Cheval de Troie

Salut,

Comment réagit l' antivirus ... si tu en as un !

Salut,

Clique droit sur ce lien pour installer ComboFix (par sUBs) :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Choisis "Enregistrer sous" (dans IE c'est "Enregistrer la cible/le lien sous..")
et sauvegarde-le (Enregistrer dans) sur le Bureau.

Important : dans "Nom du fichier" enregistre (renomme) "combofix" en combo-fix.exe

Prends connaissance de ce tutoriel : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Ferme toutes les fenêtres et applications.
Déconnecte-toi du net et désactive tes protections résidentes :
https://forum.pcastuces.com/default.asp

Sur le bureau, double clique combo-fix.exe.
Tape sur la touche Y (Yes) pour démarrer le scan.
ComboFix redémarrera ton PC.
Lorsque le scan sera complété, un rapport apparaîtra.
Copie/colle ce rapport dans ta prochaine réponse.

PS : Le rapport se trouve également ici : C:\Combofix.txt

Ne clique pas dans la fenêtre de Combofix durant l’analyse : cela pourrait provoquer le gel du programme !

Ensuite, ...

Télécharge, installe et mets à jour Malwarebytes Anti-Malwares …
http://forum.telecharger.01net.com/microhebdo/6/tuto-securite/tuto-malwaresbytes-anti-malware-352008/messages-1.html puis, lance un scan COMPLET et poste le rapport.

PS : si MalwareByte's a détecté des infections, clique sur Afficher les résultats,
puis sur Supprimer la sélection.

Salut kduc je vous remercie pour votre aide ,je crois que ce cheval de Troie est supprimé ,voila le rapport de combofix :
ComboFix 09-10-08.04 - Med_Salah 09/10/2009 15:00.1.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2046.1604 [GMT 2:00]
Lancé depuis: c:\documents and settings\Med_Salah\Bureau\Combo-Fix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Un antivirus résident est actif

