Sujet Précédent Sujet Suivant

Trojan

Benn -  
jlpjlp Messages postés 52399 Statut Contributeur sécurité -
Bonjour,

rien de bien innovant prob de trojan horse : Win32:Horst-ADX [Trj]

donc a l'aide please

merci beaucoup

Benn.
A voir également:

32 réponses

Précédent
  • 1
  • 2
Réponse 21 / 32
Benn
 
voici le rapport de combofix le dernier que tu m'a demandé je vais faire le reste tt de suite

ComboFix 09-07-27.02 - Dominique Cavuoto 28/07/2009 12:36.2.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.447.131 [GMT 2:00]
Running from: c:\documents and settings\Dominique Cavuoto\Bureau\ComboFix.exe
Command switches used :: c:\documents and settings\Dominique Cavuoto\Bureau\CFscript.txt
AV: avast! antivirus 4.8.1335 [VPS 090727-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\Drivers\nyoht.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_tsxrw

((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-28 )))))))))))))))))))))))))))))))
.

2009-07-27 08:18 . 2009-07-27 08:34 -------- d-----w- c:\program files\Navilog1
2009-07-27 08:17 . 2009-07-27 08:17 -------- d-----w- c:\program files\AskBardis
2009-07-27 08:13 . 2009-07-27 08:13 -------- d-----w- c:\program files\CCleaner
2009-07-27 08:06 . 2009-07-27 08:09 -------- d-----w- C:\ToolBar SD
2009-07-27 07:43 . 2009-07-27 07:46 -------- d-----w- C:\rsit
2009-07-24 08:34 . 2009-07-24 08:34 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.3\itstv.exe
2009-07-16 08:08 . 2009-07-16 08:08 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.2\itstv.exe
2009-07-10 15:14 . 2009-07-10 15:13 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.1\itstv.exe
2009-07-07 15:31 . 2009-07-07 15:31 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.0\itstv.exe
2009-07-02 07:59 . 2009-07-03 05:41 -------- d-----w- C:\!KillBox

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-28 10:44 . 2009-03-23 16:56 -------- d-----w- c:\program files\DNA
2009-07-28 10:44 . 2009-03-23 16:56 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\DNA
2009-07-28 10:12 . 2009-07-28 10:12 1726 ----a-w- c:\program files\xrvrzsb.txt
2009-07-28 10:05 . 2008-10-08 14:52 -------- d-----w- c:\program files\EoRezo
2009-07-28 09:12 . 2007-02-01 15:06 -------- d-----w- c:\program files\Mozilla Thunderbird Beta 2
2009-07-28 09:01 . 2008-10-08 14:52 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo
2009-07-28 05:31 . 2008-10-19 14:04 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-27 19:22 . 2007-10-26 05:23 -------- d-----w- c:\program files\Trend Micro
2009-07-27 13:28 . 2008-10-19 14:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-27 10:56 . 2009-04-15 15:25 -------- d-----w- c:\program files\LucasArts
2009-07-27 10:56 . 2006-11-17 10:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-27 09:58 . 2008-10-20 06:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-24 05:28 . 2009-04-24 17:01 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-18 07:34 . 2009-05-15 14:45 -------- d-----w- c:\program files\free-downloads.net
2009-07-17 17:56 . 2009-03-23 17:15 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\Azureus
2009-07-13 11:36 . 2008-10-20 06:59 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 11:36 . 2008-10-20 06:59 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-10 10:54 . 2009-04-24 16:57 -------- d-----w- c:\program files\Windows Live
2009-07-10 10:14 . 2007-10-17 15:30 43536 ----a-w- c:\documents and settings\Dominique Cavuoto\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-25 05:58 . 2009-06-25 05:58 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.9\itstv.exe
2009-06-17 12:39 . 2009-06-17 12:39 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.8\itstv.exe
2009-06-16 14:40 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2006-03-02 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-09 15:57 . 2009-06-09 15:56 -------- d-----w- c:\program files\Google
2009-06-09 12:16 . 2009-06-09 12:16 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.7\itstv.exe
2009-06-06 15:17 . 2009-06-05 16:14 -------- d-----w- c:\program files\Studio-Scrap
2009-06-06 14:06 . 2009-06-05 16:15 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\Studio-Scrap2
2009-06-05 16:31 . 2009-06-05 15:02 -------- d-----w- c:\program files\InstStudio-Scrap
2009-06-03 19:10 . 2006-03-02 12:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-06-03 17:07 . 2009-06-03 17:07 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.6\itstv.exe
2009-06-01 16:26 . 2009-06-01 16:26 -------- d-----w- c:\program files\EA GAMES
2009-05-31 06:31 . 2009-04-26 08:23 -------- d-----w- c:\program files\UBISOFT
2009-05-27 07:09 . 2009-05-27 07:09 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.5\itstv.exe
2009-05-16 06:42 . 2009-05-16 06:42 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.4\itstv.exe
2009-05-08 18:03 . 2009-05-08 18:03 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.3\itstv.exe
2009-05-07 15:33 . 2006-03-02 12:00 348672 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 19:26 . 2009-04-25 08:04 258408 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-07-23 15:20 . 2008-12-22 19:16 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-28_08.42.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-28 10:43 . 2009-07-28 10:43 16384 c:\windows\Temp\Perflib_Perfdata_238.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2009-07-18 07:35 2215960 ----a-w- c:\program files\free-downloads.net\tbfre0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfre0.dll" [2009-07-18 2215960]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfre0.dll" [2009-07-18 2215960]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-03-23 321344]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-06-25 1578736]
"eMuleAutoStart"="d:\programs\eMule V0.48a\eMule\emule.exe" [2009-02-22 5668864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\windows\system32\rmctrl.exe" [2000-10-16 32768]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-01-21 185896]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-06-30 2376928]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2009-03-17 157552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2006-06-16 53248]
"S3Trayp"="S3trayp.exe" - c:\windows\system32\S3Trayp.exe [2005-10-31 163840]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-03-02 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Programs\\eMule V0.48a\\eMule\\emule.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11280:TCP"= 11280:TCP:BitComet 11280 TCP
"11280:UDP"= 11280:UDP:BitComet 11280 UDP

