\The Cleaner Demo [23/12/2008|15:20] C:\Program Files\Trend Micro [30/08/2007|15:05] C:\Program Files\Uninstall Information [16/12/2008|00:50] C:\Program Files\Veoh Networks [17/12/2008|12:58] C:\Program Files\Windows Live [18/08/2008|21:50] C:\Program Files\Windows Live Favorites [17/12/2008|12:38] C:\Program Files\Windows Live SkyDrive [17/12/2008|12:58] C:\Program Files\Windows Live Toolbar [13/11/2008|19:03] C:\Program Files\Windows Media Connect 2 [21/12/2008|15:41] C:\Program Files\Windows Media Player [20/08/2004|10:34] C:\Program Files\Windows NT [21/12/2008|15:42] C:\Program Files\WindowsUpdate [09/08/2008|11:39] C:\Program Files\WinRAR [25/11/2008|21:49] C:\Program Files\xerox [11/11/2008|15:06] C:\Program Files\ZikiTranslator --------------------\ Listing des dossiers dans C:\Program Files\Fichiers communs [24/06/2008|09:53] C:\Program Files\Fichiers communs\Adobe [02/05/2008|09:54] C:\Program Files\Fichiers communs\AOL [21/08/2007|17:16] C:\Program Files\Fichiers communs\aolback [21/02/2008|15:42] C:\Program Files\Fichiers communs\BOONTY Shared [11/02/2008|23:28] C:\Program Files\Fichiers communs\Creative Labs Shared [18/08/2007|11:34] C:\Program Files\Fichiers communs\Designer [20/08/2007|13:01] C:\Program Files\Fichiers communs\DirectX [01/09/2008|23:00] C:\Program Files\Fichiers communs\DVDVideoSoft [23/07/2008|22:33] C:\Program Files\Fichiers communs\InstallShield [10/07/2007|08:57] C:\Program Files\Fichiers communs\Java [10/07/2007|09:05] C:\Program Files\Fichiers communs\McAfee [17/12/2008|12:38] C:\Program Files\Fichiers communs\Microsoft Shared [20/08/2004|10:35] C:\Program Files\Fichiers communs\MSSoap [21/08/2007|17:15] C:\Program Files\Fichiers communs\Nullsoft [29/05/2008|18:11] C:\Program Files\Fichiers communs\ODBC [21/08/2007|17:15] C:\Program Files\Fichiers communs\Real [20/08/2004|10:35] C:\Program Files\Fichiers communs\Services [10/07/2007|09:09] C:\Program Files\Fichiers communs\Sonic Shared [20/08/2004|10:30] C:\Program Files\Fichiers communs\SpeechEngines [10/07/2007|09:07] C:\Program Files\Fichiers communs\supportsoft [21/12/2008|15:41] C:\Program Files\Fichiers communs\System [10/07/2007|09:08] C:\Program Files\Fichiers communs\TiVo Shared [17/12/2008|11:41] C:\Program Files\Fichiers communs\Windows Live [07/05/2008|17:50] C:\Program Files\Fichiers communs\WindowsLiveInstaller --------------------\ Process ( 66 Processes ) ... OK ! --------------------\ Recherche avec S_Lop Aucun fichier / dossier Lop trouvé ! --------------------\ Recherche de Fichiers / Dossiers Lop Aucun fichier / dossier Lop trouvé ! --------------------\ Verification du Registre ..... OK ! --------------------\ Verification du fichier Hosts Fichier Hosts PROPRE --------------------\ Recherche de fichiers avec Catchme catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-23 17:56:53 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden files ... C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.dat 4107 bytes C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.exe 217088 bytes executable C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_nav.dat 312617 bytes C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_navps.dat 2401 bytes scan completed successfully hidden processes: 0 hidden files: 21 --------------------\ Recherche d'autres infections C:\WINDOWS\System32 vs2.inf C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.dat C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi.exe C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_nav.dat C:\DOCUME~1\VINCEN~1\LOCALS~1\APPLIC~1\iqioysi_navps.dat [b]==> EGDACCESS <==/b C:\WINDOWS\system32\UDedfMoq.ini C:\WINDOWS\system32\UDedfMoq.ini2 [b]==> VUNDO <==/b --------------------\ Cracks & Keygens .. C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects C:\DOCUME~1\VINCEN~1\Mes documents\diver\keygen.exe C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\+100VirtualDJSamples-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\+35VirtualDJSkins-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1 C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\desktop-alt.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\desktop.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\setup 2.6.exe C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\update_virtualdj_v3.0.exe C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\Virtual DJ 3.01 + Crack C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\Virtual DJ.lnk C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\VirtualDJ-Video-Effects-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\VirtualDJ2.06ACT-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\virtualdj301act-mosconet.com.rar C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\desktop-alt.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\desktop.ini C:\DOCUME~1\VINCEN~1\Mes documents\Virtual DJ 3.01 + Crack, Skins, Effects\crack to 3.1\virtualdj.exe [F:4][D:3]-> C:\DOCUME~1\VINCEN~1\LOCALS~1\Temp [F:284][D:0]-> C:\DOCUME~1\VINCEN~1\Cookies [F:871][D:7]-> C:\DOCUME~1\VINCEN~1\LOCALS~1\TEMPOR~1\content.IE5 1 - "C:\Lop SD\LopR_1.txt" - 23/12/2008|16:58 - Option : [1] 2 - "C:\Lop SD\LopR_2.txt" - 23/12/2008|17:58 - Option : [2] --------------------\ Fin du rapport a 17:58:27