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Med_Salah\Application Data\cft
c:\documents and settings\Med_Salah\Application Data\pridl
c:\documents and settings\Med_Salah\Application Data\ShoppingReport
c:\documents and settings\Med_Salah\Application Data\ShoppingReport\cs\Config.xml
c:\documents and settings\Med_Salah\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\documents and settings\Med_Salah\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\documents and settings\Med_Salah\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
c:\documents and settings\Med_Salah\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\documents and settings\Med_Salah\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\documents and settings\Med_Salah\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
c:\documents and settings\Med_Salah\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Med_Salah\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\autorun.inf
c:\program files\FunWebProducts
c:\program files\FunWebProducts\ScreenSaver\Cache\000C12C2.jpg
c:\program files\FunWebProducts\ScreenSaver\Cache\files.ini
c:\program files\FunWebProducts\ScreenSaver\Images\000B41E5.urr
c:\program files\FunWebProducts\ScreenSaver\Images\000C11B8.urr
c:\program files\FunWebProducts\ScreenSaver\Images\000DE669.dat
c:\program files\FunWebProducts\ScreenSaver\Images\101x135\000DE669.jpg
c:\program files\FunWebProducts\ScreenSaver\Images\f3wallpp.bmp
c:\program files\FunWebProducts\ScreenSaver\Images\wrkparam.lst
c:\program files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
c:\program files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
c:\program files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
c:\program files\FunWebProducts\Shared\Cache\WebfettiBtn.html
c:\program files\Jcore
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\2.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\2.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\3.bin\F3BKGERR.JPG
c:\program files\MyWebSearch\bar\3.bin\F3HKSTUB.DLL
c:\program files\MyWebSearch\bar\3.bin\F3REGHK.DLL
c:\program files\MyWebSearch\bar\3.bin\F3SPACER.WMV
c:\program files\MyWebSearch\bar\3.bin\F3WALLPP.DAT
c:\program files\MyWebSearch\bar\3.bin\F3WPHOOK.DLL
c:\program files\MyWebSearch\bar\3.bin\FWPBUDDY.PNG
c:\program files\MyWebSearch\bar\3.bin\M3AUXSTB.DLL
c:\program files\MyWebSearch\bar\3.bin\M3DLGHK.DLL
c:\program files\MyWebSearch\bar\3.bin\M3FFXTBR.JAR
c:\program files\MyWebSearch\bar\3.bin\M3FFXTBR.MANIFEST
c:\program files\MyWebSearch\bar\3.bin\M3NTSTBR.MANIFEST
c:\program files\MyWebSearch\bar\3.bin\M3SLSRCH.EXE
c:\program files\MyWebSearch\bar\3.bin\M3SRCHMN.EXE
c:\program files\MyWebSearch\bar\3.bin\MWSBAR.DLL
c:\program files\MyWebSearch\bar\3.bin\MWSOEPLG.DLL
c:\program files\MyWebSearch\bar\3.bin\MWSSRCAS.DLL
c:\program files\MyWebSearch\bar\Avatar\COMMON.F3S
c:\program files\MyWebSearch\bar\Cache\00020015
c:\program files\MyWebSearch\bar\Cache\000203EE.bin
c:\program files\MyWebSearch\bar\Cache\00020A66.bin
c:\program files\MyWebSearch\bar\Cache\00020D35.bin
c:\program files\MyWebSearch\bar\Cache\00021B1F.bin
c:\program files\MyWebSearch\bar\Cache\0007821E
c:\program files\MyWebSearch\bar\Cache\013C0D9B.bin
c:\program files\MyWebSearch\bar\Cache\013C101C.bin
c:\program files\MyWebSearch\bar\Cache\013C1377.bin
c:\program files\MyWebSearch\bar\Cache\013C1636.bin
c:\program files\MyWebSearch\bar\Cache\013DFAD5
c:\program files\MyWebSearch\bar\Cache\files.ini
c:\program files\MyWebSearch\bar\Game\CHECKERS.F3S
c:\program files\MyWebSearch\bar\Game\CHESS.F3S
c:\program files\MyWebSearch\bar\Game\REVERSI.F3S
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\icons\CM.ICO
c:\program files\MyWebSearch\bar\icons\MFC.ICO
c:\program files\MyWebSearch\bar\icons\PSS.ICO
c:\program files\MyWebSearch\bar\icons\SMILEY.ICO
c:\program files\MyWebSearch\bar\icons\WB.ICO
c:\program files\MyWebSearch\bar\icons\ZWINKY.ICO
c:\program files\MyWebSearch\bar\Message\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\COMMON.F3S
c:\program files\MyWebSearch\bar\Notifier\DOG.F3S
c:\program files\MyWebSearch\bar\Notifier\FISH.F3S
c:\program files\MyWebSearch\bar\Notifier\KUNGFU.F3S
c:\program files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
c:\program files\MyWebSearch\bar\Notifier\MAID.F3S
c:\program files\MyWebSearch\bar\Notifier\MAILBOX.F3S
c:\program files\MyWebSearch\bar\Notifier\OPERA.F3S
c:\program files\MyWebSearch\bar\Notifier\ROBOT.F3S
c:\program files\MyWebSearch\bar\Notifier\SEDUCT.F3S
c:\program files\MyWebSearch\bar\Notifier\SURFER.F3S
c:\program files\MyWebSearch\bar\Settings\prevcfg2.htm
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\ShoppingReport
c:\program files\ShoppingReport\Uninst.exe
c:\program files\WWShow
c:\program files\WWShow\WWSHow.dll
c:\slimen\PHP\Arab formation php\-_FILE~1\Desktop_.ini
c:\slimen\PHP\Arab formation php\_FILES~1\Desktop_.ini
c:\slimen\PHP\Arab formation php\_FILES~2\Desktop_.ini
c:\slimen\PHP\Arab formation php\Desktop_.ini
c:\slimen\PHP\Arab formation php\MYSQL_~1\Desktop_.ini
c:\slimen\PHP\Arab formation php\MYSQL_~2\Desktop_.ini
c:\slimen\PHP\Arab formation php\OOP_FI~1\Desktop_.ini
c:\slimen\PHP\Arab formation php\PHP__F~1\Desktop_.ini
c:\slimen\PHP\Arab formation php\PHP_files\Desktop_.ini
c:\slimen\PHP\Arab formation php\PHP~1._FI\Desktop_.ini
c:\slimen\PHP\Arab formation php\REGIST~1\Desktop_.ini
c:\slimen\PHP\Arab formation php\The Text Counter_files\Desktop_.ini
c:\slimen\PHP\PHP Manual\CVS\Desktop_.ini
c:\slimen\PHP\PHP Manual\Desktop_.ini
c:\slimen\PHP\W - Developer Shed Network\Desktop_.ini
c:\windows\a3kebook.ini
c:\windows\AegisP.inf
c:\windows\akebook.ini
c:\windows\ANS2000.INI
c:\windows\autorun.inf
c:\windows\msa.exe
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\Config.xml
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\db\Aliases.dbs
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\db\Sites.dbs
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\report\aggr_storage.xml
c:\windows\system32\config\systemprofile\Application Data\ShoppingReport\cs\report\send_storage.xml
c:\windows\system32\drivers\kbiwkmbpjewsrn.sys
c:\windows\system32\drivers\kmfurcgjbtmuq.sys
c:\windows\system32\drivers\str.sys
c:\windows\system32\kbiwkmmqshqqdp.dll
c:\windows\system32\kbiwkmorfprkda.dll
c:\windows\system32\kbiwkmrfwowfvx.dll
c:\windows\system32\kbiwkmsxrhovjy.dat
c:\windows\system32\kbiwkmtwhmoycf.dat
c:\windows\system32\kbiwkmupqoqxmv.dll
c:\windows\system32\kbiwkmxmitetir.dll

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_kbiwkmvdyibquw
-------\Legacy_kbiwkmvdyibquw
-------\Legacy_BFNUKGBVUWGN
-------\Legacy_MYWEBSEARCHSERVICE
-------\Legacy_SYNSEND
-------\Service_MyWebSearchService
-------\Service_synsend

((((((((((((((((((((((((((((( Fichiers créés du 2009-09-09 au 2009-10-09 ))))))))))))))))))))))))))))))))))))
.

2009-10-08 22:30 . 2009-10-08 22:31 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\GetRightToGo
2009-10-08 22:30 . 2009-10-08 22:30 -------- d-----w- C:\Downloads
2009-10-08 21:59 . 2002-06-02 15:05 38912 ----a-w- c:\windows\system32\ProSoftLK.dll
2009-10-08 21:59 . 1999-09-28 18:42 1050896 ----a-w- c:\windows\system32\msjet35.dll
2009-10-08 21:59 . 1999-09-09 19:06 252688 ----a-w- c:\windows\system32\msexcl35.dll
2009-10-08 21:59 . 1999-08-03 21:00 24848 ----a-w- c:\windows\system32\msjter35.dll
2009-10-08 21:59 . 1999-08-03 21:00 123664 ----a-w- c:\windows\system32\msjint35.dll
2009-10-08 21:59 . 1998-09-15 22:12 262144 ----a-w- c:\windows\system32\msrd2x35.dll
2009-10-08 21:59 . 1998-06-16 21:00 94285 ----a-w- c:\windows\system32\MSVCIRTD.DLL
2009-10-08 21:59 . 1998-06-16 21:00 929844 ----a-w- c:\windows\system32\MFC42D.DLL
2009-10-08 21:59 . 1998-06-16 21:00 798773 ----a-w- c:\windows\system32\MFCO42D.DLL
2009-10-08 21:59 . 1998-06-16 21:00 385100 ----a-w- c:\windows\system32\MSVCRTD.DLL
2009-10-08 21:59 . 1998-06-16 21:00 274485 ----a-w- c:\windows\system32\MFCD42D.DLL
2009-10-08 21:58 . 1997-11-19 12:49 303616 ----a-w- c:\windows\IsUninst.exe
2009-10-08 12:48 . 2009-10-08 12:48 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
2009-10-08 06:24 . 2009-10-08 06:24 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-10-07 22:38 . 2009-10-07 22:38 -------- dc-h--w- c:\windows\ie8
2009-10-05 18:08 . 2009-10-05 18:08 -------- d-----w- C:\Convertedpsp
2009-10-05 18:08 . 2009-10-05 18:08 -------- d-----w- C:\Converted
2009-10-04 21:19 . 2009-10-04 21:19 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\Phoeniixz
2009-10-04 18:10 . 2009-10-04 18:10 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\com.zoosk.Desktop.096E6A67431258A508A2446A847B240591D2C99B.1
2009-10-04 18:10 . 2009-10-04 18:10 -------- d-----w- c:\program files\Fichiers communs\Adobe AIR
2009-10-04 14:35 . 2009-10-04 14:35 -------- d-----w- C:\spoolerlogs
2009-10-04 14:32 . 2009-10-04 14:32 18432 ----a-w- c:\windows\ss3unstl.exe
2009-10-04 14:32 . 2009-10-04 14:32 4179888 ----a-w- c:\windows\system32\Nacho Libre.scr
2009-09-30 22:00 . 2009-09-30 22:00 -------- d-----w- c:\program files\Pinnacle
2009-09-30 22:00 . 2009-09-30 22:00 -------- d-----w- c:\program files\Fichiers communs\Yahoo!
2009-09-30 22:00 . 2009-09-30 22:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Pinnacle VideoSpin
2009-09-30 21:58 . 2009-09-30 21:58 -------- d-----w- c:\documents and settings\All Users\Application Data\Pinnacle
2009-09-30 21:58 . 2009-09-30 21:58 -------- d-----w- c:\documents and settings\Med_Salah\Local Settings\Application Data\Downloaded Installations
2009-09-30 21:18 . 2005-07-13 18:42 161280 ----a-w- c:\windows\system32\fmod.dll
2009-09-30 21:18 . 2001-04-27 21:11 24576 ----a-w- c:\windows\system32\smartsubclass.dll
2009-09-30 21:18 . 1999-09-08 23:51 40208 ----a-w- c:\windows\system32\dsetup.dll
2009-09-30 21:14 . 2009-09-30 21:30 -------- d-----w- c:\program files\Web Photo Album
2009-09-25 23:26 . 2009-09-25 23:26 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\Nvu
2009-09-25 23:21 . 2009-09-25 23:21 -------- d-----w- c:\program files\Crimson Editor
2009-09-25 10:45 . 2009-09-27 19:49 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\FileZilla