R0 xmasbus;xmasbus;c:\windows\system32\drivers\xmasbus.sys [16/05/2009 20:57 140800]
R0 xmasscsi;xmasscsi;c:\windows\system32\drivers\xmasscsi.sys [16/05/2009 20:57 5248]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [21/06/2009 09:14 114768]
R2 AGWinService;AG Windows Service;c:\program files\AGI\common\win32\pythonservice.exe [24/04/2009 18:54 10240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21/06/2009 09:14 20560]
R3 MSHUSBVideo;NX6000/NX3000/VX5000/VX5500/VX2000/VX7000 Filter Driver;c:\windows\system32\drivers\nx6000.sys [25/04/2009 10:07 30560]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [22/06/2006 20:23 808448]
S2 gupdate1c9e91accb640cc;Service Google Update (gupdate1c9e91accb640cc);c:\program files\Google\Update\GoogleUpdate.exe [09/06/2009 17:56 133104]
S3 DCamUSBNovatek;CI-8330 USB Video Camera;c:\windows\system32\drivers\nvtcam.sys [28/01/2007 12:53 79872]
S3 jbridgep;jbridgep;\??\c:\docume~1\DOMINI~1\LOCALS~1\Temp\jbridgep.sys --> c:\docume~1\DOMINI~1\LOCALS~1\Temp\jbridgep.sys [?]
S4 Aapiwdsnfsra;Aapiwdsnfsra; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-07-28 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-10-19 14:35]

2009-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-09 15:56]

2009-07-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-09 15:56]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.talti.com
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - d:\programs\OFFICE11\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\Dominique Cavuoto\Application Data\Mozilla\Firefox\Profiles\3h2fjo45.default\
FF - prefs.js: browser.search.selectedEngine - Kiwee Live Search
FF - prefs.js: keyword.URL - hxxp://kwtb.search.imgag.com/?c=GNKIW29193&sbs=1&sc=2&f=web&vernum=1.0&uid=&did=f8d4a70c-98e2-4081-901d-01bf93043ede&q=
FF - plugin: c:\documents and settings\Dominique Cavuoto\Application Data\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin2.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin3.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin4.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin5.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin6.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin7.dll

---- FIREFOX POLICIES ----
.

**************************************************************************

driver loading error catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-28 12:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3788)
c:\windows\system32\SSSensor.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Sygate\SPF\Smc.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
.
**************************************************************************
.
Completion time: 2009-07-28 12:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-28 10:50
ComboFix2.txt 2009-07-28 08:45

Pre-Run: 23 739 383 808 octets libres
Post-Run: 23 632 265 216 octets libres

209 --- E O F --- 2009-07-23 06:14
0
Réponse 22 / 32
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
tu as mal fais le glissé de combofix recommence et colle ad remover
0
Réponse 23 / 32
Benn
 
hello

désolé de tarder a poster, juste pour te remercier de ton coup de main et pour dire que pour l'instant tt est revenu a la normale plus d'alerte de la part d'avast pas de ralentissement particulier tt est ok

merci encore :)

Peace

Benn
0
Réponse 24 / 32
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
Tu as mal fais le glissé de combofix recommence et colle ad remover
0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 25 / 32
Benn
 
.
======= RAPPORT D'AD-REMOVER 1.1.4.5_O | UNIQUEMENT XP/VISTA/SEVEN =======
.
Mit à jour par C_XX le 24/06/2009 à 7:10 PM
Contact: AdRemover.contact@gmail.com
Site web: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Lancé à: 8:29:34, 30/07/2009 | Mode Normal | Option: CLEAN
Exécuté de: C:\Program Files\Ad-remover\
Système d'exploitation: Microsoft® Windows XP™ Service Pack 3 v5.1.2600
Nom du PC: SONATA2 | Utilisateur actuel: Dominique Cavuoto
.
Administrateur: Administrateur
Administrateur: Dominique Cavuoto
N'est pas administrateur: HelpAssistant *Desactive*
N'est pas administrateur: Invité *Desactive*
N'est pas administrateur: SUPPORT_388945a0 *Desactive*
.
============== ÉLÉMENT(S) NEUTRALISÉ(S) ==============
.
.
HKCU\Software\EoRezo
/!\ NON SUPPRIMÉ - HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0BC6E3FA-78EF-4886-842C-5A1258C4455A}
HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{AFDBDDAA-5D3F-42EE-B79C-185A7020515B}
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKCU\Software\VB and VBA Program Settings\eurobarre
HKU\S-1-5-21-1060284298-308236825-839522115-1004\Software\Binary Noise\mPlayer\kiwee_toolbar_installer.exe
HKCU\Software\AGI
/!\ NON SUPPRIMÉ - HKLM\Software\AGI
.
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\cmhost.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\ConfMedia.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\db
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\eoDesktop
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\eoStats
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\host.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\user.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\db\cat.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\eoDesktop\config.xml
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\eoDesktop\eoDesktop.html
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\eoDesktop\userConfig.xml
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\eoStats\eoStats.txt
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Download
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\help_config.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\unins000.dat
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\unins000.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\user_config.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\user_profil.cyp
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\eobrowserpub
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\eoengine
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\eobrowserpub\1.0.0.1
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\eoengine\9.1.0.0
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.1
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.2
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.3
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.4
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.5
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.6
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.7
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.8
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.9
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.0
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.1
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.2
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.3
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.2\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.3\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.4\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.5\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.6\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.7\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.8\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.9\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.0\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.1\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.2\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.3\itstv.exe
C:\DOCUME~1\DOMINI~1\APPLIC~1\EoRezo
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome.manifest
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome.manifest.dev
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\install.rdf.bak
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome\ajtoolbar.jar
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\ask.gif
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\ask.src
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\config.dat.bak
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\contents.rdf
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences\snipit.js
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\manifest.mf
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.rsa
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF\zigbert.sf
C:\DOCUME~1\DOMINI~1\APPLIC~1\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
C:\Program Files\AskBarDis\bar
C:\Program Files\AskBarDis\bar\Settings
C:\Program Files\AskBarDis\bar\Settings\prevCfg2.htm
C:\Program Files\AskBarDis
C:\Program Files\EoRezo\ConfMedia.cyp
C:\Program Files\EoRezo\EoAdv
C:\Program Files\EoRezo\eoEngine.url
C:\Program Files\EoRezo\EoMultiLanguage.dll
C:\Program Files\EoRezo\EoRezoComm.dll
C:\Program Files\EoRezo\EoRezoImg_17.dll
C:\Program Files\EoRezo\EoRezoImg_19.dll
C:\Program Files\EoRezo\EoRezoImg_20.dll
C:\Program Files\EoRezo\EoRezoImg_21.dll
C:\Program Files\EoRezo\EoRezoImg_22.dll
C:\Program Files\EoRezo\EoRezoImg_23.dll
C:\Program Files\EoRezo\EoRezoTools_16.dll
C:\Program Files\EoRezo\EoRezoTools_17.dll
C:\Program Files\EoRezo\EoRezoTools_18.dll
C:\Program Files\EoRezo\EoRezoTools_20.dll
C:\Program Files\EoRezo\EoRezoTools_21.dll
C:\Program Files\EoRezo\EoRezoTools_26.dll
C:\Program Files\EoRezo\EoRezoTools_27.dll
C:\Program Files\EoRezo\EoRezoTools_28.dll
C:\Program Files\EoRezo\EoRezoTools_29.dll
C:\Program Files\EoRezo\EoRezoTools_30.dll
C:\Program Files\EoRezo\FreeImage.dll
C:\Program Files\EoRezo\Host.cyp
C:\Program Files\EoRezo\lang
C:\Program Files\EoRezo\MngInstaller.dll
C:\Program Files\EoRezo\unins000.dat
C:\Program Files\EoRezo\unins000.exe
C:\Program Files\EoRezo\user.cyp
C:\Program Files\EoRezo\EoAdv\atl90.dll
C:\Program Files\EoRezo\EoAdv\eoAdv.url
C:\Program Files\EoRezo\EoAdv\EoRezoBho.old
C:\Program Files\EoRezo\EoAdv\mfc90.dll
C:\Program Files\EoRezo\EoAdv\Microsoft.VC90.ATL.manifest
C:\Program Files\EoRezo\EoAdv\Microsoft.VC90.CRT.manifest
C:\Program Files\EoRezo\EoAdv\Microsoft.VC90.MFC.manifest
C:\Program Files\EoRezo\EoAdv\msvcr90.dll
C:\Program Files\EoRezo\lang\ihm_eoclock.xml
C:\Program Files\EoRezo\lang\ihm_eoengine.xml
C:\Program Files\EoRezo\lang\ihm_eonet.xml
C:\Program Files\EoRezo\lang\ihm_eorezotools.xml
C:\Program Files\EoRezo\lang\ihm_eosudoku.xml
C:\Program Files\EoRezo\lang\ihm_eoweather.xml
C:\Program Files\EoRezo\lang\lang_en.xml
C:\Program Files\EoRezo\lang\lang_es.xml
C:\Program Files\EoRezo\lang\lang_fr.xml
C:\Program Files\EoRezo\lang\lang_it.xml
C:\Program Files\EoRezo
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi\config
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi\KiweeToolbar
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi\logs
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi\config\userconfig.cfg
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi\KiweeToolbar\config
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi\KiweeToolbar\config\appuserconfig.cfg
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi\logs\pyagcore.log
C:\DOCUME~1\DOMINI~1\APPLIC~1\Agi

