virus b .exe quelle marche a suivre?Fermé

Question

Bonjour,

J'ai vu plusieurs sujets qui étaient en rapport avec mon problème mais généralement, la marche a suivre parait propre a la personne en difficulté, c'est pourquoi j'ouvre un nouveau sujet .
Alors voila AVG me detecte un cheval de troie nommé "b .exe" et se trouvant dans : 
"C:\Documents and Settings\Sam\Local Settings\Temp" 

J'aimerais savoir comment supprimer définitivement ce cheval de troie?

Merci d'avance !

jean jim · Answer

avc un scanner tout simplement je suis prés a parié que c'est un trojan netbus

Utilisateur anonyme · Answer

malwarebytes' anti-malwares 

a+

sam · Answer

je fais quoi ensuite après l'analyse de Malwarebytes?

jean jim · Answer

tu as deux solution une chiante un moin si tu eut desactivé le trojan qui se lance a chaque foi ke tu demarre ton pc fait "Ctrl-alt-suppr"" gestionnaire de tache procéssus et la tu regarde il doit y avoir un fichier b.exe tu clic dessus et tu fait fin de tache sa te permetera de ne pas etre piraté en attendant de trouver une solution apré c'est le scan et la tu na jst qu'a faire mettre en quarentaine ou suprimé

sam · Answer

j'ai d'autre virus finalement que j'arrive pas a supprimer quelqu'un pourrait m'aider?

Utilisateur anonyme · Answer

Salut ,

&#9654; Télécharge random's system information tool (RSIT) et sauvegarde-le sur le Bureau. 

• Double-clique sur RSIT.exe afin de lancer RSIT. 

• Lis le contenu de l'écran Disclaimer puis clique sur Continue (si tu acceptes les conditions). 

• Si l'outil HijackThis (version à jour) n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence. 

• Lorsque l'analyse sera terminée, deux fichiers texte s'ouvriront. 

• Poste le contenu de log.txt .

• Tuto : https://forum.pcastuces.com/randoms_system_information_tool_rsit-f31s31.htm

sam · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by sam at 2009-10-29 18:59:11
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 37 GB (74%) free of 50 GB
Total RAM: 3071 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:59:25, on 29/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
C:\PROGRA~1\AVG\AVG8\avgtray .exe
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon .exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Documents and Settings\sam\Bureau\RSIT.exe
C:\Program Files	rend micro\sam.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://runonce.msn.com/runonce3.aspx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation
View
wiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "E:\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

&#9654; Télécharge OTM de OldTimer sur ton Bureau. 

• Double-clique sur OTM.exe afin de le lancer. 

• Copie (Ctrl+C) le texte suivant ci-dessous : 



:processes 
explorer.exe 

:files 
C:\ToolBar SD 
C:\WINDOWS\system32\ewmgafx.exe
C:\WINDOWS\system32\lphcpn8j0en97.exe 
C:\WINDOWS\system32\lphcpn8j0en97 .exe 
C:\Program Files\Desktop Defender 2010
C:\DOCUME~1\sam\LOCALS~1\Temp\b .exe 
C:\WINDOWS	asks\At1.job 
C:\WINDOWS	asks\At10.job 
C:\WINDOWS	asks\At11.job 
C:\WINDOWS	asks\At12.job 
C:\WINDOWS	asks\At13.job 
C:\WINDOWS	asks\At14.job 
C:\WINDOWS	asks\At15.job 
C:\WINDOWS	asks\At16.job 
C:\WINDOWS	asks\At17.job 
C:\WINDOWS	asks\At18.job 
C:\WINDOWS	asks\At19.job 
C:\WINDOWS	asks\At2.job 
C:\WINDOWS	asks\At20.job 
C:\WINDOWS	asks\At21.job 
C:\WINDOWS	asks\At22.job 
C:\WINDOWS	asks\At23.job 
C:\WINDOWS	asks\At24.job 
C:\WINDOWS	asks\At3.job 
C:\WINDOWS	asks\At4.job 
C:\WINDOWS	asks\At5.job 
C:\WINDOWS	asks\At6.job 
C:\WINDOWS	asks\At7.job 
C:\WINDOWS	asks\At8.job 
C:\WINDOWS	asks\At9.job 

:reg 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] 
"C:\WINDOWS\system32\ewmgafx.exe"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Defender 2010] 
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopRock] 
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}] 

:commands 
[emptytemp] 
[reboot] 



• Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

• Clique maintenant sur le bouton MoveIt! puis ferme OTM. 

&#9654; Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
&#9654; Accepte en cliquant sur YES. 

• Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

sam · Answer

il a rebooté mon Pc et donc sa me donne ça:



All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
C:\ToolBar SD moved successfully.
File/Folder C:\WINDOWS\system32\ewmgafx.exe not found.
File/Folder C:\WINDOWS\system32\lphcpn8j0en97.exe not found.
C:\WINDOWS\system32\lphcpn8j0en97 .exe moved successfully.
File/Folder C:\Program Files\Desktop Defender 2010 not found.
File/Folder C:\DOCUME~1\sam\LOCALS~1\Temp\b .exe not found.
C:\WINDOWS	asks\At1.job moved successfully.
C:\WINDOWS	asks\At10.job moved successfully.
C:\WINDOWS	asks\At11.job moved successfully.
C:\WINDOWS	asks\At12.job moved successfully.
C:\WINDOWS	asks\At13.job moved successfully.
C:\WINDOWS	asks\At14.job moved successfully.
C:\WINDOWS	asks\At15.job moved successfully.
C:\WINDOWS	asks\At16.job moved successfully.
C:\WINDOWS	asks\At17.job moved successfully.
C:\WINDOWS	asks\At18.job moved successfully.
C:\WINDOWS	asks\At19.job moved successfully.
C:\WINDOWS	asks\At2.job moved successfully.
C:\WINDOWS	asks\At20.job moved successfully.
C:\WINDOWS	asks\At21.job moved successfully.
C:\WINDOWS	asks\At22.job moved successfully.
C:\WINDOWS	asks\At23.job moved successfully.
C:\WINDOWS	asks\At24.job moved successfully.
C:\WINDOWS	asks\At3.job moved successfully.
C:\WINDOWS	asks\At4.job moved successfully.
C:\WINDOWS	asks\At5.job moved successfully.
C:\WINDOWS	asks\At6.job moved successfully.
C:\WINDOWS	asks\At7.job moved successfully.
C:\WINDOWS	asks\At8.job moved successfully.
C:\WINDOWS	asks\At9.job moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list\C:\WINDOWS\system32\ewmgafx.exe deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Desktop Defender 2010\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PopRock\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5C255C8A-E604-49b4-9D64-90988571CECB}\ not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 131686937 bytes
->Temporary Internet Files folder emptied: 2952673 bytes
->FireFox cache emptied: 36464469 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 33170 bytes
 
User: sam
->Temp folder emptied: 562393 bytes
->Temporary Internet Files folder emptied: 5905113 bytes
->FireFox cache emptied: 46760943 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2114937 bytes
%systemroot%\System32 .tmp files removed: 3072 bytes
Windows Temp folder emptied: 93554 bytes
RecycleBin emptied: 352111133 bytes
 
Total Files Cleaned = 551,94 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 10292009_191458

Files moved on Reboot...

Registry entries deleted on Reboot...

Utilisateur anonyme · Answer

impec ;) 

• Télécharge UsbFix sur ton bureau .

http://pagesperso-orange.fr/NosTools/Chiquitine29/UsbFix.exe
https://www.androidworld.fr/

 (!) Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) susceptible d'avoir été infectées sans les ouvrir

• Double clic sur "UsbFix.exe" présent sur ton bureau .

• Choisis l'option F pour français et tape sur [entrée] .

• Choisis l'option 1 ( Recherche ) et tape sur [entrée] .

• Laisse travailler l'outil.

• Ensuite post le rapport UsbFix.txt qui apparaitra.

• Note : Le rapport UsbFix.txt est sauvegardé a la racine du disque. ( C:\UsbFix.txt )

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

• Note : "Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
          Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
          Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. 

• Tuto : http://pagesperso-orange.fr/NosTools/usbfix.html

sam · Answer

euh usb fixe ne marche pas!
il s'ouvre et se referme très rapidement!

Utilisateur anonyme · Answer

Supprime UsbFix.exe que tu viens de telecharger et essai celui ci stp :

https://www.androidworld.fr/

sam · Answer

aucun changement

Utilisateur anonyme · Answer

tans pis ,

Refais un scan RSIT et post le nouveau rapport log.txt stp

sam · Answer

Logfile of random's system information tool 1.06 (written by random/random)
Run by sam at 2009-10-29 19:45:41
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 37 GB (75%) free of 50 GB
Total RAM: 3071 MB (79% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:45:47, on 29/10/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\SkyTel.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray .exe
C:\Program Files\HP\Digital Imaging\bin\hpqSRMon .exe
C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Documents and Settings\sam\Bureau\RSIT.exe
C:\Program Files	rend micro\sam.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation
View
wiz.exe /install
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "E:\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Sélection intelligente HP - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Utilisateur anonyme · Answer

Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 




-> Double clique sur combofix.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil. 

