Virus ou spyware ?

Bonjour,

A chaque démarrage de mon poste, mon antivirus trend micro me dit que xxx.exe (ou xxx sont 3 chiffres) est un virus dans les fichiers temporaires internet, d'autre part mon poste perd la barre de lancement rapide et ie essai de se connecter à http://www.paris-caraibes.fr/media/system/js/dia.exe ou se trouve le virus Win32.VirToolObfusca qui est bloqué.
Que Faire ? Merci d'avance pour votre aide
Ps : Win Xp Sp3, Ie7, Firefox 3

Déjà passer antivirus, spybot, ccleaner, malware aucun résultat concret puisque au démarrage suivant le problème persiste, j'ai aussi désactiver la restauration système.
Configuration: Windows XP
Firefox 3.0.3

2 réponses

  • Votes
  • Date
  • Date décroissante
  1. telecharge :https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/29061.html

    lance un scan et attend le raport

    copie le et met le ici
    1. Bonjour et merci de regarder mon souci
      Voici le résultat attendu

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 14:08:02, on 25/08/2009
      Platform: Windows XP SP3 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16876)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\Program Files\a-squared Free\a2service.exe
      C:\Program Files\Blue Coat Reporter\BCReporterService.exe
      C:\Program Files\Blue Coat Reporter\BCReporterCL.exe
      C:\WINDOWS\system32\cisvc.exe
      C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
      C:\Program Files\Java\jre6\bin\jqs.exe
      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      C:\Program Files\IBM\Lotus\Notes\nsd.exe
      C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
      C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
      C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
      C:\WINDOWS\system32\nvsvc32.exe
      C:\Program Files\OmniBack\bin\omniinet.exe
      C:\Program Files\Blue Coat Reporter\BCReporterCL.exe
      C:\Program Files\PDF Complete\pdfsvc.exe
      C:\Program Files\Cerus\Landpark\IP Server\LpServiceIPServer.exe
      C:\WINDOWS\system32\SLEE503.exe
      C:\Program Files\RealVNC\VNC4\WinVNC4.exe
      C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
      C:\WINDOWS\system32\wbem\wmiapsrv.exe
      C:\Program Files\Trend Micro\OfficeScan Client\CNTAoSMgr.exe
      C:\WINDOWS\RTHDCPL.EXE
      C:\WINDOWS\SMINST\Scheduler.exe
      C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
      C:\WINDOWS\system32\ScCertPropUI.exe
      C:\Program Files\Gemplus\GemSafe Libraries\BIN\RegTool.exe
      C:\Program Files\Java\jre6\bin\jusched.exe
      C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Steganos Security Suite 6\spm.exe
      C:\Program Files\IBM\Lotus\Notes\nminder.exe
      C:\Program Files\IBM\Lotus\Notes\NLNOTES.EXE
      C:\Program Files\IBM\Lotus\Notes\framework\rcp\eclipse\plugins\com.ibm.rcp.base_6.2.0.200811140851\win32\x86\notes2.exe
      C:\Program Files\IBM\Lotus\Notes\ntaskldr.EXE
      C:\WINDOWS\system32\cidaemon.exe
      C:\WINDOWS\system32\cidaemon.exe
      C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe
      C:\Program Files\Cerus\Landpark\IP Clients\LpServiceIPClient.exe
      C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
      C:\WINDOWS\explorer.exe
      C:\Program Files\Mozilla Firefox\firefox.exe
      C:\Poubelle\HiJackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.fr
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://inconet.maison.pri/webtime/index.htm
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 192.168.1.4:8080
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
      O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
      O4 - HKLM\..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
      O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe
      O4 - HKLM\..\Run: [Scheduler] C:\WINDOWS\SMINST\Scheduler.exe
      O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
      O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
      O4 - HKLM\..\Run: [ScCertPropUI] C:\WINDOWS\system32\ScCertPropUI.exe
      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
      O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
      O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program Files\Fichiers communs\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
      O4 - HKLM\..\Run: [PDF Converter Registry Controller] "C:\Program Files\ScanSoft\PDFConverter 2.0 Professional\PDFConv\\RegistryController.exe"