(!) -- Fichiers temporaires supprimés.

.
============== Scan additionnel ==============
.

* Mozilla FireFox Version 3.0.12 *

Nom du profil: 3h2fjo45.default (Dominique Cavuoto)
.
(Prefs.js) user_pref("browser.search.selectedEngine", "Kiwee Live Search");
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.12");
.
.

* Internet Explorer Version 6.0.2900.5512 *

[HKEY_CURRENT_USER\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]

Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/

[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]

Tabs: res://ieframe.dll/tabswelcome.htm

============== Suspect (Cracks, Serials ... ) ==============

.
C:\Documents and Settings\Dominique Cavuoto\.housecall6.6\patch.exe
.
===================================
.
11791 Octet(s) - C:\Ad-Report-CLEAN.log
.
0 Fichier(s) - C:\DOCUME~1\DOMINI~1\LOCALS~1\Temp
1 Fichier(s) - C:\WINDOWS\Temp
.
34 Fichier(s) - C:\Program Files\Ad-remover\BACKUP
68 Fichier(s) - C:\Program Files\Ad-remover\QUARANTINE
.
Fin à: 8:50:30 | 30/07/2009
.
============== E.O.F ==============
.

ComboFix 09-07-29.03 - Dominique Cavuoto 30/07/2009 8:14.3.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.447.196 [GMT 2:00]
Running from: c:\documents and settings\Dominique Cavuoto\Bureau\ComboFix.exe
Command switches used :: c:\documents and settings\Dominique Cavuoto\Bureau\CFscript.txt
AV: avast! antivirus 4.8.1335 [VPS 090729-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
"c:\docume~1\DOMINI~1\LOCALS~1\Temp\jbridgep.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_JBRIDGEP
-------\Service_jbridgep

((((((((((((((((((((((((( Files Created from 2009-06-28 to 2009-07-30 )))))))))))))))))))))))))))))))
.

2009-07-28 11:19 . 2009-07-28 12:25 -------- d-----w- c:\program files\Ad-remover
2009-07-27 08:18 . 2009-07-27 08:34 -------- d-----w- c:\program files\Navilog1
2009-07-27 08:17 . 2009-07-27 08:17 -------- d-----w- c:\program files\AskBardis
2009-07-27 08:13 . 2009-07-27 08:13 -------- d-----w- c:\program files\CCleaner
2009-07-27 08:06 . 2009-07-27 08:09 -------- d-----w- C:\ToolBar SD
2009-07-27 07:43 . 2009-07-27 07:46 -------- d-----w- C:\rsit
2009-07-24 08:34 . 2009-07-24 08:34 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.3\itstv.exe
2009-07-16 08:08 . 2009-07-16 08:08 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.2\itstv.exe
2009-07-10 15:14 . 2009-07-10 15:13 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.1\itstv.exe
2009-07-07 15:31 . 2009-07-07 15:31 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.1.0\itstv.exe
2009-07-02 07:59 . 2009-07-03 05:41 -------- d-----w- C:\!KillBox

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-30 06:21 . 2009-03-23 16:56 -------- d-----w- c:\program files\DNA
2009-07-30 06:21 . 2009-03-23 16:56 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\DNA
2009-07-30 06:11 . 2007-02-01 15:06 -------- d-----w- c:\program files\Mozilla Thunderbird Beta 2
2009-07-28 10:12 . 2009-07-28 10:12 1726 ----a-w- c:\program files\xrvrzsb.txt
2009-07-28 10:05 . 2008-10-08 14:52 -------- d-----w- c:\program files\EoRezo
2009-07-28 09:01 . 2008-10-08 14:52 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo
2009-07-28 05:31 . 2008-10-19 14:04 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-27 19:22 . 2007-10-26 05:23 -------- d-----w- c:\program files\Trend Micro
2009-07-27 13:28 . 2008-10-19 14:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-07-27 10:56 . 2009-04-15 15:25 -------- d-----w- c:\program files\LucasArts
2009-07-27 10:56 . 2006-11-17 10:22 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-27 09:58 . 2008-10-20 06:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-24 05:28 . 2009-04-24 17:01 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-18 07:34 . 2009-05-15 14:45 -------- d-----w- c:\program files\free-downloads.net
2009-07-17 17:56 . 2009-03-23 17:15 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\Azureus
2009-07-13 11:36 . 2008-10-20 06:59 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-13 11:36 . 2008-10-20 06:59 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-10 10:54 . 2009-04-24 16:57 -------- d-----w- c:\program files\Windows Live
2009-07-10 10:14 . 2007-10-17 15:30 43536 ----a-w- c:\documents and settings\Dominique Cavuoto\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-26 16:50 . 2006-03-02 12:00 670720 ----a-w- c:\windows\system32\wininet.dll
2009-06-26 16:50 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-06-25 05:58 . 2009-06-25 05:58 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.9\itstv.exe
2009-06-17 12:39 . 2009-06-17 12:39 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.8\itstv.exe
2009-06-16 14:40 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:40 . 2006-03-02 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-09 15:57 . 2009-06-09 15:56 -------- d-----w- c:\program files\Google
2009-06-09 12:16 . 2009-06-09 12:16 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.7\itstv.exe
2009-06-06 15:17 . 2009-06-05 16:14 -------- d-----w- c:\program files\Studio-Scrap
2009-06-06 14:06 . 2009-06-05 16:15 -------- d-----w- c:\documents and settings\Dominique Cavuoto\Application Data\Studio-Scrap2
2009-06-05 16:31 . 2009-06-05 15:02 -------- d-----w- c:\program files\InstStudio-Scrap
2009-06-03 19:10 . 2006-03-02 12:00 1297408 ----a-w- c:\windows\system32\quartz.dll
2009-06-03 17:07 . 2009-06-03 17:07 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.6\itstv.exe
2009-06-01 16:26 . 2009-06-01 16:26 -------- d-----w- c:\program files\EA GAMES
2009-05-31 06:31 . 2009-04-26 08:23 -------- d-----w- c:\program files\UBISOFT
2009-05-27 07:09 . 2009-05-27 07:09 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.5\itstv.exe
2009-05-16 06:42 . 2009-05-16 06:42 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.4\itstv.exe
2009-05-08 18:03 . 2009-05-08 18:03 20480 ----a-w- c:\documents and settings\Dominique Cavuoto\Application Data\EoRezo\SoftwareUpdate\Software\itsTV\3.0.0.3\itstv.exe
2009-05-07 15:33 . 2006-03-02 12:00 348672 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 19:26 . 2009-04-25 08:04 258408 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-07-23 15:20 . 2008-12-22 19:16 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-28_08.42.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-07-30 06:21 . 2009-07-30 06:21 16384 c:\windows\Temp\Perflib_Perfdata_1a0.dat
- 2009-04-29 06:03 . 2008-07-08 13:03 18296 c:\windows\system32\spmsg.dll
+ 2009-04-29 06:03 . 2009-05-26 11:40 18296 c:\windows\system32\spmsg.dll
- 2009-02-20 08:10 . 2009-04-29 04:34 81920 c:\windows\system32\dllcache\ieencode.dll
+ 2009-02-20 08:10 . 2009-06-26 16:50 81920 c:\windows\system32\dllcache\ieencode.dll
+ 2006-03-02 12:00 . 2009-06-26 16:50 621056 c:\windows\system32\urlmon.dll
- 2006-03-02 12:00 . 2009-04-29 04:34 621056 c:\windows\system32\urlmon.dll
+ 2008-04-21 06:43 . 2009-06-26 16:50 670720 c:\windows\system32\dllcache\wininet.dll
- 2008-04-21 06:43 . 2009-04-29 04:34 670720 c:\windows\system32\dllcache\wininet.dll
+ 2008-06-26 08:13 . 2009-06-26 16:50 621056 c:\windows\system32\dllcache\urlmon.dll
- 2008-06-26 08:13 . 2009-04-29 04:34 621056 c:\windows\system32\dllcache\urlmon.dll
+ 2006-03-02 12:00 . 2009-07-18 16:03 1510400 c:\windows\system32\shdocvw.dll
+ 2006-03-02 12:00 . 2009-07-18 16:03 3090432 c:\windows\system32\mshtml.dll
+ 2008-06-26 08:13 . 2009-07-18 16:03 1510400 c:\windows\system32\dllcache\shdocvw.dll
+ 2008-04-21 06:43 . 2009-07-18 16:03 3090432 c:\windows\system32\dllcache\mshtml.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ecdee021-0d17-467f-a1ff-c7a115230949}]
2009-07-18 07:35 2215960 ----a-w- c:\program files\free-downloads.net\tbfre0.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{ecdee021-0d17-467f-a1ff-c7a115230949}"= "c:\program files\free-downloads.net\tbfre0.dll" [2009-07-18 2215960]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{ECDEE021-0D17-467F-A1FF-C7A115230949}"= "c:\program files\free-downloads.net\tbfre0.dll" [2009-07-18 2215960]