Une fois fait, sur ton bureau double-clic sur Combofix.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet. 

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

sam · Answer

comment désactiver mon antivirus je le ferme mais il me dit qu'il est toujours actif

Utilisateur anonyme · Answer

passe outre l avertissement .

sam · Answer

ComboFix 09-10-28.08 - sam 29/10/2009 20:08.1.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.3071.2610 [GMT 1:00]
Lancé depuis: c:\documents and settings\sam\Bureau\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\sam\alcmtr .exe
c:\documents and settings\samthdcpl .exe
c:\documents and settings\sam\skytel .exe
c:\windows\system32\alcmtr .exe
c:\windows\system32\ctfmon .exe
c:\windows\system32thdcpl .exe
c:\windows\system32\skytel .exe
D:\autorun.inf

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-28 au 2009-10-29  ))))))))))))))))))))))))))))))))))))
.

2009-10-29 18:24 . 2009-10-29 18:38	--------	d-----w-	C:\UsbFix
2009-10-29 18:14 . 2009-10-29 18:14	--------	d-----w-	C:\_OTM
2009-10-29 17:59 . 2009-10-29 18:45	--------	d-----w-	c:\program files	rend micro
2009-10-29 17:59 . 2009-10-29 17:59	--------	d-----w-	C:sit
2009-10-29 14:37 . 2009-10-29 14:37	--------	d-----w-	c:\documents and settings\sam\Application Data\Malwarebytes
2009-10-29 14:37 . 2009-09-10 13:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-29 14:37 . 2009-10-29 14:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-29 14:37 . 2009-09-10 13:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-29 13:23 . 2009-10-29 18:17	30208	----a-w-	c:\documents and settings\sam\alcmtr.exe
2009-10-29 13:23 . 2009-10-29 18:16	30208	----a-w-	c:\documents and settings\samthdcpl.exe
2009-10-29 13:23 . 2009-10-29 18:16	30208	----a-w-	c:\documents and settings\sam\skytel.exe
2009-10-29 13:09 . 2009-10-29 13:09	--------	d-----w-	c:\documents and settings\sam\Application Data\Uniblue
2009-10-29 13:09 . 2009-10-29 13:09	--------	d-----w-	c:\program files\Uniblue
2009-10-29 12:14 . 2009-10-29 12:14	93360	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 12:11 . 2009-10-29 12:11	--------	d-----w-	c:\documents and settings\LocalService\Bureau
2009-10-29 12:09 . 2009-10-29 13:25	--------	d-----w-	c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-28 18:18 . 2009-10-29 13:51	30208	----a-w-	c:\windows\system32\alcmtr.exe
2009-10-28 18:18 . 2009-10-29 13:51	30208	----a-w-	c:\windows\system32thdcpl.exe
2009-10-28 18:18 . 2009-10-29 13:51	30208	----a-w-	c:\windows\system32\skytel.exe
2009-10-28 18:15 . 2009-10-28 18:15	--------	d-----w-	c:\documents and settings\sam\Application Data\Sony
2009-10-28 17:48 . 2009-10-28 17:48	--------	d-----w-	c:\documents and settings\sam\Application Data\Publish Providers
2009-10-28 17:48 . 2009-10-28 17:48	--------	d-----w-	c:\documents and settings\sam\Application Data\NetMedia Providers
2009-10-28 17:48 . 2009-10-28 17:48	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Sony
2009-10-28 17:13 . 2009-10-28 17:13	--------	d-----w-	c:\windows\system32\LogFiles
2009-10-28 12:46 . 2009-10-28 12:46	--------	d-----w-	c:\program files\Microsoft Works
2009-10-28 12:45 . 2009-10-28 12:45	--------	d-----w-	c:\program files\Microsoft.NET
2009-10-28 12:42 . 2009-10-28 12:42	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-10-28 12:42 . 2009-10-28 12:46	--------	d-----w-	c:\windows\SHELLNEW
2009-10-28 12:41 . 2009-10-28 12:41	--------	d-----r-	C:\MSOCache
2009-10-28 10:03 . 2009-10-28 10:03	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\HP
2009-10-27 18:40 . 2009-10-27 18:40	--------	d-----w-	c:\program files\ASIO4ALL v2
2009-10-27 18:40 . 2006-06-20 08:56	225280	----a-w-	c:\windows\system32ewire.dll
2009-10-27 18:40 . 2009-10-28 13:20	--------	d-----w-	c:\program files\Image-Line
2009-10-27 18:14 . 2009-10-27 18:14	--------	d-----w-	c:\documents and settings\sam\Application Data\DAEMON Tools
2009-10-27 18:12 . 2009-10-27 18:12	715248	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-10-27 18:07 . 2009-10-27 18:07	--------	d--h--w-	c:\windows\PIF
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\program files\QuickTime
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Apple
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\program files\Apple Software Update
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2009-10-27 18:01 . 2009-10-27 18:01	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Apple Computer
2009-10-27 15:22 . 2009-10-27 15:22	--------	d-----w-	c:\documents and settings\All Users\Application Data\ALM
2009-10-27 15:22 . 2009-10-27 15:22	--------	d-----w-	c:\program files\Bonjour
2009-10-27 15:18 . 2009-10-27 15:18	--------	d-----w-	c:\program files\Fichiers communs\Macrovision Shared
2009-10-27 11:21 . 2009-10-27 12:23	--------	d-----w-	c:\documents and settings\All Users\Application Data\FLEXnet
2009-10-26 18:57 . 2009-10-26 18:57	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Nokia
2009-10-26 17:06 . 2009-10-26 18:57	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\PC Suite
2009-10-26 13:03 . 2009-10-29 13:24	--------	d-----w-	c:\documents and settings\sam\Application Data\uTorrent
2009-10-25 21:00 . 2009-10-25 21:00	--------	d-----w-	c:\documents and settings\sam\Application Data\dvdcss
2009-10-25 20:52 . 2009-10-29 18:38	--------	d-----w-	c:\documents and settings\sam\Application Data\vlc
2009-10-24 21:58 . 2004-08-03 21:08	25600	-c--a-w-	c:\windows\system32\dllcache\usbser.sys
2009-10-24 21:58 . 2004-08-03 21:08	25600	----a-w-	c:\windows\system32\drivers\usbser.sys
2009-10-24 21:58 . 2008-03-21 11:57	14640	------w-	c:\windows\system32\spmsgXP_2k3.dll
2009-10-24 21:57 . 2009-10-24 21:58	--------	d-----w-	c:\documents and settings\sam\Application Data\PC Suite
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\documents and settings\sam\Application Data\Nokia
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\PC Suite
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\program files\Fichiers communs\PCSuite
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\program files\Fichiers communs\Nokia
2009-10-24 21:57 . 2008-08-26 08:26	18816	----a-w-	c:\windows\system32\drivers\pccsmcfd.sys
2009-10-24 21:56 . 2009-10-24 21:56	--------	d-----w-	c:\program files\PC Connectivity Solution
2009-10-24 21:56 . 2009-02-09 06:37	7808	----a-w-	c:\windows\system32\drivers\usbser_lowerfltj.sys
2009-10-24 21:56 . 2009-02-09 06:37	7808	----a-w-	c:\windows\system32\drivers\usbser_lowerflt.sys
2009-10-24 21:56 . 2009-02-09 06:37	22016	----a-w-	c:\windows\system32\drivers\ccdcmbo.sys
2009-10-24 21:56 . 2009-02-09 06:37	659968	----a-w-	c:\windows\system32
mwcdcocls.dll
2009-10-24 21:56 . 2009-02-09 06:37	17664	----a-w-	c:\windows\system32\drivers\ccdcmb.sys
2009-10-24 21:56 . 2009-02-09 06:32	1112288	----a-w-	c:\windows\system32\wdfcoinstaller01007.dll
2009-10-24 21:56 . 2009-02-09 06:37	91136	----a-w-	c:\windows\system32
mwcdcls.dll
2009-10-24 21:56 . 2009-10-24 21:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Installations
2009-10-24 19:43 . 2009-10-24 19:43	--------	d-----w-	c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-10-24 19:42 . 2009-10-29 19:04	--------	d-----w-	c:\documents and settings\sam\Application Data\HPAppData
2009-10-24 19:41 . 2009-08-03 13:07	403816	----a-w-	c:\windows\system32\OGACheckControl.DLL
2009-10-24 19:34 . 2009-10-29 13:52	--------	d-----w-	c:\documents and settings\sam\Tracing