      O4 - HKLM\..\Run: [RegTool] C:\Program Files\Gemplus\GemSafe Libraries\BIN\RegTool.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
      O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
      O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [SSS6_SPM] "C:\Program Files\Steganos Security Suite 6\spm.exe" /booting
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [SSS6_Suite] "C:\Program Files\Steganos Security Suite 6\sss.exe" /booting (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [SSS6_SAFE] "C:\Program Files\Steganos Security Suite 6\safe.exe" /booting (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-19\..\Run: [SSS6_SPM] "C:\Program Files\Steganos Security Suite 6\spm.exe" /booting (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - S-1-5-18 Startup: Notes Minder.lnk = C:\Program Files\IBM\Lotus\Notes\nminder.exe (User 'SYSTEM')
      O4 - .DEFAULT Startup: Notes Minder.lnk = C:\Program Files\IBM\Lotus\Notes\nminder.exe (User 'Default user')
      O4 - Startup: Notes Minder.lnk = C:\Program Files\IBM\Lotus\Notes\nminder.exe
      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
      O8 - Extra context menu item: Ouvrir le fichier PDF dans Word (PDF Converter 2.0) - res://C:\Program Files\ScanSoft\PDFConverter 2.0 Professional\PDFConv\IEShellExt.dll /300
      O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {0F50AE99-D0FB-4029-9D17-214D92DE9C77} (GGFileVersion Control) - http://mapris.rgd74.fr/my.logout.php3?errorcode=19
      O16 - DPF: {35C3D91E-401A-4E45-88A5-F3B32CD72DF4} (Encrypt Class) - https://trend.maison.pri/officescan/console/html/root/AtxEnc.cab
      O16 - DPF: {4F3DCE50-E8E7-40AC-AB8D-99F87F1F89BD} (Console d'administration Trend Micro OfficeScan) - https://trend.maison.pri/officescan/console/html/root/AtxConsole.cab
      O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://mapris.rgd74.fr/my.logout.php3?errorcode=19
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
      O16 - DPF: {6F185310-9433-4550-B7BF-156548F1DBB9} (IncoScardX Control) - http://inconet/webtime/ActiveX/IncoScardX/IncoScard.cab
      O16 - DPF: {A050E865-64E3-431B-8079-F0DFCEA90A2D} (PieChart Class) - https://trend/officescan/console/html/root/AtxPie.cab
      O16 - DPF: {CAFECAFE-0013-0001-0022-ABCDEFABCDEF} (JInitiator 1.3.1.22) -
      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = maison.pri
      O17 - HKLM\Software\..\Telephony: DomainName = maison.pri
      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = maison.pri
      O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = maison.pri
      O20 - Winlogon Notify: gemsafe - C:\Program Files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll
      O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
      O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
      O23 - Service: Blue Coat Reporter (BCReporterService) - Unknown owner - C:\Program Files\Blue Coat Reporter\BCReporterService.exe
      O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
      O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
      O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe
      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
      O23 - Service: Diagnostics Lotus Notes (Lotus Notes Diagnostics) - IBM - C:\Program Files\IBM\Lotus\Notes\nsd.exe
      O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
      O23 - Service: NVIDIA Performance Driver Service - Unknown owner - C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
      O23 - Service: Data Protector Inet (omniInet) - Hewlett-Packard - C:\Program Files\OmniBack\bin\omniinet.exe
      O23 - Service: PC Angel (PCA) - SoftThinks - C:\WINDOWS\SMINST\PCAngel.exe
      O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe
      O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
      O23 - Service: Landpark Network IP Server (Service1) - Cerus Informatique - C:\Program Files\Cerus\Landpark\IP Server\LpServiceIPServer.exe
      O23 - Service: Landpark Network IP Client (Service2) - Cerus Informatique - C:\Program Files\Cerus\Landpark\IP Clients\LpServiceIPClient.exe
      O23 - Service: Steganos Live Encryption Engine (Version 503) [Service] (SLEE_503_SERVICE) - Unknown owner - C:\WINDOWS\system32\SLEE503.exe
      O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe
      O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
      O23 - Service: Service proxy d'OfficeScan NT (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
      O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe