Message antivirus

Bonjour,

voila depuis quelque temps maintenant quand je suis sur internet un message antivirus 2009 apparais et me fait une analyse automatique de mon pc je refuse tout le temps mais les message sont de plus en plus fréquent, que faire ??,
Configuration: Windows XP
Firefox 3.0.5

9 réponses

  1. Salut!!

    Télécharge d'abord cet outil qui va permettre de cibler l'infection:

    hijackthis

    Installe-le dans son dossier par défaut et lance-le.

    Choisis l'option "Do a system scan and save a Logfile".

    Copie/colle alors le rapport généré dans ta prochaine réponse.

    A++ ;)
    0
    1. Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 01:29:36, on 18/12/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      C:\Program Files\Bonjour\mDNSResponder.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\system32\RUNDLL32.EXE
      D:\Program Files\iTunes\iTunesHelper.exe
      C:\WINDOWS\V0350Mon.exe
      C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
      C:\Program Files\MSN Messenger\MsnMsgr.Exe
      D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
      C:\Program Files\Electronic Arts\EADM\Core.exe
      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE
      C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
      C:\Program Files\e-Carte Bleue LCL\ecbl-lcl.exe
      D:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
      D:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
      C:\Program Files\iPod\bin\iPodService.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\MSN Messenger\usnsvc.exe
      D:\Program Files\iTunes\iTunes.exe
      C:\WINDOWS\system32\0BGrsQSC.exe
      C:\WINDOWS\system32\rundll32.exe
      C:\WINDOWS\explorer.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com/?SearchSource=10&ctid=CT1750559
      R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
      R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
      O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
      O2 - BHO: solution Class - {99C6D1BB-7555-474C-91DA-D8FB62A9CC75} - C:\WINDOWS\system32\6DItuSUE.dll
      O2 - BHO: (no name) - {b1fd3000-4fa1-4769-a86b-f9caecace4a3} - C:\WINDOWS\system32\nunoloje.dll
      O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
      O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
      O3 - Toolbar: BS.Player ControlBar - {2C688203-7EB3-4327-9995-1CB417BA23F9} - C:\Program Files\BS.Player ControlBar\BSToolbar.dll
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
      O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
      O4 - HKLM\..\Run: [C:\WINDOWS\system32\V0350Cvw.dll] C:\WINDOWS\system32\RegSvr32.exe /s C:\WINDOWS\system32\V0350Cvw.dll
      O4 - HKLM\..\Run: [V0350Mon.exe] C:\WINDOWS\V0350Mon.exe
      O4 - HKLM\..\Run: [WMAAD] C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
      O4 - HKLM\..\Run: [vonevowesi] Rundll32.exe "C:\WINDOWS\system32\bebutepo.dll",s
      O4 - HKLM\..\Run: [c038777a] rundll32.exe "C:\WINDOWS\system32\suluyeba.dll",b
      O4 - HKLM\..\Run: [CPMc30b44e6] Rundll32.exe "C:\WINDOWS\system32\konovozo.dll",a
      O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
      O4 - HKCU\..\Run: [UberIcon] "D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe"
      O4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silent
      O4 - HKCU\..\Run: [EPSON Stylus DX8400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE /FU "C:\WINDOWS\system32\config\SYSTEM~1\LOCALS~1\Temp\E_S57.tmp" /EF "HKCU"
      O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
      O4 - HKUS\S-1-5-19\..\Run: [vonevowesi] Rundll32.exe "C:\WINDOWS\system32\bebutepo.dll",s (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /c md "%USERPROFILE%\Local Settings\Temp" (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [vonevowesi] Rundll32.exe "C:\WINDOWS\system32\bebutepo.dll",s (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICE RÉSEAU')
      O4 - Startup: RocketDock.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
      O4 - Startup: TransBar.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
      O4 - Startup: UberIcon.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
      O4 - Startup: Y'z Shadow.lnk = D:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
      O4 - Global Startup: e-Carte Bleue LCL.lnk = C:\Program Files\e-Carte Bleue LCL\ecbl-lcl.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O8 - Extra context menu item: Transfert par Image Converter 3 - C:\Program Files\Sony\IMAGE CONVERTER 3\menu.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
      O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
      O9 - Extra button: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: @C:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O20 - AppInit_DLLs: C:\WINDOWS\system32\mupafeve.dll c:\windows\system32\konovozo.dll
      O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\konovozo.dll
      O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\konovozo.dll
      O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
      O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
      O23 - Service: Image Converter SCSI Service (ICScsiSV) - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\ICScsiSV.exe
      O23 - Service: IcVzMonLauncher - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMonLauncher.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\IMAGE CONVERTER 3\IcVzMon.exe
      O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
      O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
      O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
      O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
      O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
      0
      1. Commence par ceci:

        Télécharge malwarebytes

        Installe-le en veillant bien à ce que la case de mise à jour soit cochée en fin d'installation.

        Lance-le et après la mise à jour, coche la case "Examen Complet".

        Lance la recherche sur tous tes disques.

        Après le scan, si le programme trouve quelque chose, clique sur "Voir les résultats" puis sur "Supprimer la sélection".

        Si MBAM te demande de rebooter pour finaliser la suppression, accepte.

        Poste ensuite le rapport généré dans ta prochaine réponse.

        A+
        0
        1. -----------\\ ToolBar S&D 1.2.8 XP/Vista

          Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
          X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
          BIOS : Default System BIOS
          USER : mutrel ( Administrator )
          BOOT : Normal boot
          C:\ (Local Disk) - NTFS - Total:146 Go (Free:40 Go)
          D:\ (Local Disk) - NTFS - Total:145 Go (Free:118 Go)
          E:\ (USB)
          F:\ (USB)
          G:\ (USB)
          H:\ (USB)
          J:\ (CD or DVD)

          "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
          Option : [1] ( 18/12/2008| 2:22 )

          -----------\\ Recherche de Fichiers / Dossiers ...

          C:\Program Files\AskSBar
          C:\Program Files\AskSBar\bar
          C:\Program Files\AskSBar\bar\1.bin
          C:\Program Files\AskSBar\bar\Cache
          C:\Program Files\AskSBar\bar\History
          C:\Program Files\AskSBar\bar\Settings
          C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
          C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
          C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
          C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
          C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
          C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
          C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
          C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
          C:\Program Files\AskSBar\bar\1.bin\V2RSSMNU.DLL
          C:\Program Files\AskSBar\bar\Cache\006B620D.bin
          C:\Program Files\AskSBar\bar\Cache\006B6401.bin
          C:\Program Files\AskSBar\bar\Cache\006B6587.bin
          C:\Program Files\AskSBar\bar\Cache\006B66C0.bin
          C:\Program Files\AskSBar\bar\Cache\006B67F8.bin
          C:\Program Files\AskSBar\bar\Cache\006B6950.bin
          C:\Program Files\AskSBar\bar\Cache\00C41EAA
          C:\Program Files\AskSBar\bar\Cache\files.ini
          C:\Program Files\AskSBar\bar\History\search2
          C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm
          C:\Program Files\DAEMON Tools Toolbar
          C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
          C:\Program Files\DAEMON Tools Toolbar\Resources
          C:\Program Files\DAEMON Tools Toolbar\uninst.exe
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome.manifest
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\install.rdf
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\chrome\dttoolbar.jar
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.dll
          C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT\components\DTToolbarFF.xpt
          C:\Program Files\DAEMON Tools Toolbar\Resources\about.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\as.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\as.png
          C:\Program Files\DAEMON Tools Toolbar\Resources\astro.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\b1.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\b1.png
          C:\Program Files\DAEMON Tools Toolbar\Resources\BurnImage.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\buy.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond000.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond001.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond003.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond004.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond005.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond006.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond007.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond008.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond009.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond010.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond011.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond019.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond020.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond021.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond022.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond023.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond024.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond025.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond026.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond037.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond038.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond039.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond040.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond041.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond046.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond048.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond050.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond051.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond052.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond053.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond054.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond055.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond056.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond057.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond058.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond059.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond060.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond061.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond062.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond063.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond064.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond065.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond066.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond067.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond068.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond069.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond075.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond076.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond077.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond078.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond079.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond080.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond084.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond085.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond086.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond087.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond088.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond089.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond090.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond091.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond092.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond093.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond094.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond095.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond108.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond109.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond110.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond111.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond112.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond113.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond120.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond121.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond122.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond126.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond127.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond128.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond129.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond130.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond131.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond132.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond133.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond134.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond135.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond136.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond137.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond138.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond140.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond141.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond142.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond143.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond148.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond149.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond152.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond154.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond155.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond156.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\cond157.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\d.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\d2.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\daemon.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\ds.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\dsearch.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\dt.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\DTPro.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\Dwnl.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\emulation.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\features.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\gd.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\globe.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\GrabImage.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\hb.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\hb.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\help.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\ip.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\lang.xml
          C:\Program Files\DAEMON Tools Toolbar\Resources\lingvo.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\m.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\mail.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mailc.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_disable.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mailc_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mail_disable.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mail_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mail_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\mail_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\next.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\next_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\next_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\next_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\none.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\none_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\noW.gif
          C:\Program Files\DAEMON Tools Toolbar\Resources\op.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\pragma.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\prev.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\prev_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\prev_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\prev_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\prod.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\refresh.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\refresh_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\Rss.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\Rss1.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\rssClose.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\rssL.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\rssOpen.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\size.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\size_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\skins.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\spt.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\SupportRequest.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\time.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\TitleIcon.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\toolbar.xml
          C:\Program Files\DAEMON Tools Toolbar\Resources\trans.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\Trash.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_disable.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\Trash_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\u.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wb.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtClose_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_down.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_m.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wBtText_under.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m42.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\Weather_m43.bmp
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi0.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi1.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi10.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi11.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi12.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi13.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi2.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi3.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi4.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi5.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi6.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi7.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi8.ico
          C:\Program Files\DAEMON Tools Toolbar\Resources\wi9.ico
          C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll

          -----------\\ Extensions

          (Administrateur) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

          (mutrel) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

          -----------\\ [..\Internet Explorer\Main]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
          "Start Page"="http://search.conduit.com/?SearchSource=10&ctid=CT1750559"
          "Search Page"="https://www.google.fr/?gws_rd=ssl"
          "Search Bar"="http://www.google.fr/toolbar/ie8/sidebar.html"
          "Local Page"="C:\\WINDOWS\\system32\\blank.htm"

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
          "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
          "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
          "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
          "Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"
          "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"

          --------------------\\ Recherche d'autres infections

          C:\WINDOWS\Tasks\At1.job
          C:\WINDOWS\Tasks\At10.job
          C:\WINDOWS\Tasks\At11.job
          C:\WINDOWS\Tasks\At12.job
          C:\WINDOWS\Tasks\At13.job
          C:\WINDOWS\Tasks\At14.job
          C:\WINDOWS\Tasks\At15.job
          C:\WINDOWS\Tasks\At16.job
          C:\WINDOWS\Tasks\At17.job
          C:\WINDOWS\Tasks\At18.job
          C:\WINDOWS\Tasks\At19.job
          C:\WINDOWS\Tasks\At2.job
          C:\WINDOWS\Tasks\At20.job
          C:\WINDOWS\Tasks\At21.job
          C:\WINDOWS\Tasks\At22.job
          C:\WINDOWS\Tasks\At23.job
          C:\WINDOWS\Tasks\At24.job
          C:\WINDOWS\Tasks\At25.job
          C:\WINDOWS\Tasks\At26.job
          C:\WINDOWS\Tasks\At27.job
          C:\WINDOWS\Tasks\At28.job
          C:\WINDOWS\Tasks\At29.job
          C:\WINDOWS\Tasks\At3.job
          C:\WINDOWS\Tasks\At30.job
          C:\WINDOWS\Tasks\At31.job
          C:\WINDOWS\Tasks\At32.job
          C:\WINDOWS\Tasks\At33.job
          C:\WINDOWS\Tasks\At34.job
          C:\WINDOWS\Tasks\At35.job
          C:\WINDOWS\Tasks\At36.job
          C:\WINDOWS\Tasks\At37.job
          C:\WINDOWS\Tasks\At38.job
          C:\WINDOWS\Tasks\At39.job
          C:\WINDOWS\Tasks\At4.job
          C:\WINDOWS\Tasks\At40.job
          C:\WINDOWS\Tasks\At41.job
          C:\WINDOWS\Tasks\At42.job
          C:\WINDOWS\Tasks\At43.job
          C:\WINDOWS\Tasks\At44.job
          C:\WINDOWS\Tasks\At45.job
          C:\WINDOWS\Tasks\At46.job
          C:\WINDOWS\Tasks\At47.job
          C:\WINDOWS\Tasks\At48.job
          C:\WINDOWS\Tasks\At5.job
          C:\WINDOWS\Tasks\At6.job
          C:\WINDOWS\Tasks\At7.job
          C:\WINDOWS\Tasks\At8.job
          C:\WINDOWS\Tasks\At9.job