2009-10-24 19:34 . 2009-10-28 13:12	69640	----a-w-	c:\documents and settings\sam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-22 15:20 . 2009-10-27 15:44	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Adobe
2009-10-22 15:09 . 2009-10-22 15:09	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Mozilla
2009-10-22 11:44 . 2009-10-20 21:53	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Microsoft Help
2009-10-22 11:44 . 2009-10-18 11:51	--------	d--h--w-	c:\documents and settings\sam\Voisinage réseau
2009-10-22 11:44 . 2009-10-18 11:51	--------	d--h--w-	c:\documents and settings\sam\Voisinage d'impression
2009-10-22 11:44 . 2009-10-18 11:51	--------	d-----r-	c:\documents and settings\sam\Menu Démarrer
2009-10-22 09:39 . 2009-08-29 07:28	52224	-c----w-	c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-22 09:39 . 2009-08-29 07:28	459264	-c----w-	c:\windows\system32\dllcache\msfeeds.dll
2009-10-22 09:39 . 2009-08-29 07:28	6067200	-c----w-	c:\windows\system32\dllcache\ieframe.dll
2009-10-22 09:39 . 2009-08-29 07:28	268288	-c----w-	c:\windows\system32\dllcache\iertutil.dll
2009-10-22 09:39 . 2009-08-29 07:28	380928	-c----w-	c:\windows\system32\dllcache\ieapfltr.dll
2009-10-22 09:39 . 2009-08-29 07:28	63488	-c----w-	c:\windows\system32\dllcache\icardie.dll
2009-10-22 09:39 . 2009-08-28 10:28	13824	-c----w-	c:\windows\system32\dllcache\ieudinit.exe
2009-10-22 09:39 . 2009-06-29 08:33	2452872	-c----w-	c:\windows\system32\dllcache\ieapfltr.dat
2009-10-22 09:39 . 2009-10-22 09:39	--------	d-----w-	c:\windows\system32\fr-fr
2009-10-22 07:56 . 2009-10-22 07:56	--------	d-----w-	c:\windows\system32\XPSViewer
2009-10-22 07:55 . 2009-10-22 07:55	--------	d-----w-	c:\program files\Reference Assemblies
2009-10-22 07:55 . 2008-07-06 12:06	89088	-c----w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-10-22 07:55 . 2008-07-06 12:06	575488	-c----w-	c:\windows\system32\dllcache\xpsshhdr.dll
2009-10-22 07:55 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll
2009-10-22 07:55 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll
2009-10-22 07:55 . 2008-07-06 10:50	597504	-c----w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-10-22 07:55 . 2008-07-06 12:06	1676288	-c----w-	c:\windows\system32\dllcache\xpssvcs.dll
2009-10-22 07:55 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll
2009-10-22 07:54 . 2009-10-22 07:54	--------	d-----w-	c:\program files\MSXML 6.0
2009-10-21 09:01 . 2009-10-21 10:18	--------	d-----w-	c:\windows\system32\CatRoot_bak
2009-10-20 21:53 . 2009-10-20 21:53	--------	d-----w-	c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-10-20 11:07 . 2009-10-20 11:08	--------	d-----w-	c:\program files\Fichiers communs\AVSMedia
2009-10-20 11:07 . 2003-05-21 21:50	24576	----a-w-	c:\windows\system32\msxml3a.dll
2009-10-20 11:07 . 2003-05-21 21:50	344064	----a-w-	c:\windows\system32\msvcr70.dll
2009-10-20 11:07 . 2002-01-05 12:48	974848	----a-w-	c:\windows\system32\mfc70.dll
2009-10-20 11:07 . 2002-01-05 11:40	487424	----a-w-	c:\windows\system32\msvcp70.dll
2009-10-20 11:07 . 2004-07-03 19:08	139264	----a-w-	c:\windows\system32\xvidvfw.dll
2009-10-20 11:07 . 2004-07-03 18:59	524288	----a-w-	c:\windows\system32\xvidcore.dll
2009-10-20 11:07 . 2003-05-22 10:26	638976	----a-w-	c:\windows\system32\divx.dll
2009-10-20 11:07 . 2003-05-21 21:50	261632	----a-w-	c:\windows\system32\mcdvd_32.dll
2009-10-20 11:07 . 2002-08-19 22:41	413760	----a-w-	c:\windows\system32\mpg4c32.dll
2009-10-19 20:57 . 2009-10-22 08:40	--------	d-----w-	c:\documents and settings\Administrateur\Local Settings\Application Data\Adobe
2009-10-19 19:32 . 2003-04-10 16:29	31744	----a-w-	c:\windows\system32\E_DCINST.DLL
2009-10-19 19:29 . 2008-06-14 17:59	272768	-c----w-	c:\windows\system32\dllcache\bthport.sys
2009-10-19 19:29 . 2008-06-14 17:59	272768	------w