Fenêtres publicitaires intempestives

Question

Bonjour,

J'ai en ce moment toutes les 15 secondes quand je suis sur internet des fenêtres publicitaires qui s'ouvrent alors que mon anti pop-up est en blocage maximal. J'ai essayé de nettoyer mon ordinateur des logiciels inutiles et j'ai utilisé spybot, mais ça continue.
Est-ce que quelqu'un saurait m'aider ?
Merci beaucoup.

geoffrey5 · Answer

Bonjour,

&#x25B6; Télécharge hijackthis

&#x25B6; Tout est expliqué sur mon site web pour l'installer et l'utiliser correctement.

&#x25B6; Poste le rapport obtenu dans le bloc note dans ta prochaine réponse.


Comment copier/coller le rapport :


&#x25B6; Quand tu as le rapport à l écran, tu fais ctrl A pour "sélectionner tout" puis ctrl C pour "copier".

&#x25B6; ensuite tu viens sur le forum pour me répondre et tu fais ctrl V pour "coller" le rapport.

Namyar123. · Answer

merci pour la rapidité de ta réponse.
Voilà le rapport : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:26:17, on 24/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\RssBandit\RSSBandit.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: {12ca52ce-1dce-2729-85c4-46c26b73a47c} - {c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - C:\WINDOWS\system32\ullxdb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [key2] C:\WINDOWS\system32\winlog.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O20 - AppInit_DLLs: ullxdb.dll
O20 - Winlogon Notify: pmnlKBTl - pmnlKBTl.dll (file missing)
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe (file missing)
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

Commence par faire ceci stp :

&#x25B6; Telecharge FindyKill sur ton bureau :

&#x25B6; Lance l installation avec les parametres par default

&#x25B6; Double clic sur le raccourci FindyKill sur ton bureau

&#x25B6; Au menu principal,choisi l option 1 (Recherche)

&#x25B6; Post le rapport FindyKill.txt

 * Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

Namyar123. · Answer

Voilà le rapport :

###################### [ FindyKill V4.714 ]

# User : F‚lix POMMIER - FLIX
# Emplacement : C:\Program Files\FindyKill
# Outils Mis a jours le 19/01/09 par Chiquitine29
# Recherche effectuée à 10:36:34 le 24/01/2009
# Windows XP - Internet Explorer 7.0.5700.7

# [ FindyKill V4.714 - Scan ] ##############

\\\\\\\\\\\\\\\\\\\\ [ Processus actifs ] ///////////////////

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\RssBandit\RSSBandit.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe

\\\\\\\\\\\\\\\\\\ [ Fichiers/Dossiers infectieux ] ///////////////////

################## [ C:\ ]

################## [ C:\WINDOWS ]

################## [ C:\WINDOWS\Prefetch ]

################## [ C:\WINDOWS\system32 ]

################## [ C:\WINDOWS\system32\drivers ]

################## [ C:\Documents and Settings\F‚lix POMMIER\Application Data ]

################## [ C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp ]

\\\\\\\\\\\\\\\\\\ [ Registre / Startup ] ///////////////////

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
MSMSGS="C:\Program Files\Messenger\msmsgs.exe" /background
Ub4TrayApp="C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
msnmsgr="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
DAEMON Tools="C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
Wallpaper="C:\Program Files\Wallpaper\Wallpaper.exe" Starter
ctfmon.exe=C:\WINDOWS\system32\ctfmon.exe
SpybotSD TeaTimer=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
Windows update loader=C:\Windows\xpupdate.exe
SetDefaultMIDI=MIDIDef.exe
Creative Detector="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater=
<NO NAME>=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run]
mcagent_exe="C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
UVS10 Preload=C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
avgnt="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
SunJavaUpdateSched=C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
Adobe Reader Speed Launcher="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
AdobeCS4ServiceManager="C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
VSOCheckTask="c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
VoiceCenter="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
VirusScan Online=c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
UpdReg=C:\WINDOWS\UpdReg.EXE
SigmatelSysTrayApp=stsystra.exe
RealTray=C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
MPFExe=C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
MCUpdateExe=C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
MCAgentExe=c:\PROGRA~1\mcafee.com\agent\mcagent.exe
MBMon=Rundll32 CTMBHA.DLL,MBMon
key2=C:\WINDOWS\system32\winlog.exe
ISUSScheduler="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
ISUSPM Startup="c:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
ehTray=C:\WINDOWS\ehome\ehtray.exe
DVDLauncher="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
dla=C:\WINDOWS\system32\dla\tfswctrl.exe
CTSysVol=C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
Corel Photo Downloader=C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
ATIPTA="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
anti_troj=C:\WINDOWS\system32\anti_troj.exe
iTunesHelper="C:\Program Files\iTunes\iTunesHelper.exe"
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents=
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL=
Installed=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI=
Installed=1
NoChange=1
<NO NAME>=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS=
Installed=1
<NO NAME>=

[HKEY_CURRENT_USER\software\local appwizard-generated applications\AOM]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\InstallerApp]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\Integrator]

\\\\\\\\\\\\\\\\\\ [ Registre / Clés infectieuses ] ///////////////////

Found ! - HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Ubisoft

\\\\\\\\\\\\\\\\\\ [ Etat / Services ] ///////////////////

# Services : [ Auto=2 / Demande=3 / Désactivé=4 ]

Ndisuio - # Type de démarrage = 3

EapHost - # Type de démarrage = 3

Ip6Fw - # Type de démarrage = 3

SharedAccess - # Type de démarrage = 2

/!\ wuauserv - # Type de démarrage = 4

wscsvc - # Type de démarrage = 2

\\\\\\\\\\\\\\\\\\ [ Recherche dans supports amovibles] ///////////////////

# Informations :

C: - Lecteur fixe

D: - Lecteur fixe

# Contenu de l'autorun : C:\autorun.inf

# Contenu de l'autorun : D:\autorun.inf

# presence des fichiers :

Found ! [05/01/2009 21:32][d--h-c---] - C:\autorun.inf
Found ! [05/01/2009 21:32][d--h-c---] - D:\autorun.inf

\\\\\\\\\\\\\\\\\\ [ Registre / Mountpoint2 ] ///////////////////

-> Not found !

################## [ ! Fin du rapport # FindyKill V4.714 ! ]

geoffrey5 · Answer

&#x25B6; Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir


&#x25B6; Double clic sur le raccourci FindyKill sur ton bureau

&#x25B6; Au menu principal,choisi l option 2 (Suppression)


/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "nettoyage effectué"

/!\ Ne te sert pas du pc durant la suppression , ton bureau ne sera pas accessible c est normal !

&#x25B6; ensuite post le rapport FindyKill.txt

 * Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
 * Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides 


A lire :

le danger des cracks

bagle/beagle

Namyar123. · Answer

Je ne savais pas pour le danger des cracks, merci pour le lien.

Voilà le rapport Findykill :



###################### [ FindyKill V4.714 ]

# User : F‚lix POMMIER - FLIX
# Executed from : C:\Program Files\FindyKill
# Update on 19/01/09 by Chiquitine29
# Start at 10:56:24 the 24/01/2009
# Windows XP - Internet Explorer 7.0.5700.7
 
# [ FindyKill V4.714 - Deleting ] ############### 
 
\\\\\\\\\  [ Active Processes ]  ///////////////////  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\logonui.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SYSTEM32\Userinit.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
\\\\\\\\\  [ Infected Files / Folders ]  ///////////////////  
 
 
################## [ C:\ ] 
 
 
################## [ C:\WINDOWS ] 
 
 
################## [ C:\WINDOWS\Prefetch ] 
 
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-086F0B56.pf 
 
################## [ C:\WINDOWS\system32 ] 
 
 
################## [ C:\WINDOWS\system32\drivers ] 
 
 
################## [ C:\Documents and Settings\F‚lix POMMIER\Application Data ] 
 
Deleted ! - "C:\Documents and Settings\F‚lix POMMIER\Application Data\inst.exe"  
 
################## [ C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp ] 
 
 
################## [ C:\Documents and Settings\F‚lix POMMIER\Local Settings\Temporary Internet Files\Content.IE5 ] 
 
 
\\\\\\\\\  [  Registry / Infected keys ]  ///////////////////  
 
Deleted ! - HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Ubisoft   
 
\\\\\\\\\  [ States / Restarting of services ]  ///////////////////  
 

# Services : [ Auto=2 / Request=3 / Disable=4 ] 

Ndisuio - # Type of startup  = 3 
 
EapHost - # Type of startup  = 2 
 
Ip6Fw - # Type of startup  = 2 
 
SharedAccess - # Type of startup  = 2 
 
wuauserv - # Type of startup  = 2 
 
wscsvc - # Type of startup  = 2 
 
 
\\\\\\\\\  [ Cleaning Removable drives ]  ///////////////////  
 
# Informations : 

C: - Lecteur fixe

D: - Lecteur fixe

L: - Lecteur amovible

 
# deleting files : 
 
Not deleted !! - C:\autorun.inf  
Not deleted !! - D:\autorun.inf  
Not deleted !! - L:\autorun.inf  
 
\\\\\\\\\  [ Registry / Mountpoint2 ]  ///////////////////  
 
 
 -> Not found ! 
 
 
\\\\\\\\\  [ Searching Other Infections ]  ///////////////////  
 
 
\\\\\\\\\  [ Searching Cracks / Keygen ]  ///////////////////  
 
C:\Documents and Settings\F‚lix POMMIER\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic
C:\Documents and Settings\F‚lix POMMIER\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno
C:\Documents and Settings\F‚lix POMMIER\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\crazy hoover.mp3
C:\Documents and Settings\F‚lix POMMIER\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\hard dream eram 008.mp3
C:\Documents and Settings\F‚lix POMMIER\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\painkiller.mp3
C:\Documents and Settings\F‚lix POMMIER\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno	anulinka vendelinka.mp3
 
################## [ ! End of report # FindyKill V4.714 ! ]

geoffrey5 · Answer

Ok maintenant fais ce qui suit dans l'ordre stp : ▶ Télécharge RAV Antivirus (d'Evosla) ▶ Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX ▶ Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau ▶ Doucle-clique sur >> RAV.exe << afin de lancer l'outil. ▶ Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles) ▶ Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain . ▶ Retire tes disques amovibles et redémarrez votre ordinateur. ▶ Poste le rapport, si infection! ensuite : ▶ Télécharge l'outil Flash_Disinfector de sUBs et enregistre le sur ton bureau ▶Double clique sur Flash_Disinfector.exe pour l'exécuter. ▶Quand le message : [Plug in yours flash drive & clic Ok to begin disinfection] apparaitra : Connecte au pc, clé USB, DD externes, susceptibles d'avoir été infectés. ▶Puis clic sur Ok ▶Les icônes sur le bureau vont disparaître jusqu'à l'apparition du message: [Done!!] ▶Appuie ensuite sur OK, pour faire réapparaître le bureau. ensuite : Option 1 - Recherche : ▶ télécharge smitfraudfix et enregistre le sur le bureau ▶ Ensuite double clique sur smitfraudfix puis exécuter ▶ Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection. (attention : N utilises pas l option 2 si je ne te l ai pas demandé !!) ▶ copier/coller le rapport dans la réponse. Voici un tutoriel sonore et animé en cas de problème d'utilisation (Attention : "process.exe", un composant de l'outil, est détecté par certains antivirus comme étant un "RiskTool". Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité.)

Namyar123. · Answer

ça a été plus compliqué que prévu, mais j'ai tout fait. 
Voilà le rapport smitfraudix :

SmitFraudFix v2.391

Rapport fait à 13:22:09,18, 24/01/2009
Executé à partir de C:\Documents and Settings\F‚lix POMMIER\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Félix POMMIER\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

Fichier hosts corrompu !

127.0.0.1	www.legal-at-spybot.info
127.0.0.1	legal-at-spybot.info
127.0.0.1	www.spywareinfo.com
127.0.0.1	spywareinfo.com

»»»»»»»»»»»»»»»»»»»»»»»» C:\

C:\autorun.inf PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\F‚lix POMMIER


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\F‚lix POMMIER\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\FLIXPO~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="ullxdb.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\SYSTEM32\Userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/100 VE Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 212.27.53.252
DNS Server Search Order: 212.27.54.252

HKLM\SYSTEM\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

geoffrey5 · Answer

Ok maintenant :

Option 2 - Nettoyage :


&#x25B6; redémarre le PC en mode sans échec

&#x25B6; Double cliquer sur smitfraudfix

&#x25B6; Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

&#x25B6; A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

&#x25B6; Enregistre le rapport sur ton bureau


&#x25B6; Redémarrer en mode normal et poster le rapport.

Namyar123. · Answer

Je n'arrive pas à avoir smitfraudfix en mode sans échec. J'ai essayé de le mettre sur le bureau et dans le menu démarrer, mais il n'apparait pas en mode sans échec.
Comment est-ce que je peux faire ?

geoffrey5 · Answer

Est-ce que tu es en session administrateur ??

Namyar123. · Answer

C'est bon, j'allais effectivement sur la mauvaise session.
Voilà le rapport : 

SmitFraudFix v2.391

Rapport fait à 15:19:34,71, 24/01/2009
Executé à partir de C:\Documents and Settings\F‚lix POMMIER\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
...

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

Problème suppression C:\autorun.inf

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Agent.OMZ.Fix

Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS1\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS2\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252
HKLM\SYSTEM\CS3\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer=212.27.53.252,212.27.54.252


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

geoffrey5 · Answer

&#x25B6; Télécharge Combofix de sUBs 


&#x25B6; et enregistre le sur le Bureau. 

  
&#x25B6; désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix


&#x25B6; Je te conseille d'installer la console de récupération !!
 

ensuite envois le rapport et refais un nouveau rapport hijackthis stp

Namyar123. · Answer

Voilà le rapport combofix :

ComboFix 09-01-21.04 - Félix POMMIER 2009-01-24 16:15:47.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1554 [GMT 1:00]
Lancé depuis: c:\documents and settings\Félix POMMIER\Bureau\ComboFix.exe
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated)
* Un nouveau point de restauration a été créé
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\pack.epk
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\htipxyod.dll
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\kgqqrkiu.ini
c:\windows\system32\maxd641.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\oeteahnr.ini
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\ullxdb.dll
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe
c:\windows\Tasks\bmvzfyod.job

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_OREANS32
-------\Service_oreans32

((((((((((((((((((((((((((((( Fichiers créés du 2008-12-24 au 2009-01-24 ))))))))))))))))))))))))))))))))))))
.

2009-01-24 10:36 . 2009-01-24 11:12 <REP> d-------- c:\program files\FindyKill
2009-01-24 10:04 . 2009-01-24 10:04 <REP> d-------- c:\documents and settings\Félix POMMIER\Application Data\Bull
2009-01-24 10:03 . 2009-01-24 10:24 <REP> d-------- c:\program files\RSS Xpress
2009-01-23 20:58 . 2009-01-23 20:58 <REP> d----c--- c:\documents and settings\All Users\Application Data\Apple
2009-01-23 20:58 . 2009-01-23 20:58 <REP> d----c--- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-22 22:47 . 2009-01-23 20:58 <REP> d-------- c:\program files\iTunes
2009-01-22 22:46 . 2009-01-23 20:58 <REP> d-------- c:\program files\Bonjour
2009-01-22 22:03 . 2009-01-23 20:58 <REP> d-------- c:\program files\Apple Software Update
2009-01-20 19:01 . 2009-01-20 19:01 <REP> d----c--- c:\documents and settings\All Users\Application Data\Electronic Arts
2009-01-20 18:20 . 2009-01-20 18:20 <REP> d-------- c:\windows\system32\AGEIA
2009-01-20 18:20 . 2009-01-20 18:20 <REP> d-------- c:\program files\AGEIA Technologies
2009-01-18 17:56 . 2008-04-13 20:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-01-18 17:56 . 2008-04-13 20:47 25,856 --a------ c:\windows\system32\dllcache\usbprint.sys
2009-01-18 17:55 . 2009-01-18 17:55 <REP> d--h-c--- C:\BJPrinter
2009-01-18 17:55 . 2004-06-15 06:00 116,736 --a------ c:\windows\system32\CNMLM61.DLL
2009-01-18 17:55 . 2004-06-04 16:34 86,016 -ra------ c:\windows\system32\CNMCP61.exe
2009-01-18 17:55 . 2004-06-15 06:00 7,680 --a------ c:\windows\system32\CNMVS61.DLL
2009-01-18 17:53 . 2009-01-18 17:57 <REP> d-------- c:\program files\Canon
2009-01-14 18:45 . 2005-11-25 21:57 905,216 --a------ c:\windows\system32\VSFilter.dll
2009-01-12 20:29 . 2009-01-12 20:29 <REP> d----c--- c:\documents and settings\All Users\Application Data\ALM
2009-01-12 20:19 . 2009-01-12 20:19 <REP> d-------- c:\program files\Adobe Media Player
2009-01-12 20:14 . 2009-01-12 20:14 <REP> d-------- c:\program files\Fichiers communs\Adobe AIR
2009-01-08 23:06 . 2009-01-08 23:06 <REP> d-------- c:\program files\NOS
2009-01-08 23:06 . 2009-01-08 23:06 <REP> d----c--- c:\documents and settings\All Users\Application Data\NOS
2009-01-07 19:48 . 2009-01-07 19:47 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-07 19:48 . 2009-01-07 19:47 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-01-06 23:40 . 2009-01-06 23:40 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-06 23:40 . 2009-01-04 18:39 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-06 23:40 . 2009-01-04 18:39 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-06 23:21 . 2009-01-06 23:21 <REP> d-------- c:\program files\CCleaner
2009-01-06 23:09 . 2009-01-06 23:09 <REP> d----c--- c:\documents and settings\All Users\Application Data\Martau
2009-01-06 23:08 . 2009-01-08 21:28 <REP> d-------- c:\program files\Total Uninstall 5
2009-01-06 18:47 . 2009-01-06 18:47 <REP> d-------- c:\program files\Avira
2009-01-06 18:47 . 2009-01-06 18:47 <REP> d----c--- c:\documents and settings\All Users\Application Data\Avira
2009-01-05 21:42 . 2009-01-05 21:42 <REP> d-------- c:\documents and settings\Félix POMMIER\Application Data\Malwarebytes
2009-01-05 21:42 . 2009-01-05 21:42 <REP> d----c--- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-05 21:39 . 2009-01-05 21:39 <REP> d-------- c:\program files\Trend Micro
2009-01-05 20:34 . 2009-01-06 18:38 <REP> d-------- c:\program files\UsbFix
2009-01-05 16:18 . 2009-01-05 16:18 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx
2009-01-05 16:18 . 2009-01-05 16:18 57,344 --a------ c:\windows\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-24 14:58 --------- d-----w c:\program files\Alwil Software
2009-01-24 14:09 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\RssBandit
2009-01-24 09:32 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-23 19:58 --------- d-----w c:\program files\QuickTime
2009-01-23 19:58 --------- d-----w c:\program files\Fichiers communs\Apple
2009-01-23 19:57 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-23 19:56 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\uTorrent
2009-01-22 21:47 --------- d-----w c:\program files\iPod
2009-01-22 18:26 --------- d-----w c:\program files\FlashGet
2009-01-22 18:26 --------- d-----w c:\program files\FileZilla
2009-01-22 18:26 --------- d-----w c:\program files\Dactylo
2009-01-22 18:26 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Vso
2009-01-22 17:58 --------- dc----w c:\documents and settings\All Users\Application Data\Ulead Systems
2009-01-22 17:58 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-22 17:58 --------- d-----w c:\program files\Ulead Systems
2009-01-22 17:58 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Ulead Systems
2009-01-22 17:56 --------- d-----w c:\program files\Fichiers communs\Ulead Systems
2009-01-22 17:46 --------- d-----w c:\program files\Creative
2009-01-22 17:42 --------- d-----w c:\program files\Fichiers communs\AVSMedia
2009-01-20 17:20 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard
2009-01-12 19:24 --------- d-----w c:\program files\Fichiers communs\Adobe
2009-01-12 06:32 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Download Manager
2009-01-11 13:36 --------- d-----w c:\program files\RssBandit
2009-01-08 20:38 --------- d--h--w c:\program files\Creative Installation Information
2009-01-08 20:37 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Creative
2009-01-07 18:54 --------- d-----w c:\program files\Java
2009-01-06 17:40 --------- d-----w c:\program files\DivX
2009-01-06 17:40 --------- d-----w c:\program files\Audible
2009-01-06 17:12 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-12-19 06:29 --------- d-----w c:\program files\Microsoft Silverlight
2008-12-19 06:18 --------- d-----w c:\program files\Fichiers communs\Creative
2008-12-14 21:07 --------- d-----w c:\program files\pspvideo9
2008-12-14 21:05 --------- d-----w c:\program files\WinAVI MP4 Converter
2008-12-12 06:45 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-12-04 10:53 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\McAfee
2008-12-04 10:18 --------- d-----w c:\program files\Final Fantasy VII
2008-12-04 09:46 --------- d-----w c:\program files\Fichiers communs\McAfee
2008-12-04 09:45 --------- d-----w c:\program files\McAfee.com
2008-12-03 21:25 --------- dc----w c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-11-27 08:47 --------- d-----w c:\program files\Picasa2
2007-08-01 19:46 47,360 ----a-w c:\documents and settings\Félix POMMIER\Application Data\pcouffin.sys
2007-08-01 17:04 54 ----a-w c:\program files\inc1.bat
2007-08-01 17:04 41 ----a-w c:\program files\sleep.bat
2006-08-02 17:41 680 ----a-w c:\program files\mpc2.reg
2006-08-02 17:41 596 ----a-w c:\program files\mpc1.reg
2006-08-02 17:41 5,352 ----a-w c:\program files\mpc7.reg
2006-08-02 17:41 4,868 ----a-w c:\program files\mpc4.reg
2006-08-02 17:41 4,482 ----a-w c:\program files\satsukidecodersettings.ini
2006-08-02 17:41 30,302 ----a-w c:\program files\ffdsvsetts.reg
2006-08-02 17:41 3,072 ----a-w c:\program files\ffdssetts.reg
2006-08-02 17:41 3,026 ----a-w c:\program files\mpc3.reg
2006-08-02 17:41 18,168 ----a-w c:\program files\mpc6.reg
2006-08-02 17:41 16,882 ----a-w c:\program files\mpc5.reg
2006-08-02 17:41 1,172 ----a-w c:\program files\ffdsasetts.reg
2006-02-19 16:51 9,216 -c--a-w c:\program files\PERIODN.NDX
2006-02-19 16:51 9,216 -c--a-w c:\program files\OBJETBD.NDX
2006-02-19 16:51 8,192 -c--a-w c:\program files\AUTEUR.NDX
2006-02-19 16:51 7,168 -c--a-w c:\program files\PERIOD.NDX
2006-02-19 16:51 26,624 -c--a-w c:\program files\LIVRE.NDX
2006-02-19 16:51 12,288 -c--a-w c:\program files\SERIE.NDX
2006-02-19 16:51 10,240 -c--a-w c:\program files\EXLIB.NDX
2006-02-18 14:03 68 -c--a-w c:\program files\EPISODE.FIC
2006-02-18 14:02 68 -c--a-w c:\program files\COLLECT.FIC
2006-02-18 14:02 410 -c--a-w c:\program files\AUTEUR.FIC
2006-02-18 14:02 38 -c--a-w c:\program files\AUTSER.FIC
2006-02-18 14:02 38 -c--a-w c:\program files\AUTLIV.FIC
2006-02-18 14:02 26 -c--a-w c:\program files\ACTIVITE.FIC
2006-02-18 14:02 22 -c--a-w c:\program files\COTOB.FIC
2006-02-18 14:02 22 -c--a-w c:\program files\COTEX.FIC
2006-02-18 14:02 22 -c--a-w c:\program files\COTES.FIC
2006-02-18 14:02 128 -c--a-w c:\program files\AUTEUR.MMO
2006-01-28 19:52 251 -c--a-w c:\program files\wt3d.ini
2002-09-23 08:19 89,088 -c--a-w c:\program files\Gbdao.exe
2002-09-23 08:19 2,955,813 -c--a-w c:\program files\Gbdao.wdl
2001-11-01 09:19 1,003,520 -c--a-w c:\program files\cjpg.exe
2001-09-12 16:05 356,832 -c--a-w c:\program files\filigrane.bmp
2001-08-16 13:35 53,248 -c--a-w c:\program files\mySQL4WD.dll
2001-07-30 23:46 225,280 -c--a-w c:\program files\libmySQL.dll
1999-09-13 08:56 60,318 -c--a-w c:\program files\pasimg.bmp
1998-12-18 10:52 65,536 -c--a-w c:\program files\Wd553ndx.exe
1998-09-02 14:27 23,200 -c--a-w c:\program files\eztwain.dll
1998-08-31 23:00 326 -c--a-w c:\program files\Main5.cur
1998-08-23 18:36 63,488 -c--a-w c:\program files\eztw32.dll
2003-08-16 17:56 579,584 --sha-r c:\windows\system32\cd.exe
2005-11-06 11:49 184,618 --sha-r c:\windows\system32\patcher.exe
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Ub4TrayApp"="c:\program files\Astase\UltraBackup\4.0\bin\ubtray.exe" [2004-10-21 1381376]
"msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]
"Wallpaper"="c:\program files\Wallpaper\Wallpaper.exe" [2007-08-21 233472]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
"UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-07 36864]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AdobeCS4ServiceManager"="c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\McUpdate.exe" [2007-12-06 419152]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2008-07-11 641208]
"ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 c:\windows\stsystra.exe]
"MBMon"="CTMBHA.DLL" [2005-05-19 c:\windows\system32\CTMBHA.DLL]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-27 110592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.l3codec"= l3codecp.acm
"VIDC.VP40"= vp4vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"iPodService"=3 (0x3)
"Creative Service for CDROM Access"=2 (0x2)
"AOL ACS"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\eMule\\eMule.exe"=
"c:\\Program Files\\uTorrent\\utorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Fichiers communs\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification
"5353:TCP"= 5353:TCP:Adobe CSI CS4

S1 intel5;INTEL processor extention;\??\c:\windows\system32\intel5.sys --> c:\windows\system32\intel5.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-08 33752]
.
Contenu du dossier 'Tâches planifiées'

2009-01-22 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe []

2009-01-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe []

2006-01-22 c:\windows\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 03:34]
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file)
BHO-{c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - c:\windows\system32\ullxdb.dll
WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
HKCU-Run-Creative Detector - c:\program files\Creative\MediaSource\Detector\CTDetect.exe
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\j2re1.4.2_03\bin\jusched.exe
HKLM-Run-VSOCheckTask - c:\progra~1\mcafee.com\vso\mcmnhdlr.exe
HKLM-Run-VoiceCenter - c:\program files\Creative\VoiceCenter\AndreaVC.exe
HKLM-Run-VirusScan Online - c:\progra~1\mcafee.com\vso\mcvsshld.exe
HKLM-Run-RealTray - c:\program files\Real\RealPlayer\RealPlay.exe
HKLM-Run-MPFExe - c:\progra~1\McAfee.com\PERSON~1\MpfTray.exe
HKLM-Run-key2 - c:\windows\system32\winlog.exe
HKLM-Run-ISUSPM Startup - c:\program files\Fichiers communs\InstallShield\UpdateService\isuspm.exe
HKLM-Run-Corel Photo Downloader - c:\program files\Corel\Corel Photo Album 6\MediaDetect.exe
HKLM-Run-anti_troj - c:\windows\system32\anti_troj.exe
Notify-pmnlKBTl - pmnlKBTl.dll

.
------- Examen supplémentaire -------
.
uStart Page = hxxp://google.fr/
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.05\AMVConverter\grab.html
IE: Download Video on This Page - c:\program files\Tomato\YouTube Video Downloader\IEPage.html
IE: Download Video This Links To - c:\program files\Tomato\YouTube Video Downloader\IELink.html
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.05\MediaManager\grab.html
IE: S'abonner avec l'agrégateur par défaut - c:\documents and settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
IE: {{11F19C45-9675-488A-A8E0-8E8234DC245D} - c:\program files\Tomato\YouTube Video Downloader\IEPage.html
Trusted Zone: internet
Trusted Zone: mcafee.com
TCP: {D876E30A-A71F-4C3F-A6A4-E440C94F5729} = 212.27.53.252,212.27.54.252
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab
FF - ProfilePath - c:\documents and settings\Félix POMMIER\Application Data\Mozilla\Firefox\Profiles\4v4o4b9j.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- PARAMETRES FIREFOX ----
FF - user.js: general.useragent.extra.zencast - .

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 16:21:03
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

c:\docume~1\FLIXPO~1\LOCALS~1\Temp\~DF32F6.tmp 16384 bytes

Scan terminé avec succès
Fichiers cachés: 1

**************************************************************************
.
--------------------- CLES DE REGISTRE BLOQUEES ---------------------

[HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DCFA1E9C-CCF0-C36D-C10E-CCCFB8B5C25C}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"pafcfobnbhinojbaenpkcpodjdggnjbk"=hex:6a,61,62,6a,6a,6e,63,67,6a,68,64,62,69,
63,66,6c,61,6e,6c,6e,00,ee
"oalpomjgfmjjhcefhaaadcnngfmgnm"=hex:6a,61,62,6a,6c,69,69,66,64,6e,62,62,67,70,
64,67,69,61,62,67,00,e9

[HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Zepter Software\RegLib*e4ef0cfd\AnyDVD/1]
"1"=dword:447066af
"2"=dword:4470673c

[HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Zepter Software\RegLib*e4ef0cfd\CloneDVDmobile/1]
"1"=dword:44706403
"2"=dword:44bf45e4

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{3B85D734-4D1E-A5B8-7A2C9FEBD20E3A7C}\{9B78C2B1-5ACD-EEEE-C2C08A9F5ADC5CE8}\{497F871A-1051-F8C7-F54470C03EAE9AE4}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,34,ce,39,
8f,a1,8c,ed,25,29,79,d3,90,4f,6f,9b,78,dd,5f,6e,60,17,5b,31,35,61,ed,4b,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,c5,ef,5c,00,b7,
0c,4e,6d,e2,63,26,f1,3f,c8,ff,68,47,9c,0b,88,ed,41,37,61,e2,63,26,f1,3f,c8,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5B0B6C35-3AEA-9EAE-179EBB09B20EA2F1}\{75565C86-DCE5-4077-B0F3502E93E7104E}\{6B409343-0D15-4A1C-46DBD99A1375331F}*]
"{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,34,ce,39,
8f,a1,8c,ed,25,29,79,d3,90,4f,6f,9b,78,dd,5f,6e,60,17,5b,31,35,61,ed,4b,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5BE3D010-3EF3-EA3A-19EA72F7729702DF}\{352FFD75-9B70-D323-D2F13A6467AA3E3D}\{81CD47E4-7EF3-579C-2C259DBE42414B54}*]
"NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04,
de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,c0,c1,a1,4a,11,
22,ea,21,6a,9c,d6,61,af,45,84,18,13,55,92,c2,79,7e,3f,99,6a,9c,d6,61,af,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,f7,ce,ec,4c,54,
5e,fe,07,ff,7c,85,e0,43,d4,0e,fe,97,86,58,47,98,75,c0,e7,ff,7c,85,e0,43,d4,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,bf,a3,0e,38,50,
0f,d1,a5,86,8c,21,01,be,91,eb,e7,67,12,2e,e3,a7,65,6a,79,86,8c,21,01,be,91,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,59,b4,2b,01,ed,
ab,b0,f2,f5,1d,4d,73,a8,13,5c,05,0c,02,c2,73,17,6e,65,c7,f5,1d,4d,73,a8,13,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,f2,20,8d,41,56,
36,0b,77,df,20,58,62,78,6b,cf,c8,21,ad,7b,0a,78,15,1b,89,df,20,58,62,78,6b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,fb,0d,ed,71,ee,
be,a6,07,fb,a7,78,e6,12,2f,9a,ea,06,81,26,cf,3e,c9,79,fe,fb,a7,78,e6,12,2f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,d1,d9,47,51,80,
ef,70,4b,01,3a,48,fc,e8,04,4a,f1,4b,04,47,f6,2e,02,2d,17,01,3a,48,fc,e8,04,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,c0,4e,b6,83,7b,
a4,2b,0f,f6,0f,4e,58,98,5b,89,c9,9f,1b,b5,09,5b,27,db,65,f6,0f,4e,58,98,5b,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,d8,92,3b,cf,8e,
bb,83,5b,3d,ce,ea,26,2d,45,aa,78,7e,01,45,58,4d,9c,d5,22,3d,ce,ea,26,2d,45,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F71B406A-64B6-7890-A4E79C228CB5B5C7}\{B2D97AB2-1AAA-0E19-47D2DF75F80031A6}\{B1F98325-4C85-36BE-448BCE0A416EDA34}*]
"NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04,
de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,6c,ff,2b,c7,a3,
27,53,1c,2a,b7,cc,b5,b9,7f,41,e7,8e,52,a4,d2,50,b9,66,94,2a,b7,cc,b5,b9,7f,\

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWS\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,4a,cc,ef,97,47,
4f,56,ba,6c,43,2d,1e,aa,22,2f,9c,17,c0,5b,cc,06,93,5c,61,6c,43,2d,1e,aa,22,\

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*]
"C040110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
------------------------ Autres processus actifs ------------------------
.
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\program files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\Fichiers communs\McAfee\MNA\McNASvc.exe
c:\program files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rundll32.exe
c:\docume~1\FLIXPO~1\LOCALS~1\temp\clclean.0001
c:\windows\ehome\ehmsas.exe
c:\program files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Heure de fin: 2009-01-24 16:27:34 - La machine a redémarré [Félix POMMIER]
ComboFix-quarantined-files.txt 2009-01-24 15:27:31

Avant-CF: 69,485,682,688 octets libres
Après-CF: 69,523,533,824 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

425 --- E O F --- 2009-01-24 10:00:01

Et le rapport hijackthis ;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:29:29, on 24/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe (file missing)
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

&#x25B6; Télécharge malwarebyte's anti-malware 

&#x25B6; Un tutoriel sera à ta disposition pour l'installer et l'utiliser correctement.
 
&#x25B6; Fais la mise à jour du logiciel (elle se fait normalement à l'installation) 

&#x25B6; Lance une analyse complète en cliquant sur "Exécuter un examen complet"

&#x25B6; Sélectionnes les disques que tu veux analyser et cliques sur "Lancer l'examen"

&#x25B6; L'analyse peut durer un bon moment.....

&#x25B6; Une fois l'analyse terminée, cliques sur "OK" puis sur "Afficher les résultats"

&#x25B6; Vérifies que tout est bien coché et cliques sur "Supprimer la sélection" => et ensuite sur "OK"

&#x25B6; Un rapport va s'ouvrir dans le bloc note... Fais un copié/collé du rapport dans ta prochaine réponse sur le forum


* Il se pourrait que certains fichiers devront être supprimés au redémarrage du PC... Faites le en cliquant sur "oui" à la question posée


Et ensuite refais un nouveau rapport hijackthis stp

Namyar123. · Answer

Le rapport malwarebytes : 

Malwarebytes' Anti-Malware 1.33
Version de la base de données: 1688
Windows 5.1.2600 Service Pack 3

24/01/2009 18:15:27
mbam-log-2009-01-24 (18-15-27).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 179330
Temps écoulé: 1 hour(s), 34 minute(s), 52 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 4

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Qoobox\Quarantine\C\WINDOWS\system32\htipxyod.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ullxdb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP60\A0012634.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP60\A0012637.dll (Trojan.Vundo) -> Quarantined and deleted successfully.




Et le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:37, on 24/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\RssBandit\RSSBandit.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\ehome\ehshell.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe (file missing)
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

&#x25B6; Télécharger et enregistrer lopSD sur le Bureau 
 
&#x25B6; Double-clic Lop S&D
 
&#x25B6; Faire l'installation 

&#x25B6; Fermer toutes les applications 

&#x25B6; Le lancer par un double-clic sur le raccourci qui est sur le bureau 
Avec VISTA => clic-droit et => Exécuter en tant qu'administrateur
 
&#x25B6; Taper F pour français , puis presser entrée 

&#x25B6; Taper 1 

&#x25B6; Presser Entrée 

&#x25B6; Le PC va redémarrer 
Note= si l'antivirus annonce une infection dans TEMP , l'ignorer
 
&#x25B6; Attendre l'apparition du rapport 
&#x25B6; Copier le rapport et le coller dans la réponse 
le rapport se trouve aussi à C:\lopR

Namyar123. · Answer

Voilà le rapport : 


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
   USER : Félix POMMIER ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Activated)
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:64 Go)
   D:\ (Local Disk) - NTFS - Total:149 Go (Free:83 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [1] ( 24/01/2009|20:47 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [17/01/2006|19:59] C:\DOCUME~1\ADMINI~1\APPLIC~1\Corel
   [01/09/2005|07:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [11/12/2008|10:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [17/01/2006|19:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [17/01/2006|19:56] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [23/01/2009|20:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [12/01/2009|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [20/07/2006|08:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
   [12/01/2009|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ALM
   [20/07/2006|09:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [23/01/2009|20:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [29/09/2006|09:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [06/01/2009|18:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [17/01/2006|19:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative Labs
   [20/01/2009|19:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Electronic Arts
   [05/08/2006|21:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\eXPert PDF 4
   [17/01/2008|18:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
   [01/08/2007|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [17/01/2006|19:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [09/07/2006|14:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ipswitch
   [11/01/2007|19:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macromedia
   [17/01/2008|17:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MAGIX
   [05/01/2009|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [06/01/2009|23:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Martau
   [12/12/2008|07:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [27/11/2006|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [20/01/2009|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [11/11/2006|13:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
   [08/01/2009|23:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [28/01/2006|11:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
   [17/01/2008|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
   [17/01/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle VideoSpin
   [29/01/2006|14:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [10/06/2008|07:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [19/02/2006|15:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G4
   [03/12/2008|22:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [16/03/2008|07:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
   [24/01/2009|10:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [30/04/2006|14:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TechSmith
   [22/01/2009|18:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [17/01/2008|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\VideoSpin
   [01/12/2007|07:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [13/09/2006|18:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [10/04/2008|08:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [17/01/2006|19:59] C:\DOCUME~1\Autres\APPLIC~1\Corel
   [18/04/2006|15:53] C:\DOCUME~1\Autres\APPLIC~1\Microsoft

   [22/01/2009|15:20] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Adobe
   [17/01/2006|19:59] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Corel
   [01/09/2005|07:25] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Identities
   [12/07/2006|23:06] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Macromedia
   [23/11/2006|18:24] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Microsoft
   [12/07/2006|23:02] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Mozilla
   [17/07/2007|11:04] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Real
   [17/01/2006|19:45] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Sun
   [11/04/2008|11:28] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Ulead Systems
   [17/01/2006|19:56] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\You've Got Pictures Screensaver

   [17/01/2006|19:59] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Corel
   [01/09/2005|07:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [01/09/2005|07:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [17/01/2006|19:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [17/01/2006|19:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver



   [10/06/2006|23:13] C:\DOCUME~1\FLIXPO~1\APPLIC~1\.bittorrent
   [08/11/2008|11:45] C:\DOCUME~1\FLIXPO~1\APPLIC~1\AccurateRip
   [22/01/2009|18:43] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Adobe
   [22/01/2006|18:20] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Apple Computer
   [18/07/2006|21:39] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Aveso
   [15/04/2006|13:36] C:\DOCUME~1\FLIXPO~1\APPLIC~1\BitDefender
   [24/01/2009|10:04] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Bull
   [30/07/2007|18:02] C:\DOCUME~1\FLIXPO~1\APPLIC~1\CopyToDvd
   [08/01/2009|21:37] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Creative
   [21/02/2008|18:28] C:\DOCUME~1\FLIXPO~1\APPLIC~1\DivX
   [07/08/2007|15:17] C:\DOCUME~1\FLIXPO~1\APPLIC~1\DMCache
   [12/01/2009|07:32] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Download Manager
   [21/05/2006|13:29] C:\DOCUME~1\FLIXPO~1\APPLIC~1\dvdcss
   [21/06/2006|19:09] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Eltima Software
   [05/08/2006|21:32] C:\DOCUME~1\FLIXPO~1\APPLIC~1\eXPert PDF Editor
   [20/11/2007|19:49] C:\DOCUME~1\FLIXPO~1\APPLIC~1\FastStone
   [06/02/2006|14:11] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Finder Bar
   [02/10/2007|16:09] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Google
   [08/01/2008|18:09] C:\DOCUME~1\FLIXPO~1\APPLIC~1\gtk-2.0
   [16/04/2006|17:04] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Identities
   [09/07/2006|14:34] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Ipswitch
   [19/02/2006|11:35] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Leadertech
   [23/11/2006|22:15] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Macromedia
   [17/01/2008|17:13] C:\DOCUME~1\FLIXPO~1\APPLIC~1\MAGIX
   [05/01/2009|21:42] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Malwarebytes
   [04/12/2008|11:53] C:\DOCUME~1\FLIXPO~1\APPLIC~1\McAfee
   [12/06/2008|17:30] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Media Player Classic
   [20/11/2008|19:25] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Microsoft
   [11/01/2009|17:49] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Mozilla
   [11/11/2006|13:24] C:\DOCUME~1\FLIXPO~1\APPLIC~1\NCH Swift Sound
   [01/05/2006|16:04] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Nullriver
   [12/02/2006|17:39] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Nvu
   [13/11/2007|16:46] C:\DOCUME~1\FLIXPO~1\APPLIC~1\OpenOffice.org2
   [15/02/2007|00:07] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Opera
   [28/01/2006|11:24] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Otto
   [24/07/2006|13:01] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Publish Providers
   [10/06/2008|17:41] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Real
   [11/11/2006|13:24] C:\DOCUME~1\FLIXPO~1\APPLIC~1\RecordPad
   [18/02/2006|16:17] C:\DOCUME~1\FLIXPO~1\APPLIC~1\River Past G4
   [24/01/2009|20:46] C:\DOCUME~1\FLIXPO~1\APPLIC~1\RssBandit
   [16/09/2008|20:28] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Samsung
   [14/09/2008|15:21] C:\DOCUME~1\FLIXPO~1\APPLIC~1\SFR
   [21/05/2006|14:13] C:\DOCUME~1\FLIXPO~1\APPLIC~1\SlySoft
   [19/02/2006|11:36] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Sonic
   [30/10/2006|11:39] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Sony
   [17/01/2006|19:45] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Sun
   [18/04/2006|17:16] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Talkback
   [12/02/2006|21:56] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Template
   [22/01/2009|18:58] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Ulead Systems
   [23/01/2009|20:56] C:\DOCUME~1\FLIXPO~1\APPLIC~1\uTorrent
   [01/12/2007|07:13] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Viewpoint
   [22/01/2006|18:37] C:\DOCUME~1\FLIXPO~1\APPLIC~1\vlc
   [22/01/2009|19:26] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Vso
   [16/11/2007|12:03] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Wallpaper
   [06/05/2008|20:42] C:\DOCUME~1\FLIXPO~1\APPLIC~1\WinRAR
   [17/01/2006|19:56] C:\DOCUME~1\FLIXPO~1\APPLIC~1\You've Got Pictures Screensaver


   [28/04/2006|18:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [06/10/2006|10:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Media Player Classic
   [01/09/2005|07:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [28/04/2006|18:40] C:\DOCUME~1\LOCALS~1\APPLIC~1\Mozilla
   [06/01/2009|18:12] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore
   [28/04/2006|18:40] C:\DOCUME~1\LOCALS~1\APPLIC~1\Talkback