          1 - "C:\ToolBar SD\TB_1.txt" - 18/12/2008| 2:23 - Option : [1]

          -----------\\ Fin du rapport a 2:23:12,09
          0
        2. -----------\\ ToolBar S&D 1.2.8 XP/Vista

          Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
          X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz )
          BIOS : Default System BIOS
          USER : mutrel ( Administrator )
          BOOT : Normal boot
          C:\ (Local Disk) - NTFS - Total:146 Go (Free:40 Go)
          D:\ (Local Disk) - NTFS - Total:145 Go (Free:118 Go)
          E:\ (USB)
          F:\ (USB)
          G:\ (USB)
          H:\ (USB)
          J:\ (CD or DVD)

          "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
          Option : [2] ( 18/12/2008| 2:43 )

          -----------\\ SUPPRESSION

          Echec ! - C:\Program Files\AskSBar\bar
          Supprime! - C:\Program Files\AskSBar\bar\1.bin
          Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
          Supprime! - C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
          Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
          Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
          Supprime! - C:\Program Files\Mozilla Firefox\plugins\NPAskSBr.dll
          Supprime! - C:\Program Files\AskSBar
          Supprime! - C:\Program Files\DAEMON Tools Toolbar

          -----------\\ Recherche de Fichiers / Dossiers ...

          -----------\\ Extensions

          (Administrateur) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar

          (mutrel) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

          -----------\\ [..\Internet Explorer\Main]

          [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
          "Start Page"="http://search.conduit.com/?SearchSource=10&ctid=CT1750559"
          "Search Page"="https://www.google.fr/?gws_rd=ssl"
          "Search Bar"="http://www.google.fr/toolbar/ie8/sidebar.html"
          "Local Page"="C:\\WINDOWS\\system32\\blank.htm"

          [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
          "Default_Page_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
          "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
          "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
          "Start Page"="https://www.msn.com/fr-fr/"
          "Search Bar"="https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm"

