Virus Total Security Fermé

Question

Bonjour,

Mon PC est infecté par le virus Total Security

Il bloque mes applications
Il s'est installé sur c:/Documents and Settings/All users/Application data/19454684/19454684.exe

Je viens de le stopper en activant le gestionnaire des tâches pendant qu'il se lançait. J'ai supprimé le processus.
Je peux donc à nouveau lancer des applications (word, ...)


Logfile of HijackThis v1.99.0
Scan saved at 21:58:33, on 12/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32	askmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\PROGRA~1\AVG\AVG8\avgui.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\Documents and Settings\Philippe\Mes documents\antivirus\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
R3 - URLSearchHook: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Pluginseg\VeohToolbar.dll
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [19454684] C:\Documents and Settings\All Users\Application Data\19454684\19454684.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\Messenger Plus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZJfox000
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O12 - Plugin for .mu3: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .mus: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myr: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O12 - Plugin for .myt: C:\Program Files\Internet Explorer\Plugins\NPMyrMus.dll
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab
O16 - DPF: {084DAC27-6FA3-4F55-9005-033F2F102F5C} (ITPPDiagIE Class) - http://downloads.winwise.fr/Common/npwwg.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - https://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021126/qtinstall.info.apple.com/dribnif/fr/win/QuickTimeInstaller.exe
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/02f3cec39381eb6b1d18/netzip/RdxIE601_fr.cab
O16 - DPF: {665585FD-2068-4C5E-A6D3-53AC3270ECD4} (FileSharingCtrl Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/FileSharing/en/filesharingctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - https://resources.flexera.com/web/installengine/engine/isetup.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {ABB08127-7417-11D4-8566-00500448008D} (Chat Class) - http://downloads.winwise.fr/Common/npchatlax.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe Active File Monitor V6 - Unknown - C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Service Bonjour - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
O23 - Service: Service de l’iPod - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
O23 - Service: NVIDIA Driver Helper Service - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Sygate Personal Firewall - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Journaux et alertes de performance - Unknown - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

Destrio5 · Answer

Bonjour,

---> Télécharge Malwarebytes' Anti-Malware (MBAM) sur ton Bureau.
---> Double-clique sur le fichier téléchargé pour lancer le processus d'installation.
---> Dans l'onglet Mise à jour, clique sur le bouton Recherche de mise à jour : si le pare-feu demande l'autorisation à MBAM de se connecter à Internet, accepte.
---> Une fois la mise à jour terminée, rends-toi dans l'onglet Recherche.
---> Sélectionne Exécuter un examen rapide.
---> Clique sur Rechercher. L'analyse démarre.

A la fin de l'analyse, un message s'affiche :

L'examen s'est terminé normalement. Cliquez sur 'Afficher les résultats' pour afficher tous les objets trouvés.

---> Clique sur OK pour poursuivre. Si MBAM n'a rien trouvé, il te le dira aussi.
---> Ferme tes navigateurs.
Si des malwares ont été détectés, clique sur Afficher les résultats.
---> Sélectionne tout (ou laisse coché) et clique sur Supprimer la sélection, MBAM va détruire les fichiers et clés de registre infectés et en mettre une copie dans la quarantaine.
---> MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Copie-colle ce rapport dans ta prochaine réponse.

Destrio5 · Answer

Oui.

&#9679; Télécharge Ad-Remover (de Cyrildu17 / C_XX) sur ton Bureau.

/!\ Déconnecte-toi d'Internet et ferme toutes applications en cours. /!\

&#9679; Double-clique sur le programme d'installation, installe-le dans son emplacement par défaut (C:\Program Files).
&#9679; Double-clique sur le raccourci d'Ad-Remover située sur ton Bureau.
(Sous Vista, il faut cliquer droit sur le raccourci d'Ad-Remover et choisir Exécuter en tant qu'administrateur)
&#9679; Au menu principal, choisis l'option L.
&#9679; Poste le rapport généré (C:\Ad-Report-CLEAN.log).

(CTRL+A pour tout sélectionner, CTRL+C pour copier et CTRL+V pour coller)

Note : "Process.exe", une composante de l'outil, est détectée par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool.

Phil · Answer

Bonjour Destrio

C'est fait, voici le log de Ad-Remover : 

.
======= LOGFILE OF AD-REMOVER 1.1.4.5_U | ONLY XP/VISTA/7 =======
.
Updated by C_XX on 12/09/2009 at 9:30 PM
Contact: AdRemover.contact@gmail.com
Website: http://pagesperso-orange.fr/NosTools/ad_remover.html
.
Launch at:  1:53:04, 13/09/2009 | Normal Boot | Option: CLEAN
Executed from: C:\Program Files\Ad-Remover\
Operating system: Microsoft® Windows XP™  Service Pack 3 v5.1.2600
Computer Name: ORDI4 | Current user: C:\Documents and Settings\Philippe
. 
============== NEUTRALIZED ELEMENT(S) ============== 
.
.
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1A0AADCD-3A72-4B5F-900F-E3BB5A838E2A} 
HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} 
HKCU\Software\SWEETIE 
HKCU\Software\Trymedia Systems 
HKLM\Software\Classes\CLSID\{9AFB8248-617F-460D-9366-D71CDEDA3179} 
HKLM\Software\Classes\SWEETIE.IEToolbar 
HKLM\Software\Classes\SWEETIE.IEToolbar.1 
HKLM\Software\Classes\SWEETIE.SWEETIE 
HKLM\Software\Classes\SWEETIE.SWEETIE.1 
HKLM\Software\Classes\ToolBand.SWEETIE 
HKLM\Software\Classes\ToolBand.SWEETIE.1 
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} 
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\{F6D63A65-BD23-46F3-B9A3-87F442423481} 
HKLM\Software\Trymedia Systems 
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{08165EA0-E946-11CF-9C87-00AA005127ED}
HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKLM\Software\Microsoft\Internet Explorer\Toolbar\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{BC4FFE41-DE9F-46FA-B455-AAD49B9F9938}
HKLM\Software\Classes\CLSID\{08165EA0-E946-11CF-9C87-00AA005127ED} 
HKLM\Software\Classes\Interface\{49C929EE-A1B7-4C58-B539-E63BE392B6F3} 
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\980289C22F80A7C4BB9323DC61255E4E 
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\installer\userdata\S-1-5-18\Components\FA96423FE2B98E248A3B23548D1E22D9 
. 
C:\Program Files\Macrogaming 
C:\Program Files\Macrogaming\SweetIM 
C:\Program Files\Macrogaming\SweetIM\conf 
C:\Program Files\Macrogaming\SweetIM\conf\users 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr\emoticons_shortcut.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr\lastuse_Audibles.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr\lastuse_Emoticons.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr\lastuse_SoundFX.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr\lastuse_SpecialFX.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr\lastuse_Winks.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\annesophierivoalen@hotmail.fr\user_config.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\clarissebl@hotmail.fr 
C:\Program Files\Macrogaming\SweetIM\conf\users\clarissebl@hotmail.fr\emoticons_shortcut.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\clarissebl@hotmail.fr\user_config.xml 
C:\Program Files\Macrogaming\SweetIM\conf\users\main_user_config.xml 
C:\Program Files\Macrogaming\SweetIM\data 
C:\Program Files\Macrogaming\SweetIM\data\contentdb 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AE.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100AF.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B0.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B3.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B6.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B7.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100B8.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100BB.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C1.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C5.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C6.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100C9.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CA.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CE.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100CF.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D1.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D2.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D3.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D4.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100D8.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100DA.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100DD.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100E8.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000100FE.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010100.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010104.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010105.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010109.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001010A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001010B.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001010C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001010E.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010119.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001011A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010122.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010124.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010814.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010816.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001081C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001083F.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010842.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010845.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010848.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010849.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084E.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001084F.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010854.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010856.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010857.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010859.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001085A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001085D.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010861.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010862.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010863.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010867.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00010868.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001086E.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001086F.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0001088C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020059.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020069.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006B.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002006E.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020071.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020072.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020075.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020078.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0002007C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020095.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020096.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020098.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020099.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200A9.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200AB.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200BD.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200DA.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\000200ED.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020114.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020132.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00020143.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030001.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030003.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030007.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030009.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003000B.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003000F.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030011.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030013.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030015.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030017.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030019.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003001B.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003001D.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0003001F.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030021.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030023.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030025.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00030027.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040013.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040015.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040018.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040020.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040024.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040029.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004002C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040036.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004003C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040042.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040044.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040046.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040049.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004004A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040050.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040051.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004005A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004006E.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040073.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040076.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040078.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040079.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004007A.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0004007C.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00040081.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050001.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00050002.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\0006007E.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\00060082.dat 
C:\Program Files\Macrogaming\SweetIM\data\contentdb\cache_indx.dat 
C:\Program Files\Macrogaming\SweetIMBarForIE 
C:\Program Files\Macrogaming\SweetIMBarForIE\affid.dat 
C:\Program Files\Macrogaming\SweetIMBarForIE\basis.xml 
C:\Program Files\Macrogaming\SweetIMBarForIE\Bookmarks_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\Cache 
C:\Program Files\Macrogaming\SweetIMBarForIE\Cache\cd2005c66fba47ff715ecc444d3bc1fb.xml 
C:\Program Files\Macrogaming\SweetIMBarForIE\Email_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\Games_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\Greetingcards_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\Mobile_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\Music_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\News_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\Shoping_23x18.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\SmileySmile.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\SmileyWink.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE\sweetimicons.bmp 
C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.crc 
C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.xml 
C:\Program Files\Macrogaming\SweetIMBarForIE\version.txt 
C:\Windows\Installer\1a15ddd.msi 
 
(!) -- Temp files deleted. 
 
.
============== Added scan ==============
.
.
* Mozilla FireFox Version 3.0.13 *
.
 ProfilePath: dnbihuhj.default (Philippe)
.
(Prefs.js) user_pref("browser.startup.homepage", "hxxp://www.google.fr/"); 
(Prefs.js) user_pref("browser.startup.homepage_override.mstone", "rv:1.9.0.13"); 
.
.
* Internet Explorer Version 6.0.2900.5512 *
.
[HKEY_CURRENT_USER\..\Internet Explorer\Main]
.
Start Page: hxxp://fr.msn.com/
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Default_page_url: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Search bar: hxxp://go.microsoft.com/fwlink/?linkid=54896
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\Main]
.
Default_Page_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
Default_Search_URL: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Start Page: hxxp://fr.msn.com/
Search Page: hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
Search bar: hxxp://search.msn.com/spbasic.htm
.
[HKEY_LOCAL_MACHINE\..\Internet Explorer\ABOUTURLS]
.
Tabs: res://ieframe.dll/tabswelcome.htm
.
============== Suspect (Cracks; Serials ... ) ==============
.
C:\Documents and Settings\Philippe\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jta25-patched.jar-5b8ed13e-7db6806f.zip
C:\Documents and Settings\Philippe\Mes documents\jeux\Warlord\PATCH.EXE
.
===================================
.
15309 Byte(s) - C:\Ad-Report-CLEAN.log 
.
0 File(s) - C:\DOCUME~1\Philippe\LOCALS~1\Temp 
18 File(s) - C:\WINDOWS\Temp 
.
18 File(s) - C:\Program Files\Ad-Remover\BACKUP
17 File(s) - C:\Program Files\Ad-Remover\QUARANTINE 
.
End at:  2:09:08 | 13/09/2009
.
============== E.O.F ==============
.

Destrio5 · Answer

--> Relance MBAM, va dans Quarantaine et supprime tout.

--> Télécharge Random's System Information Tool (RSIT) (par random/random) sur ton Bureau.

--> Double-clique sur RSIT.exe afin de lancer le programme.
(Sous Vista, il faut cliquer droit sur RSIT.exe et choisir Exécuter en tant qu'administrateur)

--> Clique sur Continue à l'écran Disclaimer.

--> Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.

--> Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. Poste le contenu de log.txt (c'est celui qui apparaît à l'écran) ainsi que de info.txt (que tu verras dans la barre des tâches).

Note : les rapports sont sauvegardés dans le dossier C:\rsit.

Virus Total Security

4 réponses

Discussions similaires