2009-09-25 10:45 . 2009-09-25 10:45 -------- d-----w- c:\program files\FileZilla Client
2009-09-23 17:27 . 2009-10-07 11:28 -------- d-----w- c:\documents and settings\Med_Salah\Local Settings\Application Data\Temp
2009-09-22 22:46 . 2009-09-22 22:46 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
2009-09-22 21:35 . 2009-09-22 21:35 -------- d-----w- c:\documents and settings\Med_Salah\Local Settings\Application Data\ESET
2009-09-22 21:34 . 2009-09-22 21:34 -------- d-----w- c:\program files\ESET
2009-09-22 21:34 . 2009-09-22 21:34 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-09-22 20:38 . 2009-09-22 20:38 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\Uniblue
2009-09-21 10:25 . 2009-09-21 10:25 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\Windows Live Writer
2009-09-21 10:25 . 2009-09-21 10:25 -------- d-----w- c:\documents and settings\Med_Salah\Local Settings\Application Data\Windows Live Writer
2009-09-17 22:10 . 2009-09-17 22:10 -------- d-----w- c:\program files\IMProDeskTop
2009-09-15 21:28 . 2009-09-15 21:29 -------- d-----w- c:\program files\FaceMorpher Lite
2009-09-15 21:18 . 2009-09-15 21:18 -------- d-----w- c:\documents and settings\Med_Salah\Local Settings\Application Data\MAGIX
2009-09-15 21:18 . 2009-09-15 21:18 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\MAGIX
2009-09-15 21:18 . 2003-04-18 13:46 1233920 ----a-w- c:\windows\system32\msxml4.dll
2009-09-15 21:18 . 2003-04-18 13:29 82432 ----a-w- c:\windows\system32\msxml4r.dll
2009-09-15 21:18 . 2003-04-18 13:29 44544 ----a-w- c:\windows\system32\msxml4a.dll
2009-09-15 21:18 . 2009-09-15 21:18 -------- d-----w- c:\documents and settings\All Users\Application Data\MAGIX
2009-09-15 21:18 . 2009-09-15 21:18 -------- d-----w- c:\program files\MAGIX
2009-09-15 21:18 . 2007-04-27 07:43 120200 ----a-w- c:\windows\system32\DLLDEV32i.dll
2009-09-15 21:18 . 2009-09-15 21:18 -------- d-----w- c:\windows\system32\MAGIX
2009-09-15 21:18 . 2008-04-15 13:14 700416 ----a-w- c:\windows\system32\mgxoschk.dll
2009-09-15 21:17 . 2009-09-15 21:18 -------- d-----w- c:\program files\Lovely Cats
2009-09-15 20:04 . 2009-09-15 20:04 32768 ----a-w- c:\windows\system32\drivers\taphss.sys
2009-09-14 13:14 . 2009-10-09 12:04 -------- d-----w- c:\documents and settings\Med_Salah\Tracing
2009-09-14 12:58 . 2009-09-14 12:58 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-14 12:58 . 2009-09-14 12:58 -------- d-----w- c:\program files\Microsoft Office Outlook Connector
2009-09-14 12:57 . 2009-08-05 20:48 54752 ----a-w- c:\windows\system32\drivers\fssfltr_tdi.sys
2009-09-14 12:57 . 2009-09-14 12:57 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-14 12:56 . 2006-11-29 11:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-09-14 12:56 . 2009-09-14 12:56 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-14 12:55 . 2009-09-14 12:58 -------- d-----w- c:\program files\Microsoft
2009-09-14 12:55 . 2009-09-14 12:55 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-14 12:54 . 2009-09-14 12:57 -------- d-----w- c:\program files\Windows Live
2009-09-14 12:33 . 2009-09-14 12:33 -------- d-----w- c:\program files\Fichiers communs\Windows Live
2009-09-12 12:25 . 2009-09-12 12:25 -------- d-----w- c:\windows\Sun
2009-09-11 20:07 . 2009-10-05 18:15 -------- d-----w- c:\program files\Total Video Converter
2009-09-11 19:16 . 2009-09-11 19:16 -------- d-----w- C:\My Videos
2009-09-11 19:16 . 2009-09-11 19:16 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\aHisoft
2009-09-11 19:16 . 2009-09-11 19:16 -------- d-----w- c:\program files\aHisoft
2009-09-11 17:52 . 2009-09-20 15:11 -------- d-----w- C:\UsbFix