[HKEY_CLASSES_ROOT\clsid\{ecdee021-0d17-467f-a1ff-c7a115230949}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 139264]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-03-23 321344]
"ccleaner"="c:\program files\CCleaner\CCleaner.exe" [2009-06-25 1578736]
"eMuleAutoStart"="d:\programs\eMule V0.48a\eMule\emule.exe" [2009-02-22 5668864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\windows\system32\rmctrl.exe" [2000-10-16 32768]
"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"TkBellExe"="c:\program files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-01-21 185896]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-06-30 2376928]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2009-03-17 157552]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"VTTimer"="VTTimer.exe" - c:\windows\system32\VTTimer.exe [2006-06-16 53248]
"S3Trayp"="S3trayp.exe" - c:\windows\system32\S3Trayp.exe [2005-10-31 163840]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-03-02 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"avast! Web Scanner"=3 (0x3)
"avast! Mail Scanner"=3 (0x3)
"avast! Antivirus"=2 (0x2)
"aswUpdSv"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeEnC2.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeTray.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Programs\\eMule V0.48a\\eMule\\emule.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"11280:TCP"= 11280:TCP:BitComet 11280 TCP
"11280:UDP"= 11280:UDP:BitComet 11280 UDP

R0 xmasbus;xmasbus;c:\windows\system32\drivers\xmasbus.sys [16/05/2009 20:57 140800]
R0 xmasscsi;xmasscsi;c:\windows\system32\drivers\xmasscsi.sys [16/05/2009 20:57 5248]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [21/06/2009 09:14 114768]
R2 AGWinService;AG Windows Service;c:\program files\AGI\common\win32\pythonservice.exe [24/04/2009 18:54 10240]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [21/06/2009 09:14 20560]
R3 MSHUSBVideo;NX6000/NX3000/VX5000/VX5500/VX2000/VX7000 Filter Driver;c:\windows\system32\drivers\nx6000.sys [25/04/2009 10:07 30560]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [22/06/2006 20:23 808448]
S2 gupdate1c9e91accb640cc;Service Google Update (gupdate1c9e91accb640cc);c:\program files\Google\Update\GoogleUpdate.exe [09/06/2009 17:56 133104]
S3 DCamUSBNovatek;CI-8330 USB Video Camera;c:\windows\system32\drivers\nvtcam.sys [28/01/2007 12:53 79872]
S4 Aapiwdsnfsra;Aapiwdsnfsra; [x]
.
Contents of the 'Scheduled Tasks' folder

2009-07-30 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2008-10-19 14:35]

2009-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-09 15:56]

2009-07-30 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-09 15:56]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.talti.com
mWindow Title =
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - d:\programs\OFFICE11\EXCEL.EXE/3000
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
FF - ProfilePath - c:\documents and settings\Dominique Cavuoto\Application Data\Mozilla\Firefox\Profiles\3h2fjo45.default\
FF - prefs.js: browser.search.selectedEngine - Kiwee Live Search
FF - prefs.js: keyword.URL - hxxp://kwtb.search.imgag.com/?c=GNKIW29193&sbs=1&sc=2&f=web&vernum=1.0&uid=&did=f8d4a70c-98e2-4081-901d-01bf93043ede&q=
FF - plugin: c:\documents and settings\Dominique Cavuoto\Application Data\Mozilla\Firefox\Profiles\3h2fjo45.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin2.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin3.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin4.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin5.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin6.dll
FF - plugin: d:\programs\Quick Time\Plugins\npqtplugin7.dll

---- FIREFOX POLICIES ----
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-30 08:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2348)
c:\windows\system32\SSSensor.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Sygate\SPF\Smc.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-30 8:26 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-30 06:26
ComboFix2.txt 2009-07-28 10:50
ComboFix3.txt 2009-07-28 08:45

Pre-Run: 23 451 357 184 octets libres
Post-Run: 23 424 212 992 octets libres

227 --- E O F --- 2009-07-30 06:02
0
Réponse 26 / 32
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
ok remets un rapport RSIT et dis nous si encore des soucis
0
Réponse 27 / 32
Benn
 