Destrio5 · Answer

- Télécharge Navilog1 (de IL-MAFIOSO) et enregistre-le sur le bureau : 
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 

- Double-clique sur Navilog1.exe afin de lancer l'installation

- Si le fix ne se lance pas automatiquement après son installation, double-clique sur Navilog1 présent sur le bureau

- Appuie sur F ou f  puis valide par Entrée

- Appuie sur une touche de ton clavier à chaque fois que cela est demandé, tu arriveras au menu des options

- Choisis l'option 1 et appuie sur la touche Entrée pour valider ton choix

- Patiente jusqu'au message : *** Analyse terminée le ..... ***

- Le scan fini, le bloc-notes contenant le rapport sera affiché, poste le contenu de ce rapport dans ta prochaine réponse

- Si le résultat du scan ne s'affiche pas, tu le trouveras dans C:\fixnavi.txt

N'utilise pas l'option 2, 3 et 4 sans notre accord, des fichiers légitimes peuvent être inclus dans ce scan.

filly44 · Answer

voici le rapport
Search Navipromo version 3.7.0 commencé le 23/12/2008 à 18:39:31,28

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M CPU        520  @ 1.60GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A17
USER : Vincent  FOURAGE ( Administrator )
BOOT : Normal boot

Antivirus : McAfee VirusScan  (Activated)
Firewall  : McAfee Personal Firewall  (Activated)

C:\ (Local Disk) - NTFS - Total:69 Go (Free:28 Go)
D:\ (CD or DVD)


Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Vincent  FOURAGE\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\moi\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Vincent  FOURAGE\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\moi\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Vincent  FOURAGE\menudm~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\moi\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Fichier(s) caché(s) :

C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi.dat
C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi.exe
C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi_nav.dat
C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi_navps.dat


*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Vincent  FOURAGE\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\moi\locals~1\applic~1" * 



*** Recherche fichiers *** 


C:\WINDOWS\system32
vs2.inf trouvé !