          --------------------\\ Recherche d'autres infections

          C:\WINDOWS\Tasks\At1.job
          C:\WINDOWS\Tasks\At10.job
          C:\WINDOWS\Tasks\At11.job
          C:\WINDOWS\Tasks\At12.job
          C:\WINDOWS\Tasks\At13.job
          C:\WINDOWS\Tasks\At14.job
          C:\WINDOWS\Tasks\At15.job
          C:\WINDOWS\Tasks\At16.job
          C:\WINDOWS\Tasks\At17.job
          C:\WINDOWS\Tasks\At18.job
          C:\WINDOWS\Tasks\At19.job
          C:\WINDOWS\Tasks\At2.job
          C:\WINDOWS\Tasks\At20.job
          C:\WINDOWS\Tasks\At21.job
          C:\WINDOWS\Tasks\At22.job
          C:\WINDOWS\Tasks\At23.job
          C:\WINDOWS\Tasks\At24.job
          C:\WINDOWS\Tasks\At25.job
          C:\WINDOWS\Tasks\At26.job
          C:\WINDOWS\Tasks\At27.job
          C:\WINDOWS\Tasks\At28.job
          C:\WINDOWS\Tasks\At29.job
          C:\WINDOWS\Tasks\At3.job
          C:\WINDOWS\Tasks\At30.job
          C:\WINDOWS\Tasks\At31.job
          C:\WINDOWS\Tasks\At32.job
          C:\WINDOWS\Tasks\At33.job
          C:\WINDOWS\Tasks\At34.job
          C:\WINDOWS\Tasks\At35.job
          C:\WINDOWS\Tasks\At36.job
          C:\WINDOWS\Tasks\At37.job
          C:\WINDOWS\Tasks\At38.job
          C:\WINDOWS\Tasks\At39.job
          C:\WINDOWS\Tasks\At4.job
          C:\WINDOWS\Tasks\At40.job
          C:\WINDOWS\Tasks\At41.job
          C:\WINDOWS\Tasks\At42.job
          C:\WINDOWS\Tasks\At43.job
          C:\WINDOWS\Tasks\At44.job
          C:\WINDOWS\Tasks\At45.job
          C:\WINDOWS\Tasks\At46.job
          C:\WINDOWS\Tasks\At47.job
          C:\WINDOWS\Tasks\At48.job
          C:\WINDOWS\Tasks\At5.job
          C:\WINDOWS\Tasks\At6.job
          C:\WINDOWS\Tasks\At7.job
          C:\WINDOWS\Tasks\At8.job
          C:\WINDOWS\Tasks\At9.job

          1 - "C:\ToolBar SD\TB_1.txt" - 18/12/2008| 2:23 - Option : [1]
          2 - "C:\ToolBar SD\TB_2.txt" - 18/12/2008| 2:43 - Option : [2]

          -----------\\ Fin du rapport a 2:43:54,32
          0
      2. Malwarebytes' Anti-Malware 1.31
        Version de la base de données: 1554
        Windows 5.1.2600 Service Pack 2

        18/12/2008 02:14:00
        mbam-log-2008-12-18 (02-14-00).txt

        Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|J:\|)
        Eléments examinés: 146611
        Temps écoulé: 35 minute(s), 55 second(s)

        Processus mémoire infecté(s): 1
        Module(s) mémoire infecté(s): 7
        Clé(s) du Registre infectée(s): 15
        Valeur(s) du Registre infectée(s): 6
        Elément(s) de données du Registre infecté(s): 5
        Dossier(s) infecté(s): 3
        Fichier(s) infecté(s): 71

        Processus mémoire infecté(s):
        C:\WINDOWS\system32\0BGrsQSC.exe (Trojan.Clicker) -> Unloaded process successfully.

        Module(s) mémoire infecté(s):
        C:\WINDOWS\system32\suluyeba.dll (Trojan.Vundo.H) -> Delete on reboot.
        C:\WINDOWS\system32\mupafeve.dll (Trojan.Vundo.H) -> Delete on reboot.
        C:\WINDOWS\system32\nunoloje.dll (Trojan.Vundo.H) -> Delete on reboot.
        C:\WINDOWS\system32\bebutepo.dll (Trojan.Vundo.H) -> Delete on reboot.
        C:\WINDOWS\system32\konovozo.dll (Trojan.Vundo.H) -> Delete on reboot.
        c:\WINDOWS\system32\bonafanu.dll (Trojan.Vundo) -> Delete on reboot.
        C:\WINDOWS\system32\6DItuSUE.dll (Trojan.Agent) -> Delete on reboot.

        Clé(s) du Registre infectée(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b1fd3000-4fa1-4769-a86b-f9caecace4a3} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{b1fd3000-4fa1-4769-a86b-f9caecace4a3} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b1fd3000-4fa1-4769-a86b-f9caecace4a3} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
        HKEY_CLASSES_ROOT\TypeLib\{00476c87-a276-49bf-86bc-ff005732430b} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\Interface\{892b2785-b0d0-4aa2-ae6a-0ed60b00a979} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\CLSID\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99c6d1bb-7555-474c-91da-d8fb62a9cc75} (Trojan.Agent) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\solution.solution (Trojan.BHO) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\solution.solution.1 (Trojan.BHO) -> Quarantined and deleted successfully.
        HKEY_CLASSES_ROOT\AppID\{e81cf86b-f683-422a-b742-3f2427ea9d6a} (Trojan.BHO) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

        Valeur(s) du Registre infectée(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c038777a (Trojan.Vundo.H) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vonevowesi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpmc30b44e6 (Trojan.Vundo.H) -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Delete on reboot.
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\c:\windows\system32\v0350cvw.dll (Trojan.Agent) -> Quarantined and deleted successfully.

