infecté par virus Win32/Heur

Question

Bonjour,

j'ai un problème depuis quelques jours avec un virus qu'a détecté mon anti-virus (AVG Free 8.5.375). Il s'appelle Win 32/Heur et m'empêche de mettre à jour AVG, et depuis hier, plusieurs troyens ont été détectés! Ca devient donc très urgent!! Je vous remercie de bien vouloir me filer un coup de main pour remettre tout ça en ordre.

Narco!4 · Answer

Bonjour,

télécharge GenProc http://www.genproc.com/GenProc.exe

double-clique sur GenProc.exe et poste le contenu du rapport qui s'ouvre

alexby · Answer

Voici le rapport:

Rapport GenProc 2.606 [1] - 20/07/2009 à 20:47:36 
@ Windows XP Service Pack 3 - Mode normal
@ Mozilla Firefox (3.0.11) [Navigateur par défaut]

# Etape 1/ Télécharge :
 
- CCleaner https://www.ccleaner.com/ccleaner/download (FileHippo). Ce logiciel va permettre de supprimer tous les fichiers temporaires. Lance-le et clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. Ferme le programme.

- Toolbar-S&D https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 (Team IDN) sur ton Bureau.

- USBFix http://sd-1.archive-host.com/membres/up/127028005715545653/UsbFix.exe (Chiquitine29) sur le Bureau, et procède simplement à son installation.


 Redémarre en mode sans échec comme indiqué ici https://www.wekyo.com/demarrer-le-pc-en-mode-sans-echec-windows-7-et-8/  ; Choisis ta session courante *** Alexis *** (pour retrouver le rapport, clique sur le raccourci "Rapport GenProc[1]" sur ton bureau).


# Etape 2/ 

 Lance Toolbar-S&D situé sur le Bureau.
 Tape sur "2" puis valide en appuyant sur "Entrée". Ne ferme pas la fenêtre lors de la suppression.

# Etape 3/ 

 Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) susceptibles d'avoir été infectées sans les ouvrir, puis double-clique sur le raccourci USBFix présent sur ton Bureau : choisis l' option 2 (Suppression), ton bureau disparaitra et le pc redémarrera. Au redémarrage, USBFix scannera ton pc, laisse travailler l'outil.

# Etape 4/ 

 Lance CCleaner : "Nettoyeur"/"lancer le nettoyage" et c'est tout.

# Etape 5/ 

 Redémarre normalement et poste, dans la même réponse : 

- Le contenu du rapport TB.txt situé dans C:\ ; 
- Le contenu du rapport UsbFix.txt situé dans C:\ ; 
- Un nouveau rapport HijackThis http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ;
- Un nouveau rapport GenProc ;

 Précise les difficultés que tu as eu (ce que tu n'as pas pu faire...) ainsi que l'évolution de la situation.

~~ Arguments de la procédure ~~


# Détections [1] GenProc 2.606 20/07/2009 à 20:47:57 
Toolbar:le 20/07/2009 à 20:48:24 "C:\Documents and Settings\Alexis\Application Data\Search Settings" 
USBFix:le 20/07/2009 à 20:48:44 "C:\WINDOWS\antiv.exe" 

----------------------------------------------------------------------
Sites officiels GenProc : www.alt-shift-return.org et www.genproc.com
----------------------------------------------------------------------

~~ Fin à 20:49:51 ~~

Narco!4 · Answer

suit ces manips

alexby · Answer

voici le rapport TB:


   -----------\  ToolBar S&D 1.2.8   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 Mobile Technology MK-36 )
   BIOS : Ver 1.00PARTTBL
   USER : Alexis ( Administrator )
   BOOT : Fail-safe boot
   Antivirus : AVG Anti-Virus Free 8.5 (Activated)
   C:\ (Local Disk) - FAT32 - Total:53 Go (Free:29 Go)
   D:\ (Local Disk) - FAT32 - Total:53 Go (Free:25 Go)
   E:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 )
   Option : [2] ( 22/07/2009|20:50 )

   -----------\ SUPPRESSION

   Supprime! - C:\WINDOWS\Prefetch\SEARCHSETTINGS.EXE-30C88223.pf
   Supprime! - C:\Program Files\Mozilla Firefox\extensions\search@searchsettings.com
   Supprime! - C:\DOCUME~1\ALEXIS\APPLIC~1\Search Settings\kb128
   Supprime! - C:\DOCUME~1\ALEXIS\APPLIC~1\Search Settings

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  Extensions

   (All Users) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar

   (Alexis) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Start Page"="https://fr.yahoo.com/"
   "Search Page"="http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/"
   "SearchMigratedDefaultURL"="https://search.yahoo.com/web{searchTerms}&ei=utf-8&fr=b1ie7"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\ALEXIS\Mes documents\Ma musique\iTunes Music\Passi\MA 6-T VA CRACK-ER
   C:\DOCUME~1\ALEXIS\Mes documents\Ma musique\iTunes Music\Passi\MA 6-T VA CRACK-ER\Les flammes du mal.mp3



   1 - "C:\ToolBar SD\TB_1.txt" - 22/07/2009|20:52 - Option : [2]

   -----------\  Fin du rapport a 20:52:18,42


J'ai formaté la carte SD par laquelle j'ai été infecté, je n'ai donc pas fait l'étape 3.

Voici le rapport HIJACKTHIS:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:31:05, on 22/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 2
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\Alexis\LOCALS~1\Temp\olhrwef.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O24 - Desktop Component 0: (no name) - C:\Documents and Settings\Alexis\Mes documents\Mes images	ruc de ouf.bmp
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\Alexis\Mes documents\Mes images\fleur.bmp

Narco!4 · Answer

la manip genproc.

alexby · Answer

Voici le rapport UsbFix:


############################## | UsbFix V6.009 |

# User : Alexis (Administrateurs) # ACER-318DE0055E
# Update on 20/07/09 by Chiquitine29 & C_XX
# Start at: 20:01:26 | 23/07/2009
# Website : http://pagesperso-orange.fr/NosTools/index.html

# AMD Turion(tm) 64 Mobile Technology MK-36
# Microsoft Windows XP Édition familiale (5.1.2600 32-bit) # Service Pack 3
# Internet Explorer 7.0.5730.13
# Windows Firewall Status : Enabled
# AV : AVG Anti-Virus Free 8.5 [ Enabled | (!) Outdated ]

# C:\ # Disque fixe local # 53,2 Go (29,39 Go free) [ACER] # FAT32
# D:\ # Disque fixe local # 53,69 Go (25,28 Go free) [ACERDATA] # FAT32
# E:\ # Disque CD-ROM
# F:\ # Disque fixe local # 335,27 Go (162,61 Go free) [IOMEGA_HDD] # FAT32

############################## | Processus actifs |

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe

################## | Fichiers # Dossiers infectieux |

Supprimé ! C:\WINDOWS\antiv.exe  
Supprimé ! C:\WINDOWS\system32\olhrwef.exe  
Supprimé ! C:\DOCUME~1\Alexis\LOCALS~1\Temp
mdfgds0.dll  

################## | C:\Documents and Settings\Alexis\Temporary Internet Files |


################## | All Drives ... |

C:\autorun.inf # -> fichier appelé  : "C:\xmcckw.bat" ( Absent ! )  
Supprimé ! C:\autorun.inf    
D:\autorun.inf # -> fichier appelé  : "D:\xmcckw.bat" ( Absent ! )  
Supprimé ! D:\autorun.inf    

################## | Registre # Clés Run infectieuses |

Supprimé ! HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "cdoosoft"    
Supprimé ! HKLM\SYSTEM\CurrentControlSet\Services\AVPsys    
Supprimé ! HKLM\SYSTEM\ControlSet002\Services\AVPsys    

################## | Registre # Mountpoints2 |

Supprimé ! HKCU\...\Explorer\MountPoints2\C\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\D\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{16c5acc0-4939-11dd-ad55-0016cf5bb2d3}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{57c2b734-1875-11de-ae1a-0016cf5bb2d3}\Shell\AutoRun\Command  
Supprimé ! HKCU\...\Explorer\MountPoints2\{6ee65778-13ac-11dd-acec-0016d4530549}\Shell\AutoRun\Command  

################## | Listing des fichiers présent |

[?|?|?] - C:\hiberfil.sys
[22/07/2009 20:52|--a------|2283] - C:\TB.txt
[05/08/2004 05:00|-rahs----|4952] - C:\Bootfont.bin
[27/05/2008 18:53|-rahs----|252240] - C:
tldr
[05/08/2004 05:00|-rahs----|47564] - C:\NTDETECT.COM
[23/05/2006 16:29|--a------|0] - C:\CONFIG.SYS
[23/05/2006 17:00|--a------|50] - C:\AUTOEXEC.BAT
[23/05/2006 16:29|-rahs----|0] - C:\IO.SYS
[23/05/2006 16:29|-rahs----|0] - C:\MSDOS.SYS
[12/04/2008 19:04|--a------|559] - C:\RHDSetup.log
[24/05/2006 11:33|--a------|75] - C:\Preload.aaa
[11/11/1999 00:17|--a------|49] - C:\XPH.TAG
[23/07/2009 20:03|--a------|4280] - C:\UsbFix.txt
[?|?|?] - C:\pagefile.sys
[24/02/2009 22:50|--ah-----|244] - C:\sqmnoopt00.sqm
[26/09/2008 08:58|--ah-----|244] - C:\sqmnoopt01.sqm
[26/09/2008 08:58|--ah-----|232] - C:\sqmdata01.sqm
[16/04/2008 11:07|--ahs----|115343872] - C:\eDS_PSD_drive.vmdf
[26/09/2008 09:49|--ah-----|244] - C:\sqmnoopt02.sqm
[26/09/2008 09:49|--ah-----|232] - C:\sqmdata02.sqm
[26/09/2008 22:58|--ah-----|244] - C:\sqmnoopt03.sqm
[26/09/2008 22:58|--ah-----|232] - C:\sqmdata03.sqm
[27/09/2008 09:22|--ah-----|244] - C:\sqmnoopt04.sqm
[27/09/2008 09:22|--ah-----|232] - C:\sqmdata04.sqm
[27/09/2008 11:50|--ah-----|244] - C:\sqmnoopt05.sqm
[27/09/2008 11:50|--ah-----|232] - C:\sqmdata05.sqm
[13/10/2008 14:20|--ah-----|244] - C:\sqmnoopt06.sqm
[13/10/2008 14:20|--ah-----|232] - C:\sqmdata06.sqm
[14/10/2008 18:28|--ah-----|244] - C:\sqmnoopt07.sqm
[14/10/2008 18:28|--ah-----|232] - C:\sqmdata07.sqm
[30/06/2008 23:20|-r-hs----|228] - C:\boot.ini
[15/10/2008 20:57|--ah-----|244] - C:\sqmnoopt08.sqm
[15/10/2008 20:57|--ah-----|232] - C:\sqmdata08.sqm
[16/10/2008 16:46|--ah-----|244] - C:\sqmnoopt09.sqm
[16/10/2008 16:46|--ah-----|232] - C:\sqmdata09.sqm
[16/10/2008 18:25|--ah-----|244] - C:\sqmnoopt10.sqm
[16/10/2008 18:25|--ah-----|232] - C:\sqmdata10.sqm
[20/10/2008 11:33|--ah-----|244] - C:\sqmnoopt11.sqm
[20/10/2008 11:33|--ah-----|232] - C:\sqmdata11.sqm
[21/10/2008 22:04|--ah-----|244] - C:\sqmnoopt12.sqm
[21/10/2008 22:04|--ah-----|232] - C:\sqmdata12.sqm
[22/10/2008 11:38|--ah-----|244] - C:\sqmnoopt13.sqm
[22/10/2008 11:38|--ah-----|232] - C:\sqmdata13.sqm
[24/10/2008 19:35|--ah-----|244] - C:\sqmnoopt14.sqm
[24/10/2008 19:35|--ah-----|232] - C:\sqmdata14.sqm
[12/12/2008 18:02|--ah-----|244] - C:\sqmnoopt15.sqm
[12/12/2008 18:02|--ah-----|232] - C:\sqmdata15.sqm
[15/12/2008 21:38|--ah-----|244] - C:\sqmnoopt16.sqm
[15/12/2008 21:38|--ah-----|232] - C:\sqmdata16.sqm
[16/12/2008 18:56|--ah-----|244] - C:\sqmnoopt17.sqm
[16/12/2008 18:56|--ah-----|232] - C:\sqmdata17.sqm
[16/12/2008 21:52|--ah-----|244] - C:\sqmnoopt18.sqm
[16/12/2008 21:52|--ah-----|232] - C:\sqmdata18.sqm
[10/02/2009 18:11|--ah-----|244] - C:\sqmnoopt19.sqm
[10/02/2009 18:11|--ah-----|232] - C:\sqmdata19.sqm
[16/10/2008 16:44|--a------|3809] - C:estlog.txt
[06/11/2008 20:09|--a------|510] - C:\updatedatfix.log
[13/04/2008 19:34|--a------|28672] - D:\setupSNK.exe
[08/11/2008 23:40|--ahs----|142336] - F:\Thumbs.db

################## | Vaccination |

# C:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# D:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  
# F:\autorun.inf ( # Not infected ) -> Folder created by UsbFix.  

################## | Etat / Services / Informations |


################## | PEH ... |


################## | Cracks / Keygens / Serials |


################## | ! Fin du rapport # UsbFix V6.009 ! |

Voici le nouveau rapport HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:35:05, on 23/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Acer\Acer Arcade\PCMService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ycomp/defaults/su/*https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
R3 - URLSearchHook: (no name) - *{EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: pdfforge Toolbar - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\WidgiToolbarIE.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Acer\Acer Arcade\PCMService.exe"
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 1
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] c:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/MSNPUpld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\Acer\Acer Arcade\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\Acer\Acer Arcade\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O24 - Desktop Component 0: (no name) - C:\Documents and Settings\Alexis\Mes documents\Mes images	ruc de ouf.bmp
O24 - Desktop Component 1: (no name) - C:\Documents and Settings\Alexis\Mes documents\Mes images\fleur.bmp

Narco!4 · Answer

ok

alexby · Answer

Le rapport TCleaner:

[ Rapport ToolsCleaner version 2.3.7 (par A.Rothstein & dj QUIOU) ]

--> Recherche: 

C:\TB.txt: trouvé !
C:\UsbFix.txt: trouvé !
C:\GenProc: trouvé !
C:\Toolbar SD: trouvé !
C:\UsbFix: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Alexis\Menu Démarrer\Programmes\UsbFix: trouvé !
C:\Documents and Settings\Alexis\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: trouvé !
C:\Documents and Settings\Alexis\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Alexis\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Alexis\Bureau\ToolBarSD.exe: trouvé !
C:\Documents and Settings\Alexis\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Alexis\Bureau\TB.txt: trouvé !
C:\Documents and Settings\Alexis\Bureau\UsbFix.exe: trouvé !
C:\Documents and Settings\Alexis\Bureau\UsbFix.txt: trouvé !
C:\Documents and Settings\Alexis\Bureau\UsbFix.lnk: trouvé !
C:\Documents and Settings\Alexis\Recent\HijackThis.lnk: trouvé !
C:\Documents and Settings\Alexis\Recent\UsbFix.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !
C:\GenProc\outil\hijackthis.log: trouvé !
C:\GenProc\outil\mbr.exe: trouvé !
C:\GenProc\Page\GenProc[*].html: trouvé !

---------------------------------
--> Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Alexis\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Alexis\Bureau\HJTInstall.exe: supprimé !
C:\Documents and Settings\Alexis\Bureau\ToolBarSD.exe: supprimé !
C:\Documents and Settings\Alexis\Recent\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\TB.txt: supprimé !
C:\UsbFix.txt: supprimé !
C:\Documents and Settings\Alexis\Menu Démarrer\Programmes\UsbFix\UsbFix.lnk: supprimé !
C:\Documents and Settings\Alexis\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Alexis\Bureau\TB.txt: supprimé !
C:\Documents and Settings\Alexis\Bureau\UsbFix.exe: supprimé !
C:\Documents and Settings\Alexis\Bureau\UsbFix.txt: supprimé !
C:\Documents and Settings\Alexis\Bureau\UsbFix.lnk: supprimé !
C:\Documents and Settings\Alexis\Recent\UsbFix.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\GenProc\outil\hijackthis.log: supprimé !
C:\GenProc\outil\mbr.exe: supprimé !
C:\GenProc\Page\GenProc[*].html: ERREUR DE SUPPRESSION !!
C:\GenProc: supprimé !
C:\Toolbar SD: supprimé !
C:\UsbFix: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\Alexis\Menu Démarrer\Programmes\UsbFix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Le rapport Nod32:

ESETSmartInstaller@High as downloader log:
all ok
# version=6
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.5886
# api_version=3.0.2
# EOSSerial=08e817b8ba71514b83a4e45bc841c50c
# end=finished
# remove_checked=true
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2009-07-23 10:16:59
# local_time=2009-07-24 12:16:59 (+0100, Paris, Madrid)
# country="France"
# lang=1036
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=1026 25 66 97 27022736875000
# scanned=114868
# found=52
# cleaned=52
# scan_time=11453
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034883.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034884.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034911.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034912.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034944.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034945.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034970.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034971.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035008.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035009.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035035.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035036.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035058.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035059.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0035138.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0035139.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036212.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036213.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036236.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036237.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036265.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036266.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036293.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036294.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036674.exe	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036675.INF	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034885.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034886.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034913.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034914.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034946.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034947.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034972.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0034973.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035010.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035011.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035037.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035038.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035061.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP146\A0035062.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0035140.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0035141.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036214.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036215.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036238.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036239.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036267.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036268.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036295.bat	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036296.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
D:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036677.inf	Win32/PSW.OnLineGames.NNU cheval de troie (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C
F:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP52\A0013434.exe	une variante de Win32/PTCasino application (nettoyé par suppression - mis en quarantaine)	00000000000000000000000000000000	C


Juste après mon dernier post, AVG a de nouveau détecté le virus. Voici l'historique d'AVG:

"Warning";"Found Tracking cookie.Doubleclick";"C:\Documents and Settings\Alexis\Application Data\Mozilla\Firefox\Profiles\o5njm3kg.default\cookies.sqlite";"";"25/07/2009, 15:47:11"

"Warning";"Found Tracking cookie.Atdmt";"C:\Documents and Settings\Alexis\Cookies\alexis@atdmt[2].txt";"";"25/07/2009, 15:46:53"

"Warning";"Found Tracking cookie.Smartadserver";"C:\Documents and Settings\Alexis\Application Data\Mozilla\Firefox\Profiles\o5njm3kg.default\cookies.sqlite";"";"24/07/2009, 08:06:34"

"Warning";"Found Tracking cookie.Atdmt";"C:\Documents and Settings\Alexis\Cookies\alexis@atdmt[2].txt";"";"24/07/2009, 08:06:18"

"Infection";"Virus found Win32/Heur";"C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0036202.dll";"";"23/07/2009, 23:00:05"

"Infection";"Virus found Win32/Heur";"C:\system volume information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP147\A0035180.dll";"";"23/07/2009, 23:00:05"

"Infection";"Trojan horse PSW.OnlineGames_r.AP";"C:\WINDOWS\system32\c.exe";"";"22/07/2009, 19:10:23"
"Infection";"Virus found Win32/Heur";"C:\Documents and Settings\Alexis\Local Settings\Temp\help.exe";"";"22/07/2009, 19:03:13"

"Infection";"Trojan horse PSW.OnlineGames_r.AP";"C:\WINDOWS\system32\c.exe";"";"20/07/2009, 19:32:30"
"Infection";"Virus found Win32/Heur";"C:\Documents and Settings\Alexis\Local Settings\Temp\help.exe";"";"20/07/2009, 19:25:26"