Logfile of random's system information tool 1.06 (written by random/random)
Run by Dominique Cavuoto at 2009-07-30 11:07:59
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 22 GB (45%) free of 50 GB
Total RAM: 447 MB (7% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:08:30, on 30/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
D:\Programs\eMule V0.48a\eMule\emule.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Thunderbird Beta 2\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dominique Cavuoto\Bureau\logiciels trojan\RSIT.exe
C:\Program Files\trend micro\Dominique Cavuoto.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O2 - BHO: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll
O3 - Toolbar: free-downloads.net Toolbar - {ecdee021-0d17-467f-a1ff-c7a115230949} - C:\Program Files\free-downloads.net\tbfre0.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Programs\eMule V0.48a\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Programs\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate1c9e91accb640cc) (gupdate1c9e91accb640cc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NBService - Nero AG - D:\Programs\Nero\Nero v7.2.3b + Keygen\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
0
Réponse 28 / 32
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
ok le rapport est incomplet de rsit :) mais bon sur cette partie

sinon mets a jour internet explorer avec la version 7 ou 8

et

Mettre a jour java:
https://javara.fr.malavida.com/­indows

Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries.
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.)
Double-clique sur le répertoire JavaRa obtenu.
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher)
Clique sur Search For Updates.
Sélectionne Update Using jucheck.exe puis clique sur Search.
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes.
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions.
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok.
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse.
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log
(c:\JavaRa.log)
Ferme l'application.

si cela ne fonctionne pas

https://www.java.com/fr/download/windows_manual.jsp?locale=fr&host=www.java.com:80

tu peux désinstaller les vieilles versions.

______________

lance tool cleaner pour virer ce qui a été utilisé:
https://www.commentcamarche.net/telecharger/

______________
désactive ta restauration puis redemarre ton pc puis réactive la:
https://www.informatruc.com

voilà c'est bon

pour protéger gratos ton ordi
https://www.commentcamarche.net/telecharger/

mettre un antivirus

ANTIVIR ou AVG8 ou (AVAST)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MALWAREBYTE ANTIMALWARE + SPYBOT
+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation : il suffit de faire "update" pour mettre à jour tous les mois et ensuite" enable all protection" pour immuniser)...

--------
un pare feu :
(celui de Windows) ou mieux COMODO ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit)

http://www.clubic.com/telecharger-fiche11071-sunbelt-persona­l-firewall-e(...)
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
https://www.commentcamarche.net/telecharger/ 157 zonealarm

-----------

CCLEANER pour effacer les traces de surf
0
Réponse 29 / 32
Benn
 
Logfile of random's system information tool 1.06 (written by random/random)
Run by Dominique Cavuoto at 2009-07-30 11:32:13
Microsoft Windows XP Professionnel Service Pack 3
System drive C: has 23 GB (45%) free of 50 GB
Total RAM: 447 MB (14% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:32:34, on 30/07/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AGI\common\win32\PythonService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
D:\Programs\eMule V0.48a\eMule\emule.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Thunderbird Beta 2\thunderbird.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dominique Cavuoto\Bureau\logiciels trojan\RSIT.exe
C:\Program Files\trend micro\Dominique Cavuoto.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - (no file)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NTIECatcher Class - {C56CB6B0-0D96-11D6-8C65-B2868B609932} - C:\Program Files\Xi\NetTransport 2\NTIEHelper.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [eMuleAutoStart] D:\Programs\eMule V0.48a\eMule\emule.exe -AutoStart
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Programs\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Google Update (gupdate1c9e91accb640cc) (gupdate1c9e91accb640cc) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Fichiers communs\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NBService - Nero AG - D:\Programs\Nero\Nero v7.2.3b + Keygen\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Sygate Personal Firewall Pro (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
0
Réponse 30 / 32
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
ok rien d'infectieux

fais le message precedent et c'est bon pour toi!
0
Réponse 31 / 32
Benn
 
hello

voila tt est ENFIN fini lol

j'ai installé antivir et comodo

merci pour ce gros coup de main

et si t'as d'autres astuces hesites pas

thx a lot

Benn
0
Réponse 32 / 32
jlpjlp Messages postés 52399 Statut Contributeur sécurité 5 040
 
ok parfait

bonne suite!
0

Discussions similaires

Menace détectée TrojanSMS-PA sur Google Huawei/Android
Outmost -
bazfile -

6 réponses
Comment supprimer le virus Trojan
vitsou -
vitsou -

18 réponses
Comment enlever mon virus trojan:win32/si...
bryanoulet -
juju666 -

58 réponses
qu'est ce qu'un "trojan agent/gen" ? svp
Saber03 -
jacques.gache -

33 réponses
Trojan impossible à supprimer!
Gridouu -
Malekal_morte- -

12 réponses