        Elément(s) de données du Registre infecté(s):
        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\mupafeve.dll -> Quarantined and deleted successfully.
        HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\mupafeve.dll
        0
        1. Relance MBAM, vadans quarantaine et supprime tout.

          -------------------------------------------------------------------------

          Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.

          https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

          Lance l'installation du programme en exécutant le fichier téléchargé.
          Double-clique maintenant sur le raccourci de Toolbar-S&D.
          Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
          Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.

          Poste le rapport généré. (C:\TB.txt)
          0
          1. Re!!

            As-tu redémarré ton pc après le scan Malwarebytes? Si non, fais-le avant la suite.

            -----------------------------------

            Suite:

            Relance Toolbar S&D et exécute cette fois l'option 2. Poste le rapport généré.

            A+
            0
            1. Re!

              Répond à la suite stp, ce sera plus simple. Merci

              ----------------------

              Petit nettoyage:

              Télécharge CCleaner

              Lors de l’installation, décoche l’option qui t’installerait la barre Yahoo

              Va dans "Options">>"Avancé". Décoche la première ligne.

              Va dans la section "Nettoyeur". Lance l'analyse. La liste créée, lance le nettoyage deux fois de suite afin d'obtenir 0bytes supprimé!

              Ensuite dans "Registre", lance une recherche des erreurs. La liste créée, fais-les réparer.

              /!\ A ce moment CCleaner te demande normalement de sauvegarder le registre, fais-le. /!\


              Recommence ensuite le cycle Recherche/Réparation des erreurs jusqu'à n'en trouver aucune lors de la recherche.

              ---------------------

              Relance Malwarebytes comme tout à l'heure mais coche cette fois "Examen Rapide". Poste le rapport.

              0
              1. Malwarebytes' Anti-Malware 1.31
                Version de la base de données: 1554
                Windows 5.1.2600 Service Pack 2

                18/12/2008 08:28:22
                mbam-log-2008-12-18 (08-28-22).txt

                Type de recherche: Examen complet (C:\|D:\|E:\|F:\|G:\|H:\|J:\|)
                Eléments examinés: 139281
                Temps écoulé: 33 minute(s), 36 second(s)

                Processus mémoire infecté(s): 0
                Module(s) mémoire infecté(s): 0
                Clé(s) du Registre infectée(s): 0
                Valeur(s) du Registre infectée(s): 0
                Elément(s) de données du Registre infecté(s): 0
                Dossier(s) infecté(s): 0
                Fichier(s) infecté(s): 2

                Processus mémoire infecté(s):
                (Aucun élément nuisible détecté)

                Module(s) mémoire infecté(s):
                (Aucun élément nuisible détecté)

                Clé(s) du Registre infectée(s):
                (Aucun élément nuisible détecté)

                Valeur(s) du Registre infectée(s):
                (Aucun élément nuisible détecté)

                Elément(s) de données du Registre infecté(s):
                (Aucun élément nuisible détecté)

                Dossier(s) infecté(s):
                (Aucun élément nuisible détecté)

                Fichier(s) infecté(s):
                C:\WINDOWS\system32\0BGrsQSC.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
                C:\WINDOWS\system32\0BGrsQSC.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
                0
            2. Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :

              http://www.geekstogo.com/forum/files/file/6-smitfraudfix/

              - Enregistre-le sur le bureau

              - Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

              - Un rapport sera généré, poste-le dans ta prochaine réponse.