   [01/09/2005|07:05] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [22/01/2009 22:03][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [15/01/2009 01:00][--a------] C:\WINDOWS	asks\McDefragTask.job
   [01/01/2009 01:00][--a------] C:\WINDOWS	asks\McQcTask.job
   [22/01/2006 16:02][--a------] C:\WINDOWS	asks\Rappel d'abonnement 1 auprès de l'ISP.job
   [24/01/2009 16:20][--ah-----] C:\WINDOWS	asks\SA.DAT
   [10/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [20/07/2006|17:43] C:\Program Files\Admiresoft
   [12/01/2009|20:29] C:\Program Files\Adobe
   [12/01/2009|20:19] C:\Program Files\Adobe Media Player
   [14/03/2008|18:50] C:\Program Files\Aegisub
   [20/01/2009|18:20] C:\Program Files\AGEIA Technologies
   [20/07/2006|17:53] C:\Program Files\All Sound Recorder XP 210
   [01/08/2007|20:41] C:\Program Files\ALO Power Audio Converter
   [24/01/2009|15:58] C:\Program Files\Alwil Software
   [23/01/2009|20:58] C:\Program Files\Apple Software Update
   [18/02/2006|14:44] C:\Program Files\Army
   [11/11/2006|17:22] C:\Program Files\Astase
   [17/01/2006|19:50] C:\Program Files\ATI Technologies
   [02/08/2006|16:29] C:\Program Files\AtomixMP3
   [22/01/2006|18:30] C:\Program Files\Audacity
   [06/01/2009|18:40] C:\Program Files\Audible
   [06/01/2009|18:47] C:\Program Files\Avira
   [20/07/2006|09:39] C:\Program Files\AXEL
   [26/03/2008|19:25] C:\Program Files\Badongo
   [24/02/2007|11:21] C:\Program Files\BDGest
   [13/01/2007|11:26] C:\Program Files\BitZipper
   [17/02/2007|16:34] C:\Program Files\Blender Foundation
   [23/01/2009|20:58] C:\Program Files\Bonjour
   [18/01/2009|17:57] C:\Program Files\Canon
   [24/06/2006|22:14] C:\Program Files\CaptureFlash
   [08/05/2006|17:31] C:\Program Files\Capturino
   [20/11/2007|19:48] C:\Program Files\Capturino 1.4
   [06/01/2009|23:21] C:\Program Files\CCleaner
   [29/05/2008|16:26] C:\Program Files\CD to WAV and MP3 Ripper
   [08/11/2008|12:04] C:\Program Files\Celestia
   [15/03/2008|12:30] C:\Program Files\Conduit
   [20/07/2006|09:09] C:\Program Files\Corel
   [22/01/2009|18:46] C:\Program Files\Creative
   [08/01/2009|21:38] C:\Program Files\Creative Installation Information
   [17/01/2006|19:50] C:\Program Files\CyberLink
   [22/01/2009|19:26] C:\Program Files\Dactylo
   [24/07/2007|18:02] C:\Program Files\DAEMON Tools
   [20/07/2006|09:02] C:\Program Files\Dell
   [12/04/2007|12:15] C:\Program Files\directx
   [06/01/2009|18:40] C:\Program Files\DivX
   [17/10/2007|12:38] C:\Program Files\Doom 3
   [10/07/2006|12:44] C:\Program Files\DTR Leisure Ltd
   [23/03/2008|15:33] C:\Program Files\DVDVIDEOSOFT
   [15/06/2007|10:35] C:\Program Files\Easy Mosaic 2005 Trial V12
   [24/10/2006|12:36] C:\Program Files\Elaborate Bytes
   [01/08/2007|18:04] C:\Program Files\eMule
   [24/01/2009|16:16] C:\Program Files\Fichiers communs
   [22/01/2009|19:26] C:\Program Files\FileZilla
   [04/12/2008|11:18] C:\Program Files\Final Fantasy VII
   [24/01/2009|11:12] C:\Program Files\FindyKill
   [20/07/2006|09:02] C:\Program Files\Flash Optimizer
   [22/01/2009|19:26] C:\Program Files\FlashGet
   [30/01/2007|18:35] C:\Program Files\FLVPlayer
   [28/06/2007|21:06] C:\Program Files\Folding@Home
   [08/11/2008|12:05] C:\Program Files\Free Audio Pack
   [01/08/2007|20:43] C:\Program Files\FTP Commander
   [08/11/2008|12:07] C:\Program Files\Gnaural
   [13/11/2007|16:22] C:\Program Files\Google
   [05/01/2007|14:09] C:\Program Files\Grisoft
   [11/06/2008|13:48] C:\Program Files\GTK2-Runtime
   [07/03/2008|16:40] C:\Program Files\honestech Video Editor 7.0 Trial
   [21/05/2006|16:20] C:\Program Files\ImTOO
   [22/01/2009|18:58] C:\Program Files\InstallShield Installation Information
   [17/01/2006|19:50] C:\Program Files\Intel
   [22/01/2009|19:26] C:\Program Files\Internet Explorer
   [22/01/2009|22:47] C:\Program Files\iPod
   [23/01/2009|20:58] C:\Program Files\iTunes
   [30/01/2007|18:35] C:\Program Files\IVCsoft
   [10/11/2006|20:17] C:\Program Files\IZArc
   [07/01/2009|19:54] C:\Program Files\Java
   [10/04/2007|15:52] C:\Program Files\Larousse
   [17/01/2006|19:56] C:\Program Files\Learn2.com
   [03/08/2007|17:19] C:\Program Files\LeechGet 2007
   [14/01/2007|11:13] C:\Program Files\LocalCooling
   [24/07/2007|18:23] C:\Program Files\LucasArts
   [11/01/2007|19:06] C:\Program Files\Macromedia
   [17/01/2008|17:01] C:\Program Files\MAGIX
   [24/01/2009|16:39] C:\Program Files\Malwarebytes' Anti-Malware
   [18/04/2006|15:50] C:\Program Files\McAfee(2).com
   [04/12/2008|10:45] C:\Program Files\McAfee.com
   [08/09/2008|09:55] C:\Program Files\Messenger
   [01/09/2005|07:18] C:\Program Files\microsoft frontpage
   [16/12/2006|17:58] C:\Program Files\Microsoft Office
   [19/12/2008|07:29] C:\Program Files\Microsoft Silverlight
   [06/05/2006|00:01] C:\Program Files\Microsoft Works
   [16/12/2006|17:58] C:\Program Files\Microsoft.NET
   [16/04/2008|17:57] C:\Program Files\Movie Collection
   [08/09/2008|09:43] C:\Program Files\Movie Maker
   [23/01/2009|21:23] C:\Program Files\Mozilla Firefox
   [01/09/2007|06:59] C:\Program Files\MSBuild
   [15/04/2006|12:59] C:\Program Files\MSN
   [01/09/2005|07:12] C:\Program Files\MSN Gaming Zone
   [10/04/2008|08:30] C:\Program Files\MSN Messenger
   [12/01/2008|21:40] C:\Program Files\MSXML 4.0
   [02/09/2007|02:01] C:\Program Files\MSXML 6.0
   [08/12/2007|20:02] C:\Program Files\NCH Swift Sound
   [21/05/2006|16:42] C:\Program Files
eodivx2006
   [08/09/2008|09:40] C:\Program Files\NetMeeting
   [08/01/2009|23:06] C:\Program Files\NOS
   [13/11/2007|16:36] C:\Program Files\Nvu
   [01/09/2005|07:13] C:\Program Files\Online Services
   [13/11/2007|16:47] C:\Program Files\OpenOffice.org 2.0
   [19/12/2008|07:01] C:\Program Files\Outlook Express
   [01/08/2007|20:45] C:\Program Files\Paint.NET
   [08/12/2007|20:03] C:\Program Files\PC Inspector File Recovery
   [01/08/2007|20:45] C:\Program Files\PDF Editeur 2
   [27/11/2008|09:47] C:\Program Files\Picasa2
   [17/01/2008|17:10] C:\Program Files\Pinnacle
   [12/12/2006|21:19] C:\Program Files\Power Tab Software
   [14/12/2008|22:07] C:\Program Files\pspvideo9
   [23/01/2009|20:58] C:\Program Files\QuickTime
   [27/07/2007|15:37] C:\Program Files\Rayman
   [05/06/2007|20:07] C:\Program Files\Real
   [10/06/2008|07:43] C:\Program Files\Real Alternative
   [01/09/2007|06:54] C:\Program Files\Reference Assemblies
   [18/04/2006|15:50] C:\Program Files\RegClean
   [09/01/2007|21:12] C:\Program Files\Ripp-it_AM
   [24/01/2009|10:24] C:\Program Files\RSS Xpress
   [11/01/2009|14:36] C:\Program Files\RssBandit
   [11/01/2008|21:47] C:\Program Files\Samsung
   [09/07/2006|17:19] C:\Program Files\Satsuki Decoder Pack
   [01/09/2005|07:15] C:\Program Files\Services en ligne
   [17/01/2006|19:48] C:\Program Files\Sigmatel
   [24/10/2006|12:12] C:\Program Files\SlySoft
   [16/03/2008|07:31] C:\Program Files\SmartSound Software
   [21/01/2008|18:09] C:\Program Files\Softick
   [18/04/2006|15:51] C:\Program Files\Softwin(2)
   [30/10/2006|12:43] C:\Program Files\Sonic
   [30/10/2006|12:42] C:\Program Files\Sony
   [30/10/2006|11:33] C:\Program Files\Sony Setup
   [30/04/2006|00:03] C:\Program Files\Specware
   [23/01/2009|20:57] C:\Program Files\Spybot - Search & Destroy
   [12/03/2006|15:33] C:\Program Files\SWiSHmax
   [08/05/2006|17:47] C:\Program Files\TechSmith
   [07/09/2008|23:08] C:\Program Files\Tomato
   [05/01/2007|14:33] C:\Program Files\ToniArts
   [08/01/2009|21:28] C:\Program Files\Total Uninstall 5
   [05/01/2009|21:39] C:\Program Files\Trend Micro
   [12/04/2007|12:06] C:\Program Files\Ubi Soft
   [17/10/2007|18:37] C:\Program Files\Ubisoft
   [22/01/2009|18:58] C:\Program Files\Ulead Systems
   [30/10/2006|11:36] C:\Program Files\Uninstall Information
   [06/01/2009|18:38] C:\Program Files\UsbFix
   [20/07/2008|20:39] C:\Program Files\uTorrent
   [04/03/2006|15:27] C:\Program Files\VideoLAN
   [24/06/2006|22:10] C:\Program Files\VideoSMS
   [17/01/2006|19:56] C:\Program Files\Viewpoint
   [04/11/2008|19:32] C:\Program Files\Virtools Web Player 3.5
   [01/08/2007|20:46] C:\Program Files\VSO
   [15/11/2007|22:35] C:\Program Files\Wallpaper
   [14/12/2008|22:05] C:\Program Files\WinAVI MP4 Converter
   [14/04/2007|15:34] C:\Program Files\WinAVI Video Converter
   [10/04/2008|08:29] C:\Program Files\Windows Live
   [07/03/2008|17:28] C:\Program Files\Windows Media Components
   [28/01/2007|20:50] C:\Program Files\Windows Media Connect 2
   [19/12/2008|07:01] C:\Program Files\Windows Media Player
   [08/09/2008|09:40] C:\Program Files\Windows NT
   [01/09/2005|07:12] C:\Program Files\Windows Plus
   [06/07/2007|22:44] C:\Program Files\WinOSX
   [06/05/2008|20:42] C:\Program Files\WinRAR
   [14/11/2007|07:57] C:\Program Files\WinZip
   [01/09/2005|07:18] C:\Program Files\xerox
   [31/10/2006|23:47] C:\Program Files\X'nStop 2.5
   [13/11/2007|16:48] C:\Program Files\Yahoo!
   [24/01/2007|21:49] C:\Program Files\YDKJWIN

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [12/01/2009|20:24] C:\Program Files\Fichiers communs\Adobe
   [12/01/2009|20:14] C:\Program Files\Fichiers communs\Adobe AIR
   [23/10/2006|18:39] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [20/07/2006|09:11] C:\Program Files\Fichiers communs\AOL
   [23/01/2009|20:58] C:\Program Files\Fichiers communs\Apple
   [22/01/2009|18:42] C:\Program Files\Fichiers communs\AVSMedia
   [19/12/2008|07:18] C:\Program Files\Fichiers communs\Creative
   [17/01/2006|19:51] C:\Program Files\Fichiers communs\Creative Labs Shared
   [16/12/2006|17:58] C:\Program Files\Fichiers communs\DESIGNER
   [23/03/2008|15:33] C:\Program Files\Fichiers communs\DVDVIDEOSOFT
   [17/01/2006|19:58] C:\Program Files\Fichiers communs\InstallShield
   [21/02/2008|18:24] C:\Program Files\Fichiers communs\InterVideo
   [17/01/2006|19:44] C:\Program Files\Fichiers communs\Java
   [21/02/2008|18:22] C:\Program Files\Fichiers communs\LightScribe
   [11/01/2007|19:07] C:\Program Files\Fichiers communs\Macromedia
   [24/02/2006|22:06] C:\Program Files\Fichiers communs\Macromedia Shared
   [17/01/2008|18:39] C:\Program Files\Fichiers communs\Macrovision Shared
   [07/03/2008|15:23] C:\Program Files\Fichiers communs\MAGIX Shared
   [04/12/2008|10:46] C:\Program Files\Fichiers communs\McAfee
   [25/08/2008|02:04] C:\Program Files\Fichiers communs\Microsoft Shared
   [01/09/2005|07:15] C:\Program Files\Fichiers communs\MSSoap
   [17/01/2006|19:55] C:\Program Files\Fichiers communs\Nullsoft
   [16/12/2006|17:58] C:\Program Files\Fichiers communs\ODBC
   [10/06/2008|07:42] C:\Program Files\Fichiers communs\Real
   [18/02/2006|16:16] C:\Program Files\Fichiers communs\River Past
   [01/09/2005|07:15] C:\Program Files\Fichiers communs\Services
   [18/04/2006|15:51] C:\Program Files\Fichiers communs\Softwin(2)
   [17/01/2006|19:59] C:\Program Files\Fichiers communs\Sonic Shared
   [01/09/2005|07:08] C:\Program Files\Fichiers communs\SpeechEngines
   [08/09/2008|09:55] C:\Program Files\Fichiers communs\System
   [17/01/2006|19:57] C:\Program Files\Fichiers communs\TiVo Shared
   [22/01/2009|18:56] C:\Program Files\Fichiers communs\Ulead Systems
   [05/08/2006|22:55] C:\Program Files\Fichiers communs\Vbox
   [10/04/2008|08:28] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [20/01/2009|18:20] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 50 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\FLIXPO~1\Cookies\félix_pommier@advertstream[1].txt
   C:\DOCUME~1\FLIXPO~1\Cookies\félix_pommier@advertising[1].txt
   C:\DOCUME~1\FLIXPO~1\Cookies\félix_pommier@advertising[2].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-01-24 20:48:43
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 64
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\crazy hoover.mp3
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\hard dream eram 008.mp3
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\painkiller.mp3
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno	anulinka vendelinka.mp3


   [F:17][D:2]-> C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp
   [F:184][D:0]-> C:\DOCUME~1\FLIXPO~1\Cookies
   [F:1029][D:4]-> C:\DOCUME~1\FLIXPO~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 24/01/2009|20:50 - Option : [1]

   --------------------\  Fin du rapport a 20:50:48

geoffrey5 · Answer

&#x25B6; Relance Lop S&D

&#x25B6; Choisis cette fois-ci l'option 2 (Suppression)

&#x25B6; Ne ferme pas la fenêtre lors de la suppression !

&#x25B6; Poste le rapport généré (C:\lopR.txt)

* (Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)


Ensuite :


&#x25B6; Télécharger SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
 
&#x25B6; Double cliquer sur SDFix.exe et choisir Install pour l'extraire dans un dossier dédié sur ton disque C:.
 
/!\ Démarre en mode sans échec : après le bip et avant le logo windows tapoter sur la touche F8 (ou F5): menu M.S.E.. 

&#x25B6; Choisir son compte, pas celui de l'Administrateur ou autre. 

Dérouler la liste des instructions ci-dessous :
 
• Ouvrir le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuyer sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuyer sur une touche pour redémarrer le PC. 
• Le système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuyer sur une touche pour finir l'exécution du script et charger les icônes du Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copier/coller le contenu du fichier Report.txt dans la prochaine réponse sur le forum 

et ensuite refais un nouveau rapport hijackthis stp

Namyar123. · Answer

Merci encore pour ton aide.

Le rapport Lop s&d :


   --------------------\  Lop S&D 4.2.5-0   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) 4 CPU 3.20GHz )
   BIOS : Phoenix ROM BIOS PLUS Version 1.10 A02
   USER : Félix POMMIER ( Administrator )
   BOOT : Normal boot
   Antivirus : Avira AntiVir PersonalEdition Classic 8.0.1.30 (Activated)
   C:\ (Local Disk) - NTFS - Total:144 Go (Free:64 Go)
   D:\ (Local Disk) - NTFS - Total:149 Go (Free:83 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)
   J:\ (USB)

   "C:\Lop SD" ( MAJ : 19-12-2008|23:40 )
   Option : [2] ( 24/01/2009|21:47 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\FLIXPO~1\Cookies\félix_pommier@advertstream[1].txt
   Supprime! - C:\DOCUME~1\FLIXPO~1\Cookies\félix_pommier@advertising[1].txt
   Supprime! - C:\DOCUME~1\FLIXPO~1\Cookies\félix_pommier@advertising[2].txt
 
   \\\\\\\\\\\\\\\ 

   Supprime! - C:\Program Files\Viewpoint
   Supprime! - C:\DOCUME~1\FLIXPO~1\APPLIC~1\Viewpoint
   Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
 
   \\\\\\\\\\\\\\\

 
   --------------------\  Listing des dossiers dans APPLIC~1

   [17/01/2006|19:59] C:\DOCUME~1\ADMINI~1\APPLIC~1\Corel
   [01/09/2005|07:25] C:\DOCUME~1\ADMINI~1\APPLIC~1\Identities
   [11/12/2008|10:04] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft
   [17/01/2006|19:45] C:\DOCUME~1\ADMINI~1\APPLIC~1\Sun
   [17/01/2006|19:56] C:\DOCUME~1\ADMINI~1\APPLIC~1\You've Got Pictures Screensaver

   [23/01/2009|20:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
   [12/01/2009|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [20/07/2006|08:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
   [12/01/2009|20:29] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ALM
   [20/07/2006|09:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
   [23/01/2009|20:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [29/09/2006|09:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [06/01/2009|18:47] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Avira
   [17/01/2006|19:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Creative Labs
   [20/01/2009|19:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Electronic Arts
   [05/08/2006|21:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\eXPert PDF 4
   [17/01/2008|18:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
   [01/08/2007|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [17/01/2006|19:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [09/07/2006|14:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ipswitch
   [11/01/2007|19:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Macromedia
   [17/01/2008|17:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MAGIX
   [05/01/2009|21:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [06/01/2009|23:09] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Martau
   [12/12/2008|07:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
   [27/11/2006|11:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
   [20/01/2009|18:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [11/11/2006|13:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NCH Swift Sound
   [08/01/2009|23:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\NOS
   [28/01/2006|11:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Otto
   [17/01/2008|12:00] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle
   [17/01/2008|16:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Pinnacle VideoSpin
   [29/01/2006|14:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [10/06/2008|07:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [19/02/2006|15:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G4
   [03/12/2008|22:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
   [16/03/2008|07:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SmartSound Software Inc
   [24/01/2009|10:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [30/04/2006|14:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TechSmith
   [22/01/2009|18:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ulead Systems
   [17/01/2008|12:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\VideoSpin
   [13/09/2006|18:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [10/04/2008|08:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [17/01/2006|19:59] C:\DOCUME~1\Autres\APPLIC~1\Corel
   [18/04/2006|15:53] C:\DOCUME~1\Autres\APPLIC~1\Microsoft

   [22/01/2009|15:20] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Adobe
   [17/01/2006|19:59] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Corel
   [01/09/2005|07:25] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Identities
   [12/07/2006|23:06] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Macromedia
   [23/11/2006|18:24] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Microsoft
   [12/07/2006|23:02] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Mozilla
   [17/07/2007|11:04] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Real
   [17/01/2006|19:45] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Sun
   [11/04/2008|11:28] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\Ulead Systems
   [17/01/2006|19:56] C:\DOCUME~1\AUTRES~1.FLI\APPLIC~1\You've Got Pictures Screensaver

   [17/01/2006|19:59] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Corel
   [01/09/2005|07:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [01/09/2005|07:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
   [17/01/2006|19:45] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
   [17/01/2006|19:56] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver



   [10/06/2006|23:13] C:\DOCUME~1\FLIXPO~1\APPLIC~1\.bittorrent
   [08/11/2008|11:45] C:\DOCUME~1\FLIXPO~1\APPLIC~1\AccurateRip
   [22/01/2009|18:43] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Adobe
   [22/01/2006|18:20] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Apple Computer
   [18/07/2006|21:39] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Aveso
   [15/04/2006|13:36] C:\DOCUME~1\FLIXPO~1\APPLIC~1\BitDefender
   [24/01/2009|10:04] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Bull
   [30/07/2007|18:02] C:\DOCUME~1\FLIXPO~1\APPLIC~1\CopyToDvd
   [08/01/2009|21:37] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Creative
   [21/02/2008|18:28] C:\DOCUME~1\FLIXPO~1\APPLIC~1\DivX
   [07/08/2007|15:17] C:\DOCUME~1\FLIXPO~1\APPLIC~1\DMCache
   [12/01/2009|07:32] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Download Manager
   [21/05/2006|13:29] C:\DOCUME~1\FLIXPO~1\APPLIC~1\dvdcss
   [21/06/2006|19:09] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Eltima Software
   [05/08/2006|21:32] C:\DOCUME~1\FLIXPO~1\APPLIC~1\eXPert PDF Editor
   [20/11/2007|19:49] C:\DOCUME~1\FLIXPO~1\APPLIC~1\FastStone
   [06/02/2006|14:11] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Finder Bar
   [02/10/2007|16:09] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Google
   [08/01/2008|18:09] C:\DOCUME~1\FLIXPO~1\APPLIC~1\gtk-2.0
   [16/04/2006|17:04] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Identities
   [09/07/2006|14:34] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Ipswitch
   [19/02/2006|11:35] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Leadertech
   [23/11/2006|22:15] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Macromedia
   [17/01/2008|17:13] C:\DOCUME~1\FLIXPO~1\APPLIC~1\MAGIX
   [05/01/2009|21:42] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Malwarebytes
   [04/12/2008|11:53] C:\DOCUME~1\FLIXPO~1\APPLIC~1\McAfee
   [12/06/2008|17:30] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Media Player Classic
   [20/11/2008|19:25] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Microsoft
   [11/01/2009|17:49] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Mozilla
   [11/11/2006|13:24] C:\DOCUME~1\FLIXPO~1\APPLIC~1\NCH Swift Sound
   [01/05/2006|16:04] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Nullriver
   [12/02/2006|17:39] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Nvu
   [13/11/2007|16:46] C:\DOCUME~1\FLIXPO~1\APPLIC~1\OpenOffice.org2
   [15/02/2007|00:07] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Opera
   [28/01/2006|11:24] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Otto
   [24/07/2006|13:01] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Publish Providers
   [10/06/2008|17:41] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Real
   [11/11/2006|13:24] C:\DOCUME~1\FLIXPO~1\APPLIC~1\RecordPad
   [18/02/2006|16:17] C:\DOCUME~1\FLIXPO~1\APPLIC~1\River Past G4
   [24/01/2009|20:46] C:\DOCUME~1\FLIXPO~1\APPLIC~1\RssBandit
   [16/09/2008|20:28] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Samsung
   [14/09/2008|15:21] C:\DOCUME~1\FLIXPO~1\APPLIC~1\SFR
   [21/05/2006|14:13] C:\DOCUME~1\FLIXPO~1\APPLIC~1\SlySoft
   [19/02/2006|11:36] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Sonic
   [30/10/2006|11:39] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Sony
   [17/01/2006|19:45] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Sun
   [18/04/2006|17:16] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Talkback
   [12/02/2006|21:56] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Template
   [22/01/2009|18:58] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Ulead Systems
   [23/01/2009|20:56] C:\DOCUME~1\FLIXPO~1\APPLIC~1\uTorrent
   [22/01/2006|18:37] C:\DOCUME~1\FLIXPO~1\APPLIC~1\vlc
   [22/01/2009|19:26] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Vso
   [16/11/2007|12:03] C:\DOCUME~1\FLIXPO~1\APPLIC~1\Wallpaper
   [06/05/2008|20:42] C:\DOCUME~1\FLIXPO~1\APPLIC~1\WinRAR
   [17/01/2006|19:56] C:\DOCUME~1\FLIXPO~1\APPLIC~1\You've Got Pictures Screensaver


   [28/04/2006|18:41] C:\DOCUME~1\LOCALS~1\APPLIC~1\Macromedia
   [06/10/2006|10:03] C:\DOCUME~1\LOCALS~1\APPLIC~1\Media Player Classic
   [01/09/2005|07:05] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [28/04/2006|18:40] C:\DOCUME~1\LOCALS~1\APPLIC~1\Mozilla
   [06/01/2009|18:12] C:\DOCUME~1\LOCALS~1\APPLIC~1\SACore
   [28/04/2006|18:40] C:\DOCUME~1\LOCALS~1\APPLIC~1\Talkback

   [01/09/2005|07:05] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [22/01/2009 22:03][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [15/01/2009 01:00][--a------] C:\WINDOWS	asks\McDefragTask.job
   [01/01/2009 01:00][--a------] C:\WINDOWS	asks\McQcTask.job
   [22/01/2006 16:02][--a------] C:\WINDOWS	asks\Rappel d'abonnement 1 auprès de l'ISP.job
   [24/01/2009 16:20][--ah-----] C:\WINDOWS	asks\SA.DAT
   [10/08/2004 13:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [20/07/2006|17:43] C:\Program Files\Admiresoft
   [12/01/2009|20:29] C:\Program Files\Adobe
   [12/01/2009|20:19] C:\Program Files\Adobe Media Player
   [14/03/2008|18:50] C:\Program Files\Aegisub
   [20/01/2009|18:20] C:\Program Files\AGEIA Technologies
   [20/07/2006|17:53] C:\Program Files\All Sound Recorder XP 210
   [01/08/2007|20:41] C:\Program Files\ALO Power Audio Converter
   [24/01/2009|15:58] C:\Program Files\Alwil Software
   [23/01/2009|20:58] C:\Program Files\Apple Software Update
   [18/02/2006|14:44] C:\Program Files\Army
   [11/11/2006|17:22] C:\Program Files\Astase
   [17/01/2006|19:50] C:\Program Files\ATI Technologies
   [02/08/2006|16:29] C:\Program Files\AtomixMP3
   [22/01/2006|18:30] C:\Program Files\Audacity
   [06/01/2009|18:40] C:\Program Files\Audible
   [06/01/2009|18:47] C:\Program Files\Avira
   [20/07/2006|09:39] C:\Program Files\AXEL
   [26/03/2008|19:25] C:\Program Files\Badongo
   [24/02/2007|11:21] C:\Program Files\BDGest
   [13/01/2007|11:26] C:\Program Files\BitZipper
   [17/02/2007|16:34] C:\Program Files\Blender Foundation
   [23/01/2009|20:58] C:\Program Files\Bonjour
   [18/01/2009|17:57] C:\Program Files\Canon
   [24/06/2006|22:14] C:\Program Files\CaptureFlash
   [08/05/2006|17:31] C:\Program Files\Capturino
   [20/11/2007|19:48] C:\Program Files\Capturino 1.4
   [06/01/2009|23:21] C:\Program Files\CCleaner
   [29/05/2008|16:26] C:\Program Files\CD to WAV and MP3 Ripper
   [08/11/2008|12:04] C:\Program Files\Celestia
   [15/03/2008|12:30] C:\Program Files\Conduit
   [20/07/2006|09:09] C:\Program Files\Corel
   [22/01/2009|18:46] C:\Program Files\Creative
   [08/01/2009|21:38] C:\Program Files\Creative Installation Information
   [17/01/2006|19:50] C:\Program Files\CyberLink
   [22/01/2009|19:26] C:\Program Files\Dactylo
   [24/07/2007|18:02] C:\Program Files\DAEMON Tools
   [20/07/2006|09:02] C:\Program Files\Dell
   [12/04/2007|12:15] C:\Program Files\directx
   [06/01/2009|18:40] C:\Program Files\DivX
   [17/10/2007|12:38] C:\Program Files\Doom 3
   [10/07/2006|12:44] C:\Program Files\DTR Leisure Ltd
   [23/03/2008|15:33] C:\Program Files\DVDVIDEOSOFT
   [15/06/2007|10:35] C:\Program Files\Easy Mosaic 2005 Trial V12
   [24/10/2006|12:36] C:\Program Files\Elaborate Bytes
   [01/08/2007|18:04] C:\Program Files\eMule
   [24/01/2009|16:16] C:\Program Files\Fichiers communs
   [22/01/2009|19:26] C:\Program Files\FileZilla
   [04/12/2008|11:18] C:\Program Files\Final Fantasy VII
   [24/01/2009|11:12] C:\Program Files\FindyKill
   [20/07/2006|09:02] C:\Program Files\Flash Optimizer
   [22/01/2009|19:26] C:\Program Files\FlashGet
   [30/01/2007|18:35] C:\Program Files\FLVPlayer
   [28/06/2007|21:06] C:\Program Files\Folding@Home
   [08/11/2008|12:05] C:\Program Files\Free Audio Pack
   [01/08/2007|20:43] C:\Program Files\FTP Commander
   [08/11/2008|12:07] C:\Program Files\Gnaural
   [13/11/2007|16:22] C:\Program Files\Google
   [05/01/2007|14:09] C:\Program Files\Grisoft
   [11/06/2008|13:48] C:\Program Files\GTK2-Runtime
   [07/03/2008|16:40] C:\Program Files\honestech Video Editor 7.0 Trial
   [21/05/2006|16:20] C:\Program Files\ImTOO
   [22/01/2009|18:58] C:\Program Files\InstallShield Installation Information
   [17/01/2006|19:50] C:\Program Files\Intel
   [22/01/2009|19:26] C:\Program Files\Internet Explorer
   [22/01/2009|22:47] C:\Program Files\iPod
   [23/01/2009|20:58] C:\Program Files\iTunes
   [30/01/2007|18:35] C:\Program Files\IVCsoft
   [10/11/2006|20:17] C:\Program Files\IZArc
   [07/01/2009|19:54] C:\Program Files\Java
   [10/04/2007|15:52] C:\Program Files\Larousse
   [17/01/2006|19:56] C:\Program Files\Learn2.com
   [03/08/2007|17:19] C:\Program Files\LeechGet 2007
   [14/01/2007|11:13] C:\Program Files\LocalCooling
   [24/07/2007|18:23] C:\Program Files\LucasArts
   [11/01/2007|19:06] C:\Program Files\Macromedia
   [17/01/2008|17:01] C:\Program Files\MAGIX
   [24/01/2009|16:39] C:\Program Files\Malwarebytes' Anti-Malware
   [18/04/2006|15:50] C:\Program Files\McAfee(2).com
   [04/12/2008|10:45] C:\Program Files\McAfee.com
   [08/09/2008|09:55] C:\Program Files\Messenger
   [01/09/2005|07:18] C:\Program Files\microsoft frontpage
   [16/12/2006|17:58] C:\Program Files\Microsoft Office
   [19/12/2008|07:29] C:\Program Files\Microsoft Silverlight
   [06/05/2006|00:01] C:\Program Files\Microsoft Works
   [16/12/2006|17:58] C:\Program Files\Microsoft.NET
   [16/04/2008|17:57] C:\Program Files\Movie Collection
   [08/09/2008|09:43] C:\Program Files\Movie Maker
   [23/01/2009|21:23] C:\Program Files\Mozilla Firefox
   [01/09/2007|06:59] C:\Program Files\MSBuild
   [15/04/2006|12:59] C:\Program Files\MSN
   [01/09/2005|07:12] C:\Program Files\MSN Gaming Zone
   [10/04/2008|08:30] C:\Program Files\MSN Messenger
   [12/01/2008|21:40] C:\Program Files\MSXML 4.0
   [02/09/2007|02:01] C:\Program Files\MSXML 6.0
   [08/12/2007|20:02] C:\Program Files\NCH Swift Sound
   [21/05/2006|16:42] C:\Program Files
eodivx2006
   [08/09/2008|09:40] C:\Program Files\NetMeeting
   [08/01/2009|23:06] C:\Program Files\NOS
   [13/11/2007|16:36] C:\Program Files\Nvu
   [01/09/2005|07:13] C:\Program Files\Online Services
   [13/11/2007|16:47] C:\Program Files\OpenOffice.org 2.0
   [19/12/2008|07:01] C:\Program Files\Outlook Express
   [01/08/2007|20:45] C:\Program Files\Paint.NET
   [08/12/2007|20:03] C:\Program Files\PC Inspector File Recovery
   [01/08/2007|20:45] C:\Program Files\PDF Editeur 2
   [27/11/2008|09:47] C:\Program Files\Picasa2
   [17/01/2008|17:10] C:\Program Files\Pinnacle
   [12/12/2006|21:19] C:\Program Files\Power Tab Software
   [14/12/2008|22:07] C:\Program Files\pspvideo9
   [23/01/2009|20:58] C:\Program Files\QuickTime
   [27/07/2007|15:37] C:\Program Files\Rayman
   [05/06/2007|20:07] C:\Program Files\Real
   [10/06/2008|07:43] C:\Program Files\Real Alternative
   [01/09/2007|06:54] C:\Program Files\Reference Assemblies
   [18/04/2006|15:50] C:\Program Files\RegClean
   [09/01/2007|21:12] C:\Program Files\Ripp-it_AM
   [24/01/2009|10:24] C:\Program Files\RSS Xpress
   [11/01/2009|14:36] C:\Program Files\RssBandit
   [11/01/2008|21:47] C:\Program Files\Samsung
   [09/07/2006|17:19] C:\Program Files\Satsuki Decoder Pack
   [01/09/2005|07:15] C:\Program Files\Services en ligne
   [17/01/2006|19:48] C:\Program Files\Sigmatel
   [24/10/2006|12:12] C:\Program Files\SlySoft
   [16/03/2008|07:31] C:\Program Files\SmartSound Software
   [21/01/2008|18:09] C:\Program Files\Softick
   [18/04/2006|15:51] C:\Program Files\Softwin(2)
   [30/10/2006|12:43] C:\Program Files\Sonic
   [30/10/2006|12:42] C:\Program Files\Sony
   [30/10/2006|11:33] C:\Program Files\Sony Setup
   [30/04/2006|00:03] C:\Program Files\Specware
   [23/01/2009|20:57] C:\Program Files\Spybot - Search & Destroy
   [12/03/2006|15:33] C:\Program Files\SWiSHmax
   [08/05/2006|17:47] C:\Program Files\TechSmith
   [07/09/2008|23:08] C:\Program Files\Tomato
   [05/01/2007|14:33] C:\Program Files\ToniArts
   [08/01/2009|21:28] C:\Program Files\Total Uninstall 5
   [05/01/2009|21:39] C:\Program Files\Trend Micro
   [12/04/2007|12:06] C:\Program Files\Ubi Soft
   [17/10/2007|18:37] C:\Program Files\Ubisoft
   [22/01/2009|18:58] C:\Program Files\Ulead Systems
   [30/10/2006|11:36] C:\Program Files\Uninstall Information
   [06/01/2009|18:38] C:\Program Files\UsbFix
   [20/07/2008|20:39] C:\Program Files\uTorrent
   [04/03/2006|15:27] C:\Program Files\VideoLAN
   [24/06/2006|22:10] C:\Program Files\VideoSMS
   [04/11/2008|19:32] C:\Program Files\Virtools Web Player 3.5
   [01/08/2007|20:46] C:\Program Files\VSO
   [15/11/2007|22:35] C:\Program Files\Wallpaper
   [14/12/2008|22:05] C:\Program Files\WinAVI MP4 Converter
   [14/04/2007|15:34] C:\Program Files\WinAVI Video Converter
   [10/04/2008|08:29] C:\Program Files\Windows Live
   [07/03/2008|17:28] C:\Program Files\Windows Media Components
   [28/01/2007|20:50] C:\Program Files\Windows Media Connect 2
   [19/12/2008|07:01] C:\Program Files\Windows Media Player
   [08/09/2008|09:40] C:\Program Files\Windows NT
   [01/09/2005|07:12] C:\Program Files\Windows Plus
   [06/07/2007|22:44] C:\Program Files\WinOSX
   [06/05/2008|20:42] C:\Program Files\WinRAR
   [14/11/2007|07:57] C:\Program Files\WinZip
   [01/09/2005|07:18] C:\Program Files\xerox
   [31/10/2006|23:47] C:\Program Files\X'nStop 2.5
   [13/11/2007|16:48] C:\Program Files\Yahoo!
   [24/01/2007|21:49] C:\Program Files\YDKJWIN

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [12/01/2009|20:24] C:\Program Files\Fichiers communs\Adobe
   [12/01/2009|20:14] C:\Program Files\Fichiers communs\Adobe AIR
   [23/10/2006|18:39] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [20/07/2006|09:11] C:\Program Files\Fichiers communs\AOL
   [23/01/2009|20:58] C:\Program Files\Fichiers communs\Apple
   [22/01/2009|18:42] C:\Program Files\Fichiers communs\AVSMedia
   [19/12/2008|07:18] C:\Program Files\Fichiers communs\Creative
   [17/01/2006|19:51] C:\Program Files\Fichiers communs\Creative Labs Shared
   [16/12/2006|17:58] C:\Program Files\Fichiers communs\DESIGNER
   [23/03/2008|15:33] C:\Program Files\Fichiers communs\DVDVIDEOSOFT
   [17/01/2006|19:58] C:\Program Files\Fichiers communs\InstallShield
   [21/02/2008|18:24] C:\Program Files\Fichiers communs\InterVideo
   [17/01/2006|19:44] C:\Program Files\Fichiers communs\Java
   [21/02/2008|18:22] C:\Program Files\Fichiers communs\LightScribe
   [11/01/2007|19:07] C:\Program Files\Fichiers communs\Macromedia
   [24/02/2006|22:06] C:\Program Files\Fichiers communs\Macromedia Shared
   [17/01/2008|18:39] C:\Program Files\Fichiers communs\Macrovision Shared
   [07/03/2008|15:23] C:\Program Files\Fichiers communs\MAGIX Shared
   [04/12/2008|10:46] C:\Program Files\Fichiers communs\McAfee
   [25/08/2008|02:04] C:\Program Files\Fichiers communs\Microsoft Shared
   [01/09/2005|07:15] C:\Program Files\Fichiers communs\MSSoap
   [17/01/2006|19:55] C:\Program Files\Fichiers communs\Nullsoft
   [16/12/2006|17:58] C:\Program Files\Fichiers communs\ODBC
   [10/06/2008|07:42] C:\Program Files\Fichiers communs\Real
   [18/02/2006|16:16] C:\Program Files\Fichiers communs\River Past
   [01/09/2005|07:15] C:\Program Files\Fichiers communs\Services
   [18/04/2006|15:51] C:\Program Files\Fichiers communs\Softwin(2)
   [17/01/2006|19:59] C:\Program Files\Fichiers communs\Sonic Shared
   [01/09/2005|07:08] C:\Program Files\Fichiers communs\SpeechEngines
   [08/09/2008|09:55] C:\Program Files\Fichiers communs\System
   [17/01/2006|19:57] C:\Program Files\Fichiers communs\TiVo Shared
   [22/01/2009|18:56] C:\Program Files\Fichiers communs\Ulead Systems
   [05/08/2006|22:55] C:\Program Files\Fichiers communs\Vbox
   [10/04/2008|08:28] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [20/01/2009|18:20] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 50 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2009-01-24 21:49:08
   Windows 5.1.2600 Service Pack 3 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 64
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\crazy hoover.mp3
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\hard dream eram 008.mp3
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno\painkiller.mp3
   C:\DOCUME~1\FLIXPO~1\Mes documents\Ma musique\iTunes\iTunes Music\keygen kaotic\Techno	anulinka vendelinka.mp3


   [F:20][D:2]-> C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp
   [F:182][D:0]-> C:\DOCUME~1\FLIXPO~1\Cookies
   [F:1056][D:4]-> C:\DOCUME~1\FLIXPO~1\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 24/01/2009|20:50 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 24/01/2009|21:50 - Option : [2]

   --------------------\  Fin du rapport a 21:50:24





Le rapport SDFix : 


[b]SDFix: Version 1.240 /b
Run by Félix POMMIER on 24/01/2009 at 22:10

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services /b:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files /b: 

No Trojan Files Found






Removing Temp Files

[b]ADS Check /b:
 


                                 [b]Final Check /b:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-24 22:21:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:4f,e5,8a,73,57,3b,c0,2a,44,56,96,e2,a4,a8,8b,af,e7,bf,6c,56,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,9b,b7,1f,6e,50,c8,3e,7d,97,e7,3e,b5,7d,48,2d,11,8d,..
"khjeh"=hex:85,a5,dc,ae,78,66,8d,fc,fc,9d,b2,9d,ad,e3,bb,a6,6a,d3,f7,f5,f4,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ce,57,b7,b0,29,6f,28,88,14,e6,5c,53,2a,ec,78,f7,bd,32,35,3f,fd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:4f,e5,8a,73,57,3b,c0,2a,44,56,96,e2,a4,a8,8b,af,e7,bf,6c,56,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,9b,b7,1f,6e,50,c8,3e,7d,97,e7,3e,b5,7d,48,2d,11,8d,..
"khjeh"=hex:85,a5,dc,ae,78,66,8d,fc,fc,9d,b2,9d,ad,e3,bb,a6,6a,d3,f7,f5,f4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:ce,57,b7,b0,29,6f,28,88,14,e6,5c,53,2a,ec,78,f7,bd,32,35,3f,fd,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:4f,e5,8a,73,57,3b,c0,2a,44,56,96,e2,a4,a8,8b,af,e7,bf,6c,56,17,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,9b,b7,1f,6e,50,c8,3e,7d,97,e7,3e,b5,7d,48,2d,11,8d,..
"khjeh"=hex:85,a5,dc,ae,78,66,8d,fc,fc,9d,b2,9d,ad,e3,bb,a6,6a,d3,f7,f5,f4,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:bd,f7,e7,29,91,cb,3a,36,4a,f4,ac,ef,f7,54,10,ed,9c,28,8b,bb,90,..

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DCFA1E9C-CCF0-C36D-C10E-CCCFB8B5C25C}]
"pafcfobnbhinojbaenpkcpodjdggnjbk"=hex:6a,61,62,6a,6a,6e,63,67,6a,68,64,62,69,63,66,6c,61,6e,6c,6e,00,..
"oalpomjgfmjjhcefhaaadcnngfmgnm"=hex:6a,61,62,6a,6c,69,69,66,64,6e,62,62,67,70,64,67,69,61,62,67,00,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services /b:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\eMule\eMule.exe"="C:\Program Files\eMule\eMule.exe:*:Enabled:eMule Plus"
"C:\Program Files\uTorrent\utorrent.exe"="C:\Program Files\uTorrent\utorrent.exe:*:Enabled:µTorrent"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe"="C:\Program Files\Fichiers communs\McAfee\MNA\McNASvc.exe:*:Enabled:McAfee Network Agent"
"C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files /b:



[b]Files with Hidden Attributes /b:

Fri  4 Jan 2008     6,219,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Wed 22 Oct 2008       949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008     1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Mon  7 Jul 2008     1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon  7 Jul 2008     4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Tue 16 Sep 2008     1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008       962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Sat 16 Aug 2003       579,584 A.SHR --- "C:\WINDOWS\system32\cd.exe"
Sun  6 Nov 2005       184,618 A.SHR --- "C:\WINDOWS\system32\patcher.exe"
Fri  3 Nov 2006             9 A..H. --- "C:\WINDOWS\system32\wxmmin.dll"
Thu 28 Sep 2006         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 28 Jan 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 24 Jan 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\523d056929e13eacf8392044f602e53e\BIT3.tmp"
Fri  5 Oct 2007             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d03f71700772ecd1d20bacc33c473cd5\BIT16.tmp"
Sat 24 Jan 2009         5,940 A.SH. --- "C:\Documents and Settings\All Users\Documents\TV enregistr‚e\TempRec\TempSBE\SBE1.tmp"

[b]Finished!/b





Le rapport Hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:30:16, on 24/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O20 - Winlogon Notify: pmnlKBTl - C:\WINDOWS\
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe (file missing)
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

Il y a toujours une infection dans ton rapport, et je suis pratiquement certain que c'est une infection Bagle...

&#x25B6; Rends toi sur ce site : 
http://www.zonavirus.com/datos/descargas/95/elibagla.asp 
&#x25B6; tout en bas de cette page tu trouveras un outil 
à télécharger,clique sur "escargar Elibagla" (le numéro de version change au fur et à mesure des mises à jour) 
&#x25B6; installe ce fichier sur le Bureau. 
&#x25B6; ensuite double-clic sur Elibagla.exe 
&#x25B6; laisse la case "eliminar ficheros automaticamente" coché 
&#x25B6; clique sur"explorar" 
&#x25B6; laisse-le travailler 

&#x25B6; Redémarre en mode sans échec, 

*Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter. 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 

&#x25B6; relance 2 fois elibagla 

&#x25B6; redémarre en mode normal 

&#x25B6; poste le rapport final qui sera dans c:\infosat.txt 

ensuite refais un nouveau rapport hijackthis stp

Namyar123. · Answer

Voilà le rapport elibagla :


	  Sat Jan 24 22:47:21 2009
EliBagle v12.14  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Enero del 2009)
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sat Jan 24 22:47:29 2009
EliBagle v12.14  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Enero del 2009)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios:   12964
Nº Total de Ficheros:      120852
Nº de Ficheros Analizados: 18036
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Sat Jan 24 23:11:00 2009
EliBagle v12.14  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Enero del 2009)
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sat Jan 24 23:11:08 2009
EliBagle v12.14  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Enero del 2009)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios:   12962
Nº Total de Ficheros:      120846
Nº de Ficheros Analizados: 18036
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Sat Jan 24 23:31:33 2009
EliBagle v12.14  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Enero del 2009)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios:   12962
Nº Total de Ficheros:      120848
Nº de Ficheros Analizados: 18036
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

	  Sat Jan 24 23:39:28 2009
EliBagle v12.14  (c)2009 S.G.H. / Satinfo S.L. (Actualizado el 23 de Enero del 2009)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando "C:\"

Nº Total de Directorios:   210
Nº Total de Ficheros:      3999
Nº de Ficheros Analizados: 203
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0
Exploración Detenida por el Usuario.





Et le rapport hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:44:33, on 24/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O20 - Winlogon Notify: pmnlKBTl - C:\WINDOWS\
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe (file missing)
O23 - Service: McAfee Proxy Service (McProxy) - Unknown owner - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe (file missing)
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
O23 - Service: McAfee Personal Firewall Service (MpfService) - Unknown owner - C:\Program Files\McAfee\MPF\MPFSrv.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

* Dans la barre des tâches, cliquer sur Démarrer puis sur Exécuter.

* Taper Msconfig puis cliquer sur OK

* Cliquer sur l'onglet "Démarrage"

* Décocher la case anti_troj 

* Ensuite cliquer sur Appliquer ==> OK

* Et ensuite redémarre le PC et refais un nouveau rapport hijackthis pour vérifier stp

Namyar123. · Answer

Voilà le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:00:13, on 25/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O20 - Winlogon Notify: pmnlKBTl - C:\WINDOWS\
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

&#x25B6; Télécharge OTMoveIt3 (de Old_Timer) sur ton Bureau 
 
&#x25B6; Double-clique sur OTMoveIt.exe pour le lancer.

&#x25B6; Assure toi que la case Unregister Dll's and Ocx's soit bien cochée. 

&#x25B6; Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous "Paste instructions for item to be moved". 


:files
c:\windows\system32\anti_troj.exe

:reg
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"anti_troj"=-
 


&#x25B6; clique sur MoveIt! pour lancer la suppression. 

&#x25B6; Le résultat apparaitra dans le cadre "Results". 

&#x25B6; Clique sur Exit pour fermer. 

&#x25B6; Poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

&#x25B6; Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.


ensuite redémarre le pc et refais un nouveau rapport hijackthis stp

Namyar123. · Answer

Je peux remettre mon ordinateur en mode démarrage normal ou je dois le laisser en démarrage sélectif ?

Le rapport OTMoveit : 

========== FILES ==========
File/Folder c:\windows\system32\anti_troj.exe not found.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\anti_troj deleted successfully.
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01252009_001157


Le rapport hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:17:01, on 25/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O20 - Winlogon Notify: pmnlKBTl - C:\WINDOWS\
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

Tu peux remettre en mode normal...

As-tu redémarré le PC avant de refaire un nouveau rapport hijackthis ??

Namyar123. · Answer

Oui, je l'ai bien redemarré, quel est le souci ?

geoffrey5 · Answer

L'infection est toujours présente...

Fais ceci stp :

# ouvrir un dossier

# cliquer sur outils

# options des dossiers

# onglet affichage

# cocher la case "afficher les fichiers et dossiers cachés"

# cliquer sur "appliquer à tous les dossiers"

# Répondre par "oui" à la question posée et ensuite cliquer sur OK

Ensuite :

redémarre le PC en mode sans échec

Suis le chemin de ce fichier mis en gras et supprime-le stp :

C:\WINDOWS\system32\anti_troj.exe

Ensuite vide la corbeille, redémarre le PC en mode normal et refais un nouveau rapport hijackthis stp

Namyar123. · Answer

J'ai fait tout ça, mais le fichier n'y est pas. pour être sûr, j'ai fait une recherche sur le disque dur, et il n'y était pas non plus.

Je poste un nouveau rapport hijackthis, on sait jamais :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:43:06, on 25/01/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5700.0007)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla	fswctrl.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\DOCUME~1\FLIXPO~1\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla	fswshx.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla	fswctrl.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Ub4TrayApp] "C:\Program Files\Astase\UltraBackup\4.0\bin\ubtray.exe" /start
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe
O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ?
O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html
O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html
O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm
O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252
O20 - Winlogon Notify: pmnlKBTl - C:\WINDOWS\
O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

geoffrey5 · Answer

Bonjour,

&#x25B6; Copie le texte en gras ci-dessous : 

File:: 
c:\windows\system32\anti_troj.exe



Folder:: 


Registry:: 



&#x25B6; Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
&#x25B6; Sauvegarde ce fichier sous le nom de CFScript.txt. 

&#x25B6; Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous : 

http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif 

&#x25B6; Cela va relancer Combofix, 

&#x25B6; Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

&#x25B6; Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

&#x25B6; Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis. 

&#x25B6; S'il n'y a pas de rédémarrage, poste quand même les rapports.

Namyar123. · Answer

Bonjour. Voilà le rapport combofix : ComboFix 09-01-21.04 - Félix POMMIER 2009-01-25 15:56:27.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.2046.1459 [GMT 1:00] Lancé depuis: c:\documents and settings\Félix POMMIER\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\Félix POMMIER\Bureau\CFScript.txt AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) FW: ZoneAlarm Firewall *disabled* * Un nouveau point de restauration a été créé FILE :: c:\windows\system32\anti_troj.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\InfoSat.txt . ((((((((((((((((((((((((((((( Fichiers créés du 2008-12-25 au 2009-01-25 )))))))))))))))))))))))))))))))))))) . 2009-01-25 01:06 . 2009-01-25 16:02 503,840 --ahs---- c:\windows\system32\drivers\fidbox.dat 2009-01-25 01:06 . 2009-01-25 10:53 4,856 --ahs---- c:\windows\system32\drivers\fidbox.idx 2009-01-25 01:03 . 2009-01-25 01:03 d----c--- c:\documents and settings\All Users\Application Data\MailFrontier 2009-01-25 01:03 . 2009-01-25 01:04 4,212 ---h----- c:\windows\system32\zllictbl.dat 2009-01-25 01:02 . 2009-01-25 01:02 d-------- c:\program files\Zone Labs 2009-01-25 01:01 . 2009-01-25 10:10 d-------- c:\windows\Internet Logs 2009-01-25 00:11 . 2009-01-25 00:11 d----c--- C:\_OTMoveIt 2009-01-24 22:09 . 2009-01-24 22:09 579,584 --a------ c:\windows\system32\dllcache\user32.dll 2009-01-24 22:04 . 2009-01-24 22:04 d-------- c:\windows\ERUNT 2009-01-24 21:59 . 2009-01-24 22:26 d----c--- C:\SDFix 2009-01-24 20:46 . 2009-01-24 21:50 d----c--- C:\Lop SD 2009-01-24 10:04 . 2009-01-24 10:04 d-------- c:\documents and settings\Félix POMMIER\Application Data\Bull 2009-01-24 10:03 . 2009-01-24 10:24 d-------- c:\program files\RSS Xpress 2009-01-23 20:58 . 2009-01-23 20:58 d----c--- c:\documents and settings\All Users\Application Data\Apple 2009-01-23 20:58 . 2009-01-23 20:58 d----c--- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-01-22 22:47 . 2009-01-23 20:58 d-------- c:\program files\iTunes 2009-01-22 22:46 . 2009-01-23 20:58 d-------- c:\program files\Bonjour 2009-01-22 22:03 . 2009-01-23 20:58 d-------- c:\program files\Apple Software Update 2009-01-20 19:01 . 2009-01-20 19:01 d----c--- c:\documents and settings\All Users\Application Data\Electronic Arts 2009-01-20 18:20 . 2009-01-20 18:20 d-------- c:\windows\system32\AGEIA 2009-01-20 18:20 . 2009-01-20 18:20 d-------- c:\program files\AGEIA Technologies 2009-01-18 17:56 . 2008-04-13 20:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys 2009-01-18 17:56 . 2008-04-13 20:47 25,856 --a------ c:\windows\system32\dllcache\usbprint.sys 2009-01-18 17:55 . 2009-01-18 17:55 d--h-c--- C:\BJPrinter 2009-01-18 17:55 . 2004-06-15 06:00 116,736 --a------ c:\windows\system32\CNMLM61.DLL 2009-01-18 17:55 . 2004-06-04 16:34 86,016 -ra------ c:\windows\system32\CNMCP61.exe 2009-01-18 17:55 . 2004-06-15 06:00 7,680 --a------ c:\windows\system32\CNMVS61.DLL 2009-01-18 17:53 . 2009-01-18 17:57 d-------- c:\program files\Canon 2009-01-14 18:45 . 2005-11-25 21:57 905,216 --a------ c:\windows\system32\VSFilter.dll 2009-01-12 20:29 . 2009-01-12 20:29 d----c--- c:\documents and settings\All Users\Application Data\ALM 2009-01-12 20:19 . 2009-01-12 20:19 d-------- c:\program files\Adobe Media Player 2009-01-12 20:14 . 2009-01-12 20:14 d-------- c:\program files\Fichiers communs\Adobe AIR 2009-01-08 23:06 . 2009-01-08 23:06 d-------- c:\program files\NOS 2009-01-08 23:06 . 2009-01-08 23:06 d----c--- c:\documents and settings\All Users\Application Data\NOS 2009-01-07 19:48 . 2009-01-07 19:47 410,984 --a------ c:\windows\system32\deploytk.dll 2009-01-07 19:48 . 2009-01-07 19:47 73,728 --a------ c:\windows\system32\javacpl.cpl 2009-01-06 23:40 . 2009-01-24 16:39 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-06 23:40 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-01-06 23:40 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-01-06 23:21 . 2009-01-06 23:21 d-------- c:\program files\CCleaner 2009-01-06 23:09 . 2009-01-06 23:09 d----c--- c:\documents and settings\All Users\Application Data\Martau 2009-01-06 23:08 . 2009-01-08 21:28 d-------- c:\program files\Total Uninstall 5 2009-01-06 18:47 . 2009-01-06 18:47 d-------- c:\program files\Avira 2009-01-06 18:47 . 2009-01-06 18:47 d----c--- c:\documents and settings\All Users\Application Data\Avira 2009-01-05 21:42 . 2009-01-05 21:42 d-------- c:\documents and settings\Félix POMMIER\Application Data\Malwarebytes 2009-01-05 21:42 . 2009-01-05 21:42 d----c--- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-05 21:39 . 2009-01-05 21:39 d-------- c:\program files\Trend Micro 2009-01-05 20:34 . 2009-01-06 18:38 d-------- c:\program files\UsbFix 2009-01-05 16:18 . 2009-01-05 16:18 90,112 --a------ c:\windows\system32\QuickTimeVR.qtx 2009-01-05 16:18 . 2009-01-05 16:18 57,344 --a------ c:\windows\system32\QuickTime.qts . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-25 14:59 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\RssBandit 2009-01-24 14:58 --------- d-----w c:\program files\Alwil Software 2009-01-24 09:32 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-01-23 19:58 --------- d-----w c:\program files\QuickTime 2009-01-23 19:58 --------- d-----w c:\program files\Fichiers communs\Apple 2009-01-23 19:57 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-01-23 19:56 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\uTorrent 2009-01-22 21:47 --------- d-----w c:\program files\iPod 2009-01-22 18:26 --------- d-----w c:\program files\FlashGet 2009-01-22 18:26 --------- d-----w c:\program files\FileZilla 2009-01-22 18:26 --------- d-----w c:\program files\Dactylo 2009-01-22 18:26 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Vso 2009-01-22 17:58 --------- dc----w c:\documents and settings\All Users\Application Data\Ulead Systems 2009-01-22 17:58 --------- d--h--w c:\program files\InstallShield Installation Information 2009-01-22 17:58 --------- d-----w c:\program files\Ulead Systems 2009-01-22 17:58 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Ulead Systems 2009-01-22 17:56 --------- d-----w c:\program files\Fichiers communs\Ulead Systems 2009-01-22 17:46 --------- d-----w c:\program files\Creative 2009-01-22 17:42 --------- d-----w c:\program files\Fichiers communs\AVSMedia 2009-01-20 17:20 --------- d-----w c:\program files\Fichiers communs\Wise Installation Wizard 2009-01-12 19:24 --------- d-----w c:\program files\Fichiers communs\Adobe 2009-01-12 06:32 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Download Manager 2009-01-11 13:36 --------- d-----w c:\program files\RssBandit 2009-01-08 20:38 --------- d--h--w c:\program files\Creative Installation Information 2009-01-08 20:37 --------- d-----w c:\documents and settings\Félix POMMIER\Application Data\Creative 2009-01-07 18:54 --------- d-----w c:\program files\Java 2009-01-06 17:40 --------- d-----w c:\program files\DivX 2009-01-06 17:40 --------- d-----w c:\program files\Audible 2009-01-06 17:12 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore 2008-12-19 06:29 --------- d-----w c:\program files\Microsoft Silverlight 2008-12-19 06:18 --------- d-----w c:\program files\Fichiers communs\Creative 2008-12-14 21:07 --------- d-----w c:\program files\pspvideo9 2008-12-14 21:05 --------- d-----w c:\program files\WinAVI MP4 Converter 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys 2008-12-04 10:18 --------- d-----w c:\program files\Final Fantasy VII 2008-11-27 08:47 --------- d-----w c:\program files\Picasa2 2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2007-08-01 19:46 47,360 ----a-w c:\documents and settings\Félix POMMIER\Application Data\pcouffin.sys 2007-08-01 17:04 54 ----a-w c:\program files\inc1.bat 2007-08-01 17:04 41 ----a-w c:\program files\sleep.bat 2006-08-02 17:41 680 ----a-w c:\program files\mpc2.reg 2006-08-02 17:41 596 ----a-w c:\program files\mpc1.reg 2006-08-02 17:41 5,352 ----a-w c:\program files\mpc7.reg 2006-08-02 17:41 4,868 ----a-w c:\program files\mpc4.reg 2006-08-02 17:41 4,482 ----a-w c:\program files\satsukidecodersettings.ini 2006-08-02 17:41 30,302 ----a-w c:\program files\ffdsvsetts.reg 2006-08-02 17:41 3,072 ----a-w c:\program files\ffdssetts.reg 2006-08-02 17:41 3,026 ----a-w c:\program files\mpc3.reg 2006-08-02 17:41 18,168 ----a-w c:\program files\mpc6.reg 2006-08-02 17:41 16,882 ----a-w c:\program files\mpc5.reg 2006-08-02 17:41 1,172 ----a-w c:\program files\ffdsasetts.reg 2006-02-19 16:51 9,216 -c--a-w c:\program files\PERIODN.NDX 2006-02-19 16:51 9,216 -c--a-w c:\program files\OBJETBD.NDX 2006-02-19 16:51 8,192 -c--a-w c:\program files\AUTEUR.NDX 2006-02-19 16:51 7,168 -c--a-w c:\program files\PERIOD.NDX 2006-02-19 16:51 26,624 -c--a-w c:\program files\LIVRE.NDX 2006-02-19 16:51 12,288 -c--a-w c:\program files\SERIE.NDX 2006-02-19 16:51 10,240 -c--a-w c:\program files\EXLIB.NDX 2006-02-18 14:03 68 -c--a-w c:\program files\EPISODE.FIC 2006-02-18 14:02 68 -c--a-w c:\program files\COLLECT.FIC 2006-02-18 14:02 410 -c--a-w c:\program files\AUTEUR.FIC 2006-02-18 14:02 38 -c--a-w c:\program files\AUTSER.FIC 2006-02-18 14:02 38 -c--a-w c:\program files\AUTLIV.FIC 2006-02-18 14:02 26 -c--a-w c:\program files\ACTIVITE.FIC 2006-02-18 14:02 22 -c--a-w c:\program files\COTOB.FIC 2006-02-18 14:02 22 -c--a-w c:\program files\COTEX.FIC 2006-02-18 14:02 22 -c--a-w c:\program files\COTES.FIC 2006-02-18 14:02 128 -c--a-w c:\program files\AUTEUR.MMO 2006-01-28 19:52 251 -c--a-w c:\program files\wt3d.ini 2002-09-23 08:19 89,088 -c--a-w c:\program files\Gbdao.exe 2002-09-23 08:19 2,955,813 -c--a-w c:\program files\Gbdao.wdl 2001-11-01 09:19 1,003,520 -c--a-w c:\program files\cjpg.exe 2001-09-12 16:05 356,832 -c--a-w c:\program files\filigrane.bmp 2001-08-16 13:35 53,248 -c--a-w c:\program files\mySQL4WD.dll 2001-07-30 23:46 225,280 -c--a-w c:\program files\libmySQL.dll 1999-09-13 08:56 60,318 -c--a-w c:\program files\pasimg.bmp 1998-12-18 10:52 65,536 -c--a-w c:\program files\Wd553ndx.exe 1998-09-02 14:27 23,200 -c--a-w c:\program files\eztwain.dll 1998-08-31 23:00 326 -c--a-w c:\program files\Main5.cur 1998-08-23 18:36 63,488 -c--a-w c:\program files\eztw32.dll 2003-08-16 17:56 579,584 --sha-r c:\windows\system32\cd.exe 2005-11-06 11:49 184,618 --sha-r c:\windows\system32\patcher.exe . ((((((((((((((((((((((((((((( snapshot@2009-01-24_16.26.18.93 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2009-01-24 21:05:05 12,922,880 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0/u0000001\ntuser.dat + 2009-01-24 21:05:05 196,608 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0/u0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2009-01-24 21:04:45 12,922,880 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0/u0000001\ntuser.dat + 2009-01-24 21:04:45 196,608 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0/u0000002\UsrClass.dat - 2008-12-12 06:48:25 593,920 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\accicons.exe + 2009-01-25 00:21:25 593,920 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\accicons.exe - 2008-12-12 06:48:25 12,288 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2009-01-25 00:21:25 12,288 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2008-12-12 06:48:25 86,016 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\inficon.exe + 2009-01-25 00:21:25 86,016 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\inficon.exe - 2008-12-12 06:48:25 135,168 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\misc.exe + 2009-01-25 00:21:24 135,168 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\misc.exe - 2008-12-12 06:48:25 11,264 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\mspicons.exe + 2009-01-25 00:21:25 11,264 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\mspicons.exe - 2008-12-12 06:48:25 27,136 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\oisicon.exe + 2009-01-25 00:21:25 27,136 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\oisicon.exe - 2008-12-12 06:48:25 4,096 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe + 2009-01-25 00:21:25 4,096 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\opwicon.exe - 2008-12-12 06:48:25 794,624 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\outicon.exe + 2009-01-25 00:21:25 794,624 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\outicon.exe - 2008-12-12 06:48:25 249,856 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pptico.exe + 2009-01-25 00:21:25 249,856 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pptico.exe - 2008-12-12 06:48:25 61,440 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2009-01-25 00:21:24 61,440 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2008-12-12 06:48:25 23,040 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2009-01-25 00:21:25 23,040 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2008-12-12 06:48:25 286,720 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\wordicon.exe + 2009-01-25 00:21:24 286,720 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\wordicon.exe - 2008-12-12 06:48:25 409,600 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2009-01-25 00:21:24 409,600 ----a-r c:\windows\Installer\{9011040C-6000-11D3-8CFE-0150048383C9}\xlicons.exe + 2007-07-19 14:10:28 127,768 ----a-w c:\windows\system32\drivers\klif.sys + 2008-07-09 08:05:42 21,904 ----a-w c:\windows\system32\imsinstall_loc040c.dll + 2008-07-09 08:05:42 17,808 ----a-w c:\windows\system32\imslsp_install_loc040c.dll + 2008-07-09 08:05:08 796,048 ----a-w c:\windows\system32\libeay32_0.9.6l.dll - 2008-12-09 23:24:37 17,593,280 ----a-w c:\windows\system32\MRT.exe + 2009-01-10 01:35:28 20,853,704 ----a-w c:\windows\system32\MRT.exe + 2004-04-27 03:40:52 11,264 ----a-w c:\windows\system32\SpOrder.dll + 2008-07-09 08:05:10 83,432 ----a-w c:\windows\system32\vsdata.dll + 2008-07-09 08:05:22 394,952 ----a-w c:\windows\system32\vsdatant.sys + 2008-07-09 08:05:10 157,160 ----a-w c:\windows\system32\vsinit.dll + 2008-07-09 08:05:10 103,912 ----a-w c:\windows\system32\vsmonapi.dll + 2008-07-09 08:05:10 275,944 ----a-w c:\windows\system32\vspubapi.dll + 2008-07-09 08:05:10 71,144 ----a-w c:\windows\system32\vsregexp.dll + 2008-07-09 08:05:12 472,552 ----a-w c:\windows\system32\vsutil.dll + 2008-07-09 08:05:44 54,672 ----a-w c:\windows\system32\vsutil_loc040c.dll + 2008-07-09 08:05:12 46,568 ----a-w c:\windows\system32\vswmi.dll + 2008-07-09 08:05:12 99,816 ----a-w c:\windows\system32\vsxml.dll + 2008-07-09 08:05:12 83,432 ----a-w c:\windows\system32\zlcomm.dll + 2008-07-09 08:05:12 71,144 ----a-w c:\windows\system32\zlcommdb.dll + 2008-07-09 08:05:06 370,208 ----a-w c:\windows\system32\ZoneLabs\av.dll + 2008-07-09 08:05:36 26,000 ----a-w c:\windows\system32\ZoneLabs\av_loc040c.dll + 2007-05-30 23:03:30 65,248 ----a-w c:\windows\system32\ZoneLabs\avsys\bases\aphish.dat + 2006-06-30 13:47:36 21,568 ----a-w c:\windows\system32\ZoneLabs\avsys\bases\avcmhk4.dll + 2007-05-30 23:03:30 1,628 ----a-w c:\windows\system32\ZoneLabs\avsys\bases\pdmkl.dat + 2007-05-30 23:03:16 77,824 ----a-w c:\windows\system32\ZoneLabs\avsys\CKAHComm.dll + 2007-05-30 23:03:16 110,592 ----a-w c:\windows\system32\ZoneLabs\avsys\CKAHrule.dll + 2007-05-30 23:03:16 331,776 ----a-w c:\windows\system32\ZoneLabs\avsys\CKAHUM.dll + 2007-05-30 23:03:16 38,400 ----a-w c:\windows\system32\ZoneLabs\avsys\FSSync.dll + 2006-09-19 22:12:14 208,960 ----a-w c:\windows\system32\ZoneLabs\avsys\inv.dll + 2007-12-03 13:53:58 282,624 ----a-w c:\windows\system32\ZoneLabs\avsys\kave.dll + 2006-12-19 17:13:52 1,093,632 ----a-w c:\windows\system32\ZoneLabs\avsys\libeay32.dll + 2007-05-30 23:03:20 548,864 ----a-w c:\windows\system32\ZoneLabs\avsys\msvcp80.dll + 2007-05-30 23:03:20 626,688 ----a-w c:\windows\system32\ZoneLabs\avsys\msvcr80.dll + 2007-05-30 23:03:18 184,320 ----a-w c:\windows\system32\ZoneLabs\avsys\prloader.dll + 2007-05-30 23:03:22 90,112 ----a-w c:\windows\system32\ZoneLabs\avsys\prremote.dll + 2007-12-03 13:53:58 139,264 ----a-w c:\windows\system32\ZoneLabs\avsys\ScanningProcess.exe + 2006-12-19 17:13:52 200,704 ----a-w c:\windows\system32\ZoneLabs\avsys\ssleay32.dll + 2008-07-09 08:05:06 99,816 ----a-w c:\windows\system32\ZoneLabs\camupd.dll + 2008-07-09 08:05:36 17,808 ----a-w c:\windows\system32\ZoneLabs\camupd_loc040c.dll + 2004-01-30 11:35:08 813,568 ----a-w c:\windows\system32\ZoneLabs\dbghelp.dll + 2008-07-09 08:05:08 128,480 ----a-w c:\windows\system32\ZoneLabs\fbl.dll + 2008-07-09 08:05:08 38,376 ----a-w c:\windows\system32\ZoneLabs\featuremap.dll + 2008-07-09 08:05:08 321,016 ----a-w c:\windows\system32\ZoneLabs\imsecure.dll + 2008-07-09 08:05:42 26,000 ----a-w c:\windows\system32\ZoneLabs\imsecure_loc040c.dll + 2008-07-09 08:05:38 288,144 ----a-w c:\windows\system32\ZoneLabs\lib\ConfigWizard_loc040c.zip.dll + 2008-07-09 08:05:42 152,976 ----a-w c:\windows\system32\ZoneLabs\lib\LicenseUI_loc040c.zip.dll + 2008-07-09 08:05:24 26,000 ----a-w c:\windows\system32\ZoneLabs\lib\zlsvc.zip.dll + 2008-07-09 08:05:24 1,361,296 ----a-w c:\windows\system32\ZoneLabs\lib\zpy.zip.dll + 2008-07-09 08:05:24 71,056 ----a-w c:\windows\system32\ZoneLabs\lib\zui.zip.dll + 2008-07-09 08:06:26 30,184 ----a-w c:\windows\system32\ZoneLabs\plugins\rpc_server\rpc_server.dll + 2008-07-09 08:06:26 30,216 ----a-w c:\windows\system32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll + 2008-02-27 02:10:26 714,208 ----a-w c:\windows\system32\ZoneLabs\qrbase.dll + 2008-02-27 02:10:28 792,032 ----a-w c:\windows\system32\ZoneLabs\qrsrecl.dll + 2008-07-09 08:05:08 173,544 ----a-w c:\windows\system32\ZoneLabs\scheduler.dll + 2008-07-09 08:05:44 17,808 ----a-w c:\windows\system32\ZoneLabs\scheduler_loc040c.dll + 2008-01-21 07:34:36 7,603,688 ----a-w c:\windows\system32\ZoneLabs\spyware.dat + 2008-02-27 02:10:32 1,504,736 ----a-w c:\windows\system32\ZoneLabs\srescan.dll + 2008-02-27 02:10:44 51,176 ----a-w c:\windows\system32\ZoneLabs\srescan.sys + 2008-07-09 08:05:10 456,168 ----a-w c:\windows\system32\ZoneLabs\ssleay32.dll + 2008-07-09 08:06:26 214,528 ----a-w c:\windows\system32\ZoneLabs\streamapi\httpblocker\httpblocker.dll + 2008-07-09 08:06:30 3,266,040 ----a-w c:\windows\system32\ZoneLabs\streamapi\imslsp\imslsp.dll + 2008-07-09 08:05:42 26,000 ----a-w c:\windows\system32\ZoneLabs\streamapi\imslsp\imslsp_loc040c.dll + 2006-09-04 19:59:14 503,875 ----a-w c:\windows\system32\ZoneLabs\upd_core.dll + 2007-10-11 15:50:32 832,984 ----a-w c:\windows\system32\ZoneLabs\updating.dll + 2008-07-09 08:05:18 144,936 ----a-w c:\windows\system32\ZoneLabs\updclient.exe + 2008-07-09 08:05:44 75,152 ----a-w c:\windows\system32\ZoneLabs\updClient_loc040c.dll + 2007-01-11 16:31:06 286,787 ----a-w c:\windows\system32\ZoneLabs\updtrsdk.dll + 2008-07-09 08:05:10 108,008 ----a-w c:\windows\system32\ZoneLabs\vsavpro.dll + 2008-07-09 08:05:10 83,432 ----a-w c:\windows\system32\ZoneLabs\vsdb.dll + 2008-07-09 08:05:44 17,808 ----a-w c:\windows\system32\ZoneLabs\vsdb_loc040c.dll + 2008-07-09 08:05:18 75,304 ----a-w c:\windows\system32\ZoneLabs\vsmon.exe + 2008-07-09 08:05:44 46,480 ----a-w c:\windows\system32\ZoneLabs\vsmon_loc040c.dll + 2008-07-09 08:05:10 2,029,032 ----a-w c:\windows\system32\ZoneLabs\vsmondll.dll + 2008-07-09 08:05:12 1,361,384 ----a-w c:\windows\system32\ZoneLabs\vsruledb.dll + 2008-07-09 08:05:44 198,032 ----a-w c:\windows\system32\ZoneLabs\vsruledb_loc040c.dll + 2008-07-09 08:05:12 239,080 ----a-w c:\windows\system32\ZoneLabs\vsvault.dll + 2008-07-09 08:05:44 17,808 ----a-w c:\windows\system32\ZoneLabs\vsvault_loc040c.dll + 2008-01-21 07:34:36 7,603,688 ----a-w c:\windows\system32\ZoneLabs\zlasdbup.dat + 2008-07-09 08:05:12 177,640 ----a-w c:\windows\system32\ZoneLabs\zlparser.dll + 2008-07-09 08:05:12 79,344 ----a-w c:\windows\system32\ZoneLabs\zlquarantine.dll + 2008-07-09 08:05:44 17,808 ----a-w c:\windows\system32\ZoneLabs\zlquarantine_loc040c.dll + 2008-07-09 08:05:14 382,440 ----a-w c:\windows\system32\ZoneLabs\zlsre.dll + 2008-07-09 08:05:44 21,904 ----a-w c:\windows\system32\ZoneLabs\zlsre_loc040c.dll + 2008-07-09 08:05:14 120,296 ----a-w c:\windows\system32\ZoneLabs\zlupdate.dll + 2008-07-09 08:05:16 1,086,952 ----a-w c:\windows\system32\zpeng24.dll + 2009-01-25 14:42:27 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_2cc.dat + 2008-07-09 08:05:20 75,248 ----a-w c:\windows\zllsputility.exe + 2008-07-09 08:05:44 42,384 ----a-w c:\windows\zllsputility_loc040c.dll . -- Instantané actualisé -- . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "Wallpaper"="c:\program files\Wallpaper\Wallpaper.exe" [2007-08-21 233472] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296] "SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 c:\windows\MIDIDEF.EXE] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "UVS10 Preload"="c:\program files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe" [2006-03-07 36864] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "AdobeCS4ServiceManager"="c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112] "ISUSScheduler"="c:\program files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 81920] "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584] "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248] "dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941] "CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 57344] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 c:\windows\stsystra.exe] "MBMon"="CTMBHA.DLL" [2005-05-19 c:\windows\system32\CTMBHA.DLL] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.lnk - c:\program files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-01-27 110592] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnlKBTl] [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.I420"= i420vfw.dll "msacm.l3codec"= l3codecp.acm "VIDC.VP40"= vp4vfw.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "iPodService"=3 (0x3) "Creative Service for CDROM Access"=2 (0x2) "AOL ACS"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Messenger\msmsgs.exe"= "c:\Program Files\eMule\eMule.exe"= "c:\Program Files\uTorrent\utorrent.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Windows Live\Messenger\livecall.exe"= "c:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe"= "c:\Program Files\Bonjour\mDNSResponder.exe"= "c:\Program Files\iTunes\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 "1700:TCP"= 1700:TCP:MioNet Remote Drive Access "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification "5353:TCP"= 5353:TCP:Adobe CSI CS4 S1 intel5;INTEL processor extention;\??\c:\windows\system32\intel5.sys --> c:\windows\system32\intel5.sys [?] S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-01-08 33752] . Contenu du dossier 'Tâches planifiées' 2009-01-22 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] 2006-01-22 c:\windows\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job - c:\windows\system32\OOBE\oobebaln.exe [2008-04-14 03:34] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{4B52C38B-0DA7-412F-89B0-67BBC63D91A8} - (no file) BHO-{c74a37b6-2c64-4c58-9272-ecd1ec25ac21} - (no file) . ------- Examen supplémentaire ------- . uStart Page = hxxp://google.fr/ uInternet Settings,ProxyOverride = *.local IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.05\AMVConverter\grab.html IE: Download Video on This Page - c:\program files\Tomato\YouTube Video Downloader\IEPage.html IE: Download Video This Links To - c:\program files\Tomato\YouTube Video Downloader\IELink.html IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 IE: Easy-WebPrint Ajouter à la liste d'impressions - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html IE: Easy-WebPrint Impression rapide - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html IE: Easy-WebPrint Imprimer - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html IE: Easy-WebPrint Prévisualiser - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.05\MediaManager\grab.html IE: S'abonner avec l'agrégateur par défaut - c:\documents and settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm IE: {{11F19C45-9675-488A-A8E0-8E8234DC245D} - c:\program files\Tomato\YouTube Video Downloader\IEPage.html Trusted Zone: internet Trusted Zone: mcafee.com TCP: {D876E30A-A71F-4C3F-A6A4-E440C94F5729} = 212.27.53.252,212.27.54.252 DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.zebulon.fr/scan8/oscan8.cab FF - ProfilePath - c:\documents and settings\Félix POMMIER\Application Data\Mozilla\Firefox\Profiles\4v4o4b9j.default\ FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/ FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npyaxmpb.dll FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll ---- PARAMETRES FIREFOX ---- FF - user.js: general.useragent.extra.zencast - . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-25 16:01:57 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- CLES DE REGISTRE BLOQUEES --------------------- [HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{DCFA1E9C-CCF0-C36D-C10E-CCCFB8B5C25C}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "pafcfobnbhinojbaenpkcpodjdggnjbk"=hex:6a,61,62,6a,6a,6e,63,67,6a,68,64,62,69, 63,66,6c,61,6e,6c,6e,00,ee "oalpomjgfmjjhcefhaaadcnngfmgnm"=hex:6a,61,62,6a,6c,69,69,66,64,6e,62,62,67,70, 64,67,69,61,62,67,00,e9 [HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Zepter Software\RegLib*e4ef0cfd\AnyDVD/1] "1"=dword:447066af "2"=dword:4470673c [HKEY_USERS\S-1-5-21-3867895429-1360710054-767803533-1005\Software\Zepter Software\RegLib*e4ef0cfd\CloneDVDmobile/1] "1"=dword:44706403 "2"=dword:44bf45e4 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{3B85D734-4D1E-A5B8-7A2C9FEBD20E3A7C}\{9B78C2B1-5ACD-EEEE-C2C08A9F5ADC5CE8}\{497F871A-1051-F8C7-F54470C03EAE9AE4}*] "{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,34,ce,39, 8f,a1,8c,ed,25,29,79,d3,90,4f,6f,9b,78,dd,5f,6e,60,17,5b,31,35,61,ed,4b,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,c5,ef,5c,00,b7, 0c,4e,6d,e2,63,26,f1,3f,c8,ff,68,47,9c,0b,88,ed,41,37,61,e2,63,26,f1,3f,c8,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5B0B6C35-3AEA-9EAE-179EBB09B20EA2F1}\{75565C86-DCE5-4077-B0F3502E93E7104E}\{6B409343-0D15-4A1C-46DBD99A1375331F}*] "{3EE4C831-B7E0-4ed1-B9FC-EDC523C9612F}1"=hex:01,00,01,00,0c,00,00,00,34,ce,39, 8f,a1,8c,ed,25,29,79,d3,90,4f,6f,9b,78,dd,5f,6e,60,17,5b,31,35,61,ed,4b,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{5BE3D010-3EF3-EA3A-19EA72F7729702DF}\{352FFD75-9B70-D323-D2F13A6467AA3E3D}\{81CD47E4-7EF3-579C-2C259DBE42414B54}*] "NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04, de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,c0,c1,a1,4a,11, 22,ea,21,6a,9c,d6,61,af,45,84,18,13,55,92,c2,79,7e,3f,99,6a,9c,d6,61,af,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,f7,ce,ec,4c,54, 5e,fe,07,ff,7c,85,e0,43,d4,0e,fe,97,86,58,47,98,75,c0,e7,ff,7c,85,e0,43,d4,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "2582ae41fb52324423be06337561aa48"=hex:3e,1e,9e,e0,57,5a,93,61,bf,a3,0e,38,50, 0f,d1,a5,86,8c,21,01,be,91,eb,e7,67,12,2e,e3,a7,65,6a,79,86,8c,21,01,be,91,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,59,b4,2b,01,ed, ab,b0,f2,f5,1d,4d,73,a8,13,5c,05,0c,02,c2,73,17,6e,65,c7,f5,1d,4d,73,a8,13,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,f2,20,8d,41,56, 36,0b,77,df,20,58,62,78,6b,cf,c8,21,ad,7b,0a,78,15,1b,89,df,20,58,62,78,6b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,fb,0d,ed,71,ee, be,a6,07,fb,a7,78,e6,12,2f,9a,ea,06,81,26,cf,3e,c9,79,fe,fb,a7,78,e6,12,2f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,d1,d9,47,51,80, ef,70,4b,01,3a,48,fc,e8,04,4a,f1,4b,04,47,f6,2e,02,2d,17,01,3a,48,fc,e8,04,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,c0,4e,b6,83,7b, a4,2b,0f,f6,0f,4e,58,98,5b,89,c9,9f,1b,b5,09,5b,27,db,65,f6,0f,4e,58,98,5b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "f5f62a6129303efb32fbe080bb27835b"=hex:37,a4,aa,c3,a6,15,56,0a,d8,92,3b,cf,8e, bb,83,5b,3d,ce,ea,26,2d,45,aa,78,7e,01,45,58,4d,9c,d5,22,3d,ce,ea,26,2d,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F71B406A-64B6-7890-A4E79C228CB5B5C7}\{B2D97AB2-1AAA-0E19-47D2DF75F80031A6}\{B1F98325-4C85-36BE-448BCE0A416EDA34}*] "NRDFOBLVNAUE2QOGEQXAH1Y2DD1"=hex:01,00,01,00,00,00,00,00,b0,0a,ac,41,7a,16,04, de,35,81,92,71,e8,29,5a,84,14,35,16,70,d8,6e,ff,61 [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,6c,ff,2b,c7,a3, 27,53,1c,2a,b7,cc,b5,b9,7f,41,e7,8e,52,a4,d2,50,b9,66,94,2a,b7,cc,b5,b9,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\WINDOWS\system32\OLE32.DLL" "8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,4a,cc,ef,97,47, 4f,56,ba,6c,43,2d,1e,aa,22,2f,9c,17,c0,5b,cc,06,93,5c,61,6c,43,2d,1e,aa,22,\ [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•9~*] "C040110900063D11C8EF10054038389C"="C?\WINDOWS\system32\FM20ENU.DLL" . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(776) c:\program files\Fichiers communs\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll . Heure de fin: 2009-01-25 16:04:56 ComboFix-quarantined-files.txt 2009-01-25 15:04:52 ComboFix2.txt 2009-01-24 15:27:35 Avant-CF: 69 706 002 432 octets libres Après-CF: 69,795,524,608 octets libres 493 --- E O F --- 2009-01-25 09:53:10 Et le rapport hijackthis : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:06:28, on 25/01/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5700.0007) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\stsystra.exe C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\TechSmith\SnagIt 8\TSCHelp.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\RssBandit\RSSBandit.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [UVS10 Preload] C:\Program Files\Ulead Systems\Ulead VideoStudio 10\uvPL.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [anti_troj] C:\WINDOWS\system32\anti_troj.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [Wallpaper] "C:\Program Files\Wallpaper\Wallpaper.exe" Starter O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user') O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: AOL 9.0 Icône AOL.lnk = C:\Program Files\AOL 9.0\aoltray.exe O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ? O4 - Global Startup: SnagIt 8.lnk = C:\Program Files\TechSmith\SnagIt 8\SnagIt32.exe O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.05\AMVConverter\grab.html O8 - Extra context menu item: Download Video on This Page - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html O8 - Extra context menu item: Download Video This Links To - C:\Program Files\Tomato\YouTube Video Downloader\IELink.html O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.05\MediaManager\grab.html O8 - Extra context menu item: S'abonner avec l'agrégateur par défaut - C:\Documents and Settings\Félix POMMIER\Application Data\RssBandit\iecontext_subscribefeed.htm O9 - Extra button: Download Video - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html O9 - Extra 'Tools' menuitem: Download Video on This Page - {11F19C45-9675-488A-A8E0-8E8234DC245D} - C:\Program Files\Tomato\YouTube Video Downloader\IEPage.html O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-24-0.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.zebulon.fr/scan8/oscan8.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/... O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{D876E30A-A71F-4C3F-A6A4-E440C94F5729}: NameServer = 212.27.53.252,212.27.54.252 O20 - Winlogon Notify: pmnlKBTl - C:\WINDOWS\ O22 - SharedTaskScheduler: IE Component Categories cache daemon - {553858A7-4922-4e7e-B1C1-97140C1C16EF} - C:\WINDOWS\system32\ieframe.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Fenêtres publicitaires intempestives

32 réponses

Votre réponse

Discussions similaires

Newsletters