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-09 13:17 . 2009-09-07 14:53 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\Skype
2009-10-09 13:03 . 2008-04-14 12:00 81028 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-09 13:03 . 2008-04-14 12:00 502196 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-09 12:58 . 2009-08-31 11:56 -------- d-----w- c:\program files\SuperCopier2
2009-10-09 08:14 . 2009-09-07 16:26 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\skypePM
2009-10-07 22:25 . 2009-08-31 11:22 -------- d-----w- c:\documents and settings\All Users\Application Data\PowerAMC 12
2009-10-01 00:17 . 2009-09-07 13:12 -------- d-----w- c:\program files\Google
2009-09-30 22:03 . 2009-07-26 12:41 96152 ----a-w- c:\documents and settings\Med_Salah\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-22 23:55 . 2009-09-05 16:14 -------- d-----w- c:\program files\MSN Messenger
2009-09-20 12:03 . 2009-07-26 14:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-18 20:27 . 2009-09-03 11:00 -------- d-----w- c:\program files\EasyPHP 3.0
2009-09-18 20:18 . 2009-07-28 14:13 -------- d-----w- c:\program files\URUSoft
2009-09-16 20:09 . 2009-09-06 13:15 -------- d-----w- c:\program files\Hotspot Shield
2009-09-15 20:04 . 2009-07-02 02:34 37376 ----a-w- c:\windows\system32\drivers\hssdrv.sys
2009-09-07 16:26 . 2009-09-07 16:26 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-09-07 13:12 . 2009-09-07 13:11 -------- d-----r- c:\program files\Skype
2009-09-07 13:12 . 2009-09-07 13:12 -------- d-----w- c:\program files\Fichiers communs\Skype
2009-09-07 13:11 . 2009-09-07 13:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-09-07 13:03 . 2009-07-26 14:08 -------- d-----w- c:\program files\MSBuild
2009-09-07 13:03 . 2009-09-07 13:03 -------- d-----w- c:\program files\Reference Assemblies
2009-09-06 21:20 . 2009-07-29 18:16 -------- d-----w- c:\program files\Java
2009-09-06 21:09 . 2009-09-06 21:09 0 ----a-w- c:\windows\system32\cd.dat
2009-09-06 13:16 . 2009-09-06 13:16 -------- d-----w- c:\program files\Hotspot_Shield
2009-09-06 13:16 . 2009-09-06 13:16 -------- d-----w- c:\program files\Conduit
2009-09-05 16:17 . 2009-09-05 16:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Windows Live Toolbar
2009-09-03 15:00 . 2009-08-31 11:22 -------- d-----w- c:\program files\Sybase
2009-08-31 12:03 . 2009-08-31 12:03 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\Winamp
2009-08-31 12:00 . 2009-08-31 12:00 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\Notepad++
2009-08-31 11:22 . 2009-07-26 12:52 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-29 09:58 . 2009-08-25 08:12 -------- d-----w- c:\program files\Microsoft Etudes
2009-08-25 08:11 . 2009-08-25 08:11 -------- d-----w- c:\program files\Learning Essentials
2009-08-18 15:46 . 2009-08-18 15:44 -------- d-----w- c:\program files\Satsuki Decoder Pack
2009-08-12 18:27 . 2009-08-04 18:41 -------- d-----w- c:\documents and settings\Med_Salah\Application Data\f2fElementary
2009-08-05 09:00 . 2008-04-14 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-01 15:34 . 2009-08-01 15:34 4608 ----a-w- c:\windows\system32\w95inf32.dll
2009-08-01 15:34 . 2009-08-01 15:34 2272 ----a-w- c:\windows\system32\w95inf16.dll
2009-07-29 04:35 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-07-29 04:35 . 2008-04-14 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-07-27 07:40 . 2009-07-27 07:40 0 --sh--w- c:\windows\SF6E0144B.tmp
2009-07-26 20:13 . 2009-07-26 20:13 0 ----a-w- c:\windows\nsreg.dat
2009-07-26 14:44 . 2009-07-26 14:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-26 13:18 . 2009-07-26 13:18 0 ----a-w- c:\windows\ativpsrm.bin
2009-07-26 13:15 . 2009-07-26 13:15 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-07-26 13:15 . 2009-07-26 13:15 21361 ----a-w- c:\windows\AegisP.sys