              /!\ process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus./!\

              A+
              0
              1. SmitFraudFix v2.387

                Rapport fait à 1:43:00,87, 19/12/2008
                Executé à partir de C:\Documents and Settings\mutrel\Bureau\SmitfraudFix
                OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
                Le type du système de fichiers est NTFS
                Fix executé en mode normal

                »»»»»»»»»»»»»»»»»»»»»»»» Process

                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                C:\Program Files\Bonjour\mDNSResponder.exe
                C:\WINDOWS\system32\nvsvc32.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\Explorer.EXE
                C:\WINDOWS\RTHDCPL.EXE
                C:\WINDOWS\system32\RUNDLL32.EXE
                D:\Program Files\iTunes\iTunesHelper.exe
                C:\WINDOWS\V0350Mon.exe
                C:\Program Files\Sony\WALKMAN Launcher\WMAAD.exe
                C:\Program Files\MSN Messenger\MsnMsgr.Exe
                D:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
                C:\Program Files\Electronic Arts\EADM\Core.exe
                C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEE.EXE
                C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
                C:\Program Files\e-Carte Bleue LCL\ecbl-lcl.exe
                D:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
                D:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\iPod\bin\iPodService.exe
                C:\Program Files\MSN Messenger\usnsvc.exe
                C:\Program Files\Internet Explorer\iexplore.exe
                C:\Documents and Settings\mutrel\Bureau\SmitfraudFix\Policies.exe
                C:\WINDOWS\system32\cmd.exe

                »»»»»»»»»»»»»»»»»»»»»»»» hosts

                »»»»»»»»»»»»»»»»»»»»»»»» C:\

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

                C:\WINDOWS\Tasks\At?.job PRESENT !
                C:\WINDOWS\Tasks\At??.job PRESENT !

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

                »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mutrel

                »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\mutrel\LOCALS~1\Temp

                »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\mutrel\Application Data

                »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

                »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\mutrel\Favoris

                »»»»»»»»»»»»»»»»»»»»»»»» Bureau

                »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

                »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

                »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                "Source"="About:Home"
                "SubscribedURL"="About:Home"
                "FriendlyName"="Ma page d'accueil"

                »»»»»»»»»»»»»»»»»»»»»»»» o4Patch
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                o4Patch
                Credits: Malware Analysis & Diagnostic
                Code: S!Ri

                »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                IEDFix
                Credits: Malware Analysis & Diagnostic
                Code: S!Ri

                »»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                Agent.OMZ.Fix
                Credits: Malware Analysis & Diagnostic
                Code: S!Ri

                »»»»»»»»»»»»»»»»»»»»»»»» VACFix
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                VACFix
                Credits: Malware Analysis & Diagnostic
                Code: S!Ri

                »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                404Fix
                Credits: Malware Analysis & Diagnostic
                Code: S!Ri

                »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                SrchSTS.exe by S!Ri
                Search SharedTaskScheduler's .dll

                »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
                "AppInit_DLLs"=""
                "LoadAppInit_DLLs"=dword:00000001

                »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
                !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
                "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
                "System"=""

                »»»»»»»»»»»»»»»»»»»»»»»» RK

                »»»»»»»»»»»»»»»»»»»»»»»» DNS

                Description: TG123g USB Wireless Adapter - Miniport d'ordonnancement de paquets
                DNS Server Search Order: 192.168.1.1

                HKLM\SYSTEM\CCS\Services\Tcpip\..\{96D9F716-86B6-4E1D-AF73-982C201ADFBA}: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS1\Services\Tcpip\..\{96D9F716-86B6-4E1D-AF73-982C201ADFBA}: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS2\Services\Tcpip\..\{96D9F716-86B6-4E1D-AF73-982C201ADFBA}: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
                HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                »»»»»»»»»»»»»»»»»»»»»»»» Fin
                0
            3. Bien!

              Redémarre en mode sans échec.

              • Redémarre ton ordinateur
              • Tout de suite après le bip de démarrage, tapote la touche F8 (une pression par seconde).
              • A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
              • Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
              • Choisis ton compte.

              /!\ Ne redémarre jamais en mode sans échec par le msconfig /!\

              Une fois dans ta session, relance smitfraudfix, option 2.

              Après être revenu en mode normal, poste le rapport généré stp.

              A+
              0