*** Recherche clés spécifiques dans le Registre ***
!! Les clés trouvées ne sont pas forcément infectées !!

HKEY_CURRENT_USER\Software\Lanconfig trouvé ! 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"iqioysi"="\"c:\documents and settings\vincent  fourage\local settings\application data\iqioysi.exe\" iqioysi"


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Vincent  FOURAGE\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\moi\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup trouvé !
Certificat Electronic-Group trouvé !
Certificat Montorgueil absent !
Certificat OOO-Favorit trouvé !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche autres dossiers et fichiers connus :

C:\WINDOWS\system32\UDedfMoq.ini2 trouvé ! Infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 23/12/2008 à 18:46:56,84 ***

Destrio5 · Answer

---> Relance Navilog1, fais l'option 2 et poste le rapport.

filly44 · Answer

voici le rapport
Clean Navipromo version 3.7.0 commencé le 24/12/2008 à  0:01:37,76

Outil exécuté depuis C:\Program Files
avilog1

Mise à jour le 10.12.2008 à 21h00 par IL-MAFIOSO

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : Intel(R) Celeron(R) M CPU        520  @ 1.60GHz )
BIOS : Phoenix ROM BIOS PLUS Version 1.10 A17
USER : Vincent  FOURAGE ( Administrator )
BOOT : Normal boot

Antivirus : McAfee VirusScan  (Activated)
Firewall  : McAfee Personal Firewall  (Activated)

C:\ (Local Disk) - NTFS - Total:69 Go (Free:28 Go)
D:\ (CD or DVD)


Mode suppression automatique 
avec prise en charge résultats Catchme et GNS


Nettoyage exécuté au redémarrage de l'ordinateur

*** Creation backups fichiers trouvés par Catchme *** 

Copie vers "C:\Program Files
avilog1\Backupnavi"

Copie C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi.dat réalisée avec succès ! 
Copie C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi.exe réalisée avec succès ! 
Copie C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi_nav.dat réalisée avec succès ! 
Copie C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi_navps.dat réalisée avec succès ! 

*** Suppression des fichiers trouvés avec Catchme ***

C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi.dat supprimé ! 
C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi.exe supprimé ! 
C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi_nav.dat supprimé ! 
C:\Documents and Settings\Vincent  FOURAGE\Local Settings\Application Data\iqioysi_navps.dat supprimé ! 
 
** 2ème passage avec résultats Catchme ** 

* Dans "C:\WINDOWS\system32" *


C:\WINDOWS\prefetch\iqioysi*.pf trouvé ! 
Copie C:\WINDOWS\prefetch\iqioysi*.pf réalisée avec succès !
C:\WINDOWS\prefetch\iqioysi*.pf supprimé !


* Dans "C:\Documents and Settings\Vincent  FOURAGE\locals~1\applic~1" * 



*** Suppression avec sauvegardes résultats GenericNaviSearch ***

* Suppression dans "C:\WINDOWS\System32" *


* Suppression dans "C:\Documents and Settings\Vincent  FOURAGE\locals~1\applic~1" * 


* Suppression dans "C:\DOCUME~1\moi\locals~1\applic~1" * 


*** Suppression dossiers dans "C:\WINDOWS" ***


*** Suppression dossiers dans "C:\Program Files" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Suppression dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Suppression dossiers dans "C:\Documents and Settings\Vincent  FOURAGE\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\moi\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Vincent  FOURAGE\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\moi\locals~1\applic~1" *** 


*** Suppression dossiers dans "C:\Documents and Settings\Vincent  FOURAGE\menudm~1\progra~1" *** 


*** Suppression dossiers dans "C:\DOCUME~1\moi\menudm~1\progra~1" *** 



*** Suppression fichiers ***

C:\WINDOWS\system32
vs2.inf supprimé !

*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINDOWS\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Vincent  FOURAGE\locals~1\Temp effectué !

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Suppression avec sauvegardes nouveaux fichiers Instant Access :

2)Recherche, création sauvegardes et suppression Heuristique :


* Dans "C:\WINDOWS\system32" *



* Dans "C:\Documents and Settings\Vincent  FOURAGE\locals~1\applic~1" * 



* Dans "C:\DOCUME~1\moi\locals~1\applic~1" * 



*** Sauvegarde du Registre vers dossier Safebackup ***

sauvegarde du Registre réalisée avec succès !