2009-07-26 13:15 . 2009-07-26 13:09 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2009-07-26 12:53 . 2009-07-26 12:53 315392 ----a-w- c:\windows\HideWin.exe
2009-07-26 12:31 . 2009-07-26 12:31 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-07-25 03:23 . 2009-07-29 18:10 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-22 19:13 . 2009-07-22 19:13 28592 ----a-w- c:\windows\system32\drivers\tap0901.sys
2009-07-17 19:03 . 2008-04-14 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 10:21 . 2008-04-14 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-13 10:07 . 2009-07-13 10:07 89600 ----a-w- c:\program files\mozilla firefox\components\WWShow.dll
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]
2009-07-02 08:18 2215960 ----a-w- c:\program files\Hotspot_Shield\tbHots.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F9E4A054-E9B1-4BC3-83A3-76A1AE736170}]
2009-09-06 13:16 218160 ----a-w- c:\program files\Hotspot Shield\hssie\HssIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{c95a4e8e-816d-4655-8c79-d736da1adb6d}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{C95A4E8E-816D-4655-8C79-D736DA1ADB6D}"= "c:\program files\Hotspot_Shield\tbHots.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{c95a4e8e-816d-4655-8c79-d736da1adb6d}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="c:\program files\SuperCopier2\SuperCopier2.exe" [2006-07-07 1052672]
"MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-09-02 25623336]
"L08FXLRD_7241359"="d:\microsoft encarta\microsoft encarta\Microsoft Encarta 2008 - Études DVD\EDICT.EXE" [2007-06-12 351000]
"WPPChanger"="d:\program files\WallPapa\WPPChanger.exe" [2009-06-12 896512]
"WPPAgent"="d:\program files\WallPapa\WPPAgent.exe" [2009-06-12 22016]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-12 53248]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2008-03-04 999424]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2008-03-04 1101824]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2006-04-29 94208]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-05-29 16132608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-4-1 568176]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Documents and Settings\\Med_Salah\\Bureau\\eclipse\\eclipse.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\c\\Program Files\\EasyPHP 3.0\\mysql\\bin\\mysqld.exe"=
"c:\\Program Files\\EasyPHP 3.0\\mysql\\bin\\mysqld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"d:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"d:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"d:\\Program Files\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [14/05/2009 15:47 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [14/05/2009 15:49 94360]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [14/05/2009 15:47 731840]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [14/09/2009 14:57 54752]
R2 HssSrv;Hotspot Shield Routing Service;c:\program files\Hotspot Shield\HssWPR\hsssrv.exe [15/09/2009 22:04 331824]
R3 taphss;Anchorfree HSS Adapter;c:\windows\system32\drivers\taphss.sys [15/09/2009 22:04 32768]
S2 bfnukgbvuwgn;bfnukgbvuwgn;\??\c:\windows\system32\drivers\kmfurcgjbtmuq.sys --> c:\windows\system32\drivers\kmfurcgjbtmuq.sys [?]
S2 gupdate1ca2fbcec4a39c8;Service Google Update (gupdate1ca2fbcec4a39c8);c:\program files\Google\Update\GoogleUpdate.exe [07/09/2009 15:12 133104]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 22:48 704864]
S3 HssTrayService;Hotspot Shield Tray Service;c:\program files\Hotspot Shield\bin\HssTrayService.exe [15/09/2009 22:29 57640]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [14/06/2008 10:13 576680]
S3 tap0901;TAP-Win32 Adapter V9;c:\windows\system32\drivers\tap0901.sys [22/07/2009 21:13 28592]
S3 Tomcat6;Apache Tomcat;"d:\program files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe" //RS//Tomcat6 --> d:\program files\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe [?]

--- Autres Services/Pilotes en mémoire ---

*Deregistered* - mchInjDrv

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contenu du dossier 'Tâches planifiées'

2009-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-07 13:12]

2009-10-09 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-07 13:12]

2009-10-09 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-09-07 20:18]
.
.
------- Examen supplémentaire -------
.
uStart Page = hxxp://search.mywebsearch.com/mywebsearch/default.jhtml?ptnrS=ZRfox000&ptb=G4ZNsnpAaS2AJ06t8LrXNA
uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRfox000&fl=0&ptb=G4ZNsnpAaS2AJ06t8LrXNA&url=https://hp.mywebsearch.com/mywebsearch/index.html{searchTerms}
uInternet Settings,ProxyServer = 172.16.128.1:8080
uSearchURL,(Default) = hxxp://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Envoyer au périphérique &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
FF - ProfilePath - c:\documents and settings\Med_Salah\Application Data\Mozilla\Firefox\Profiles\vwskd2aw.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1561552&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - hxxp://www.google.fr/
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZRfox000&fl=0&ptb=G4ZNsnpAaS2AJ06t8LrXNA&url=https://hp.mywebsearch.com/mywebsearch/index.html
FF - prefs.js: network.proxy.http - 172.16.128.1
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\Med_Salah\Application Data\Mozilla\Firefox\Profiles\vwskd2aw.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - component: c:\program files\Mozilla Firefox\components\WWShow.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-L08FXLRD_2285093 - d:\program files\Microsoft Etudes\Microsoft Encarta 2008 - Études DVD\EDICT.EXE
HKLM-Run-WinampAgent - e:\winamp\winampa.exe
HKLM-Run-MyWebSearch Plugin - c:\progra~1\MYWEBS~1\bar\3.bin\M3PLUGIN.DLL
HKLM-Run-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~1\bar\3.bin\m3SrchMn.exe
AddRemove-Apache Tomcat 6.0 - d:\program files\Apache Software Foundation\Tomcat 6.0\Uninstall.exe
AddRemove-AVI ReComp - d:\program files\AVI ReComp\Uninstall.exe
AddRemove-Avisynth - d:\program files\AviSynth 2.5\Uninstall.exe
AddRemove-DebugMode Wink - d:\program files\DebugMode\Wink\uninst.exe
AddRemove-DivX Content Uploader - d:\program files\DivX\DivXContentUploaderUninstall.exe
AddRemove-TMM70 - d:\program files\Auralog\TELL ME MORE SI PLUS\Bin\unsetup.exe
AddRemove-VobSub - d:\program files\Gabest\VobSub\uninstall.exe
AddRemove-WampServer 2_is1 - d:\wamp\unins000.exe
AddRemove-Xvid_is1 - d:\program files\Xvid\unins000.exe
AddRemove-{7585478E9D9B42108671C12F8714CEFE} - d:\program files\DivX\ConverterUninstall.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - d:\program files\DivX\DivXCodecUninstall.exe
AddRemove-{8ADFC4160D694100B5B8A22DE9DCABD9} - d:\program files\DivX\DivXPlayerUninstall.exe
AddRemove-{B13A7C41581B411290FBC0395694E2A9} - d:\program files\DivX\ConverterUninstall.exe
AddRemove-{B7050CBDB2504B34BC2A9CA0A692CC29} - d:\program files\DivX\DivXWebPlayerUninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-09 15:15
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\c:\docume~1\MED_SA~1\LOCALS~1\Temp\mc2C.tmp"
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(1156)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\netprovcredman.dll

- - - - - - - > 'explorer.exe'(3812)
c:\program files\SuperCopier2\SC2Hook.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Hotspot Shield\bin\openvpnas.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\docume~1\MED_SA~1\LOCALS~1\temp\RtkBtMnt.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Heure de fin: 2009-10-09 15:20 - La machine a redémarré
ComboFix-quarantined-files.txt 2009-10-09 13:20

Avant-CF: 75 563 913 216 octets libres
Après-CF: 75 696 259 072 octets libres

460 --- E O F --- 2009-09-07 13:09

Salut,

Fais un scan HijackThis :
http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/hijackthis-version-install-sujet_199100_1.htm ... et poste le rapport.

Salut,

(si ce n’ est déjà fait) Télécharge CCleaner :
http://www.filehippo.com/download_ccleaner.html
("Download Latest Version", sur la droite) et laisse-toi guider.
A un moment, il te sera demandé de cocher :
"Ajouter la barre d' outils Yahoo". Refuse et …
Laisse-le s’ installer tel que …

-------
Redémarre le PC en mode sans échec ...
https://www.pcastuces.com/pratique/windows/mode_sans_echec/page2.html
(méthode F8 de préférence)

--------------------------------------------
Tu n' auras pas accès à Internet pendant le "mode sans échec".
Aussi, copie/colle la procédure dans un fichier texte (word) et mets-la
sur le "bureau" pour l' avoir à ta disposition.
--------------------------------------------

Ferme toutes les fenêtres et applications.
Relance HijackThis et clique sur > Do a system scan only puis, coche
les cases devant les lignes qui suivent (et uniquement ces lignes), si tjrs présentes :

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://hp.mywebsearch.com/mywebsearch/index.html
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - Startup: Anti-Autorun-inf.lnk = D:\Program Files\Prg Chris\Anti-Autorun.inf\Anti-Autorun.inf.exe
O23 - Service: wampapache - Unknown owner - d:\wamp\bin\apache\apache2.2.11\bin\httpd.exe (file missing)
O23 - Service: wampmysqld - Unknown owner - d:\wamp\bin\mysql\mysql5.1.33\bin\mysqld.exe (file missing)

Ensuite, clique sur > Fix checked et valide par "Yes". Referme HijackThis.

Lance CCleaner ...
Clique sur > Analyser > Nettoyer, puis sur OK dans la fenêtre qui s' affiche.
(re)Lance le nettoyage et (re)confirme par OK.

Redémarre le PC en mode normal ...

Relance un scan Malwarebytes et poste le rapport.

Fais de même avec Nod32.