"Infection";"Virus identified Worm/AutoRun.FR";"G:\d1vmq.exe";"";"19/07/2009, 22:17:59"
"Infection";"Trojan horse PSW.OnlineGames.BKCA";"G:\2u.com";"";"19/07/2009, 22:17:59"

"Infection";"Trojan horse PSW.OnlineGames_r.AP";"C:\WINDOWS\system32\c.exe";"";"19/07/2009, 22:04:04"
"Infection";"Virus found Win32/Heur";"C:\WINDOWS\system32
mdfgds0.dll";"";"19/07/2009, 21:56:47"

"Infection";"Virus found Win32/Heur";"C:\Documents and Settings\Alexis\Local Settings\Temp\help.exe";"";"19/07/2009, 21:56:43"

Par ailleurs, je n'arrive toujours pas à mettre à jour AVG, ce qui semble confirmer que le virus soit toujours présent.

alexby · Answer

J'ai relancé GenProc, qui m'a demandé de faire une analyse avec Active scan. En voici le résumé:

Summary of your last scan:
7/26/2009 3:09:27 AM
Results: 	1 virus or spyware detected.
Suspicious items: 	301 suspicious files detected, not sent.
Vulnerabilities: 	No vulnerabilities detected

Voici quelques détails sur ce virus:

Common name:	Lineage.KOT
Technical name:	W32/Lineage.KOT
Threat level:	Medium
Type:	Trojan
Effects:  	It allows to get into the affected computer. It uses stealth techniques to avoid being detected by the user. It spreads , via mapped drives, through shared network resources, by infecting files that are then distributed.
Affected platforms: 	

Windows 2003/XP/2000/NT/ME/98/95
First detected on:	Feb. 25, 2009
Detection updated on:	June 23, 2009
Statistics	Yes
Proactive protection:
	Yes, using TruPrevent Technologies
Brief Description 
	    

Lineage.KOT is a Trojan, which although seemingly inoffensive, can actually carry out attacks and intrusions.

 

It uses stealth techniques to avoid being detected by the user:

    * It deletes the original file from which it was run once it is installed on the computer.
    * It modifies system permissions in order to hide itself.

 

Lineage.KOT uses the following propagation or distribution methods:

    * Exploiting vulnerabilities with the intervention of the user: exploiting vulnerabilities in file formats or applications. To exploit them successfully it needs the intervention of the user: opening files, viewing malicious web pages, reading emails, etc.
    * Computer networks (mapped drives): it creates copies of itself in mapped drives.
    * Computer networks (shared resources): it creates copies of itself in shared network resources to which it has access.
    * File infection: it infects different types of files, which are then distributed through any of the usual means: floppy disks, email messages with attachments, Internet download, files transferred via FTP, IRC channels, P2P file sharing networks, etc.

Effects 

Lineage.KOT allows hackers to get into and carry out dangerous actions in affected computers, such as capturing screenshots, stealing personal data, etc.

 
It avoids being detected by the user by using the following techniques:

    * It deletes the original file from which it was run once it is installed on the computer.
    * It modifies system permissions in order to hide itself.

 
Means of transmission 

Propagation via mapped drives:

Lineage.KOT checks if the infected computer is connected to a network.

If so, it makes an inventory of all mapped drives and creates a copy of itself in each of them.

 

Propagation through shared network resources:

Lineage.KOT checks if the infected computer is connected to a network. If so, it tries to spread to the shared network drives.

To do this, it tries to gain access to these shared drives, using typical or easily guessed passwords.

 

Distribution of infected files:

Lineage.KOT does not spread automatically using its own means, but infects files of the following types:

They reach computers when previously infected files are distributed, entering computers through any of the usual channels: floppy disks, email messages with attachments, Internet download, files transferred via FTP, IRC channels, P2P file sharing networks, etc.

 
Further Details  

Lineage.KOT has the following additional characteristics:

    * It is 104234 bytes in size.

Infecté par virus Win32/Heur

9 réponses

Votre réponse

Discussions similaires

Newsletters