*** Nettoyage Registre ***

Nettoyage Registre Ok


*** Certificats ***

Certificat Egroup supprimé !
Certificat Electronic-Group supprimé !
Certificat Montorgueil absent !
Certificat OOO-Favorit supprimé !
Certificat Sunny-Day-Design-Ltdt absent !

*** Recherche autres dossiers et fichiers connus ***

C:\WINDOWS\system32\UDedfMoq.ini2 trouvé ! Infection Vundo possible non traitée par cet outil !


*** Nettoyage terminé le 24/12/2008 à  0:06:35,12 ***

Destrio5 · Answer

On s'est occupé de Bagle, de Lop, de Navipromo, on passe maintenant à Vundo.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Je te conseille vivement d'installer la Console de récupération.

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\Combofix.txt

Tutoriel officiel : 
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

filly44 · Answer

voici le rapport combofix: ComboFix 08-12-23.01 - Vincent FOURAGE 2008-12-24 8:30:15.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1014.542 [GMT 1:00] Lancé depuis: c:\documents and settings\Vincent FOURAGE\Bureau\ComboFix.exe * Un nouveau point de restauration a été créé * Resident AV is active . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c: emp\1cb c: emp\1cb\syscheck.log c: emp\FT62 c: emp\FT62 eTU.log c:\windows\Fonts\' c:\windows\Fonts\a.zip c:\windows\system32\dPI02 c:\windows\system32\EV02 c:\windows\system32\olkuryuwpwzorzm.dll c:\windows\system32\pac.txt c:\windows\system32\UDedfMoq.ini c:\windows\system32\UDedfMoq.ini2 . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_BOONTY_GAMES -------\Service_Boonty Games ((((((((((((((((((((((((((((( Fichiers créés du 2008-11-24 au 2008-12-24 )))))))))))))))))))))))))))))))))))) . 2008-12-23 18:38 . 2008-12-24 00:06 d-------- c:\program files\Navilog1 2008-12-23 16:48 . 2008-12-23 17:58 d----c--- C:\Lop SD 2008-12-23 15:20 . 2008-12-23 15:20 d-------- c:\program files\Trend Micro 2008-12-23 13:41 . 2008-12-23 14:05 d-------- c:\program files\FindyKill 2008-12-21 22:37 . 2008-06-14 18:59 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys 2008-12-21 22:26 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-12-21 22:22 . 2008-08-14 14:39 2,188,032 -----c--- c:\windows\system32\dllcache toskrnl.exe 2008-12-21 22:22 . 2008-08-14 14:39 2,144,768 -----c--- c:\windows\system32\dllcache tkrnlmp.exe 2008-12-21 22:22 . 2008-08-14 14:39 2,065,024 -----c--- c:\windows\system32\dllcache tkrnlpa.exe 2008-12-21 22:22 . 2008-08-14 14:39 2,022,912 -----c--- c:\windows\system32\dllcache tkrpamp.exe 2008-12-21 16:13 . 2008-12-21 16:13 d-------- c:\windows\dell 2008-12-21 16:09 . 2008-12-21 16:09 d-------- c:\documents and settings\moi\Application Data\FaxCtr 2008-12-21 16:09 . 2008-12-21 16:09 d-------- c:\documents and settings\moi\Application Data\AVGTOOLBAR 2008-12-21 16:04 . 2004-08-20 10:30 d--h----- c:\documents and settings\moi\Voisinage r‚seau 2008-12-21 16:04 . 2004-08-20 10:30 d--h----- c:\documents and settings\moi\Voisinage d'impression 2008-12-21 16:04 . 2008-12-21 15:26 d--h----- c:\documents and settings\moi\ModŠles 2008-12-21 16:04 . 2008-12-21 16:07 dr------- c:\documents and settings\moi\Mes documents 2008-12-21 16:04 . 2004-08-20 10:30 dr------- c:\documents and settings\moi\Menu D‚marrer 2008-12-21 16:04 . 2008-12-21 16:07 dr------- c:\documents and settings\moi\Favoris 2008-12-21 16:04 . 2008-12-21 15:39 d-------- c:\documents and settings\moi\Bureau 2008-12-21 16:04 . 2007-07-10 09:02 d-------- c:\documents and settings\moi\Application Data\InstallShield 2008-12-21 16:04 . 2007-07-10 09:10 d--h----- c:\documents and settings\moi\Application Data\Gtek 2008-12-21 16:04 . 2008-12-21 16:15 d-------- c:\documents and settings\moi 2008-12-21 15:59 . 2005-12-13 16:45 147,456 --a------ c:\windows\system32\igfxres.dll 2008-12-21 15:47 . 2004-08-05 11:00 1,875,968 --a--c--- c:\windows\system32\dllcache\msir3jp.lex 2008-12-21 15:46 . 2004-08-05 11:00 13,463,552 --a--c--- c:\windows\system32\dllcache\hwxjpn.dll 2008-12-21 15:45 . 2004-08-05 11:00 1,677,824 --a--c--- c:\windows\system32\dllcache\chsbrkr.dll 2008-12-21 15:44 . 2004-05-13 00:39 876,653 --a--c--- c:\windows\system32\dllcache\fp4awel.dll 2008-12-21 15:42 . 2008-12-21 15:42 749 -rah----- c:\windows\WindowsShell.Manifest 2008-12-21 15:42 . 2008-12-21 15:42 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest 2008-12-21 15:42 . 2008-12-21 15:42 749 -rah----- c:\windows\system32\sapi.cpl.manifest 2008-12-21 15:42 . 2008-12-21 15:42 749 -rah----- c:\windows\system32 cpa.cpl.manifest 2008-12-21 15:42 . 2008-12-21 15:42 488 -rah----- c:\windows\system32\logonui.exe.manifest 2008-12-21 15:41 . 2008-12-21 15:41 d-------- c:\program files\Services en ligne 2008-12-21 15:41 . 2004-08-05 11:00 16,384 --a--c--- c:\windows\system32\dllcache\isignup.exe 2008-12-21 15:27 . 2004-08-05 11:00 24,661 --a------ c:\windows\system32\spxcoins.dll 2008-12-21 15:27 . 2004-08-05 11:00 24,661 --a--c--- c:\windows\system32\dllcache\spxcoins.dll 2008-12-21 15:27 . 2004-08-05 11:00 13,312 --a------ c:\windows\system32\irclass.dll 2008-12-21 15:27 . 2004-08-05 11:00 13,312 --a--c--- c:\windows\system32\dllcache\irclass.dll 2008-12-20 10:42 . 2008-12-20 10:42 5,376 --a------ c:\windows\system32\drivers\MS1000.sys 2008-12-20 10:41 . 2008-12-20 10:50 d-------- c:\program files\The Cleaner Demo 2008-12-20 09:32 . 2008-12-20 09:32 d-------- c:\program files\Lavasoft 2008-12-20 09:32 . 2008-12-20 09:34 d-------- c:\documents and settings\All Users\Application Data\Lavasoft 2008-12-17 13:17 . 2008-12-23 14:10 d-------- c:\documents and settings\Vincent FOURAGE\Tracing 2008-12-17 12:57 . 2008-12-17 12:57 d-------- c:\program files\Microsoft Sync Framework 2008-12-17 12:39 . 2008-12-17 12:39 d-------- c:\program files\Microsoft 2008-12-17 12:38 . 2008-12-17 12:38 d-------- c:\program files\Windows Live SkyDrive 2008-12-17 11:41 . 2008-12-17 11:41 d-------- c:\program files\Fichiers communs\Windows Live 2008-12-16 00:50 . 2008-12-16 00:50 d-------- c:\program files\Veoh Networks 2008-12-11 23:40 . 2008-12-11 23:40 268 --ah-c--- C:\sqmdata16.sqm 2008-12-11 23:40 . 2008-12-11 23:40 244 --ah-c--- C:\sqmnoopt16.sqm 2008-12-09 23:26 . 2008-12-09 23:26 268 --ah-c--- C:\sqmdata15.sqm 2008-12-09 23:26 . 2008-12-09 23:26 244 --ah-c--- C:\sqmnoopt15.sqm 2008-12-08 00:28 . 2008-12-08 00:28 268 --ah-c--- C:\sqmdata14.sqm 2008-12-08 00:28 . 2008-12-08 00:28 244 --ah-c--- C:\sqmnoopt14.sqm 2008-12-02 22:37 . 2008-12-02 22:37 49,480 --a------ c:\windows\system32\sirenacm.dll 2008-11-24 14:12 . 2008-11-30 00:43 d--h-c--- C:\$AVG8.VAULT$ 2008-11-24 14:07 . 2008-12-23 16:49 d-------- c:\windows\system32\drivers\Avg 2008-11-24 14:07 . 2008-11-24 14:07 d-------- c:\program files\AVG 2008-11-24 14:07 . 2008-11-24 15:03 d-------- c:\documents and settings\Vincent FOURAGE\Application Data\AVGTOOLBAR 2008-11-24 14:07 . 2008-11-24 14:07 d-------- c:\documents and settings\All Users\Application Data\avg8 2008-11-24 14:07 . 2008-11-24 14:07 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys 2008-11-24 14:07 . 2008-11-24 14:07 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys 2008-11-24 14:07 . 2008-11-24 14:07 10,520 --a------ c:\windows\system32\avgrsstx.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-12-20 22:37 --------- d-----w c:\program files\lx_cats 2008-12-19 14:10 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-17 11:58 --------- d-----w c:\program files\Windows Live Toolbar 2008-12-17 11:58 --------- d-----w c:\program files\Windows Live 2008-11-25 20:36 --------- d-----w c:\program files\Cadsoft 2008-11-24 12:49 --------- d-----w c:\documents and settings\Vincent FOURAGE\Application Data\LimeWire 2008-11-22 13:39 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-11-22 00:50 --------- d-----w c:\documents and settings\Vincent FOURAGE\Application Data\vghd 2008-11-20 20:55 --------- d-----w c:\program files\Dictionnaire 2008-11-15 19:46 668 ----a-w c:\documents and settings\Vincent FOURAGE\Application Data\wklnhst.dat 2008-11-13 18:13 --------- d-----w c:\documents and settings\Vincent FOURAGE\Application Data\Learn2.com 2008-11-13 18:03 --------- d-----w c:\program files\Windows Media Connect 2 2008-11-13 17:41 --------- d-----w c:\program files\Pawsoft 2008-11-11 14:06 --------- d-----w c:\program files\ZikiTranslator 2008-11-10 07:35 --------- d-----w c:\program files\McAfee 2008-11-02 23:42 --------- d-----w c:\documents and settings\All Users\Application Data\Softdisk LLC 2008-11-02 23:38 78,336 ----a-w c:\windows\pysoft_uninstaller.exe 2008-11-02 19:37 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP 2008-11-02 18:54 --------- d-----w c:\program files\EA SPORTS 2008-10-29 10:02 21,504 ----a-w c:\windows\system32\drivers\sdtr.sys 2008-10-28 12:52 --------- d-----w c:\documents and settings\Vincent FOURAGE\Application Data\Participatory Culture Foundation 2008-10-28 12:50 --------- d-----w c:\program files\Participatory Culture Foundation 2008-10-28 12:47 --------- d-----w c:\program files\Google 2008-10-28 12:22 --------- d-----w c:\program files\Free Audio Pack 2008-10-28 10:26 --------- d-----w c:\program files\DVD Shrink 2008-10-28 10:26 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink 2008-10-27 22:27 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-18 13:16 68 ----a-w c:\documents and settings\Vincent FOURAGE\z.bat 2008-02-06 21:36 42,096 ----a-w c:\documents and settings\Vincent FOURAGE\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-05-17 68856] "PMCLoader"="c:\program files\Pinnacle\TVCenter Pro\PMCLoader.exe" [2007-07-26 105544] "VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2008-11-03 3522296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 36975] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947] "Dell QuickSet"="c:\program files\Dell\QuickSet\Quickset.exe" [2007-02-20 1191936] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-10-31 1392640] "CTSVolFE.exe"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344] "MskAgentexe"="c:\program files\McAfee\MSK\MskAgent.exe" [2007-01-17 152144] "dla"="c:\windows\system32\dla fswctrl.exe" [2004-12-06 127035] "Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-07-10 1862144] "PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-05-02 184320] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-08-21 98304] "FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2006-12-11 295856] "LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2006-11-21 106496] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "PinnacleDriverCheck"="c:\windows\system32\PSDrvCheck.exe" [2004-03-11 406016] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-28 1261336] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360] "DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.MJPG"= Pvmjpg30.dll "VIDC.PIM1"= pclepim1.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Dell\MediaDirect\PCMService.exe"= "c:\WINDOWS\system32\lxcrcoms.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe"= "c:\Program Files\EA GAMES\MOHAADemo\MOHAADemo.exe"= "c:\Program Files\Pinnacle\Studio 10\programs\RM.exe"= "c:\Program Files\Pinnacle\Studio 10\programs\Studio.exe"= "c:\Program Files\Pinnacle\Studio 10\programs\PMSRegisterFile.exe"= "c:\Program Files\Pinnacle\Studio 10\programs\umi.exe"= "c:\Program Files\AVG\AVG8\avgemc.exe"= "c:\Program Files\AVG\AVG8\avgupd.exe"= "c:\Program Files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe"= "c:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "57252:TCP"= 57252:TCP:Pando P2P TCP Listening Port "57252:UDP"= 57252:UDP:Pando P2P UDP Listening Port R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-11-24 97928] R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-11-24 875288] R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-11-24 231704] R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-11-24 76040] R2 SeaPort;SeaPort;"c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe" [2008-12-04 226640] S1 sdtr;sdtr;c:\windows\system32\drivers\sdtr.sys [2008-10-29 21504] S3 ewdmaudn;ewdmaudn;\??\c:\docume~1\VINCEN~1\LOCALS~1\Temp\ewdmaudn.sys [] S3 Ltn_stk7070P;PCTV based TV tuner device;c:\windows\system32\DRIVERS\Ltn_stk7070P.sys [2007-11-19 466048] S3 Ltn_stkrc;PCTV Infrared Receiver;c:\windows\system32\DRIVERS\Ltn_stkrc.sys [2007-11-19 13440] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e58c675-704a-11dd-a846-0019b986c0f2}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe nar.vbs . Contenu du dossier 'Tâches planifiées' 2007-07-10 c:\windows\Tasks\McDefragTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] 2008-07-31 c:\windows\Tasks\McQcTask.job - c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 12:32] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{085034FB-208A-435E-842A-39A0FDFCA5BC} - c:\windows\system32\qoMfdeDU.dll BHO-{4cb8f4f9-d4f5-40fe-a481-f30ae559766d} - c:\windows\system32\yzokwq.dll BHO-{836FCC7A-1553-BBAD-64BE-D090E5E39619} - c:\windows\system32\olkuryuwpwzorzm.dll BHO-{E0DA6733-5C9A-46BC-BA1F-7F4998A173D5} - c:\windows\system32 nnlllIa.dll HKCU-Run-Real Desktop - c:\program files\Real Desktop\Real Desktop.exe HKCU-Run-PMCRemote - (no file) HKLM-Run-ISUSPM Startup - c:\progra~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe HKLM-Run-ISUSScheduler - c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe HKLM-Run-%PROVIDERID% - bin\sprtcmd.exe HKLM-Run-28a155f9 - c:\windows\system32\wfdvapjb.dll ShellExecuteHooks-{E0DA6733-5C9A-46BC-BA1F-7F4998A173D5} - c:\windows\system32 nnlllIa.dll Notify-nnnlllIa - nnnlllIa.dll . ------- Examen supplémentaire ------- . uSearch Page = hxxp://www.google.com uSearch Bar = hxxp://www.google.com/ie mDefault_Search_URL = hxxp://www.google.com/ie uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s mSearchAssistant = hxxp://www.google.com/ie IE: &Recherche AOL Toolbar - c:\program files\AOL Toolbar oolbar.dll/SEARCH.HTML IE: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000 IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Vincent FOURAGE\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Vincent FOURAGE\Menu Démarrer\Programmes\IMVU\Run IMVU.lnk - FF - ProfilePath - c:\documents and settings\Vincent FOURAGE\Application Data\Mozilla\Firefox\Profiles\xdit6quq.default\ FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157 FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?mkt=fr-FR&FORM=MIMWA2&q= FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll FF - plugin: c:\program files\Microsoft Silverlight\2.0.31005.0 pctrl.dll FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer pWebPlayerVideoPluginATL.dll [color=red]ATTENTION: FIREFOX POLICES IS IN FORCE /color FF - user.js: dom.disable_open_during_load - false // Popupblocker control handled by McAfee Privacy Service . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-12-24 08:39:04 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16??????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . c:\program files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe c:\windows\system32\lxcrcoms.exe c:\program files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\program files\Fichiers communs\McAfee\MNA\McNASvc.exe c:\progra~1\McAfee\VIRUSS~1\mcods.exe c:\progra~1\FICHIE~1\McAfee\McProxy\McProxy.exe c:\progra~1\FICHIE~1\McAfee\RedirSvc\RedirSvc.exe c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe c:\program files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe c:\program files\McAfee\MPF\MpfSrv.exe c:\progra~1\McAfee\MPS\mps.exe c:\program files\McAfee\MSK\msksrver.exe c:\program files\Dell Support Center\bin\sprtsvc.exe c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\BCMWLTRY.EXE c:\windows\system32\fxssvc.exe c:\progra~1\McAfee\MPS\mpsevh.exe c:\progra~1\McAfee.com\Agent\mcagent.exe c:\progra~1\McAfee\MSC\mcregist.exe c:\program files\AVG\AVG8\avgrsx.exe c:\progra~1\McAfee\MSC\mcuimgr.exe c:\windows\system32\igfxsrvc.exe c:\program files\Digital Line Detect\DLG.exe . ************************************************************************** . Heure de fin: 2008-12-24 8:44:16 - La machine a redémarré ComboFix-quarantined-files.txt 2008-12-24 07:44:11 Avant-CF: 32ÿ800ÿ399ÿ360 octets libres AprÞs-CF: 33,407,713,280 octets libres WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect 303 --- E O F --- 2008-12-22 21:49:33

LOVG · Answer

On s'est occupé de Bagle, de Lop, de Navipromo, on passe maintenant à Vundo

ou ?

filly44 · Answer

C'est le logiciel VundoFix 6.5.4?

LOVG · Answer

VUNDOFIX est dépassé .. par les evenement et surement pas a jours

des bisous et bonnes fetes

Destrio5 · Answer

--> Télécharge UsbFix (de Chiquitine29) sur ton Bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

--> Double-clique sur le raccourci UsbFix sur ton Bureau.

--> Choisis l'option 1 (Nettoyage).

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)

LOVG · Answer

pourquoi usbfix ,?

Destrio5 · Answer

"[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e58c675-704a-11dd-a846-0019b986c0f2}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe"

Module introuvable : wfdvapjb.dll

22 réponses

Votre réponse

Discussions similaires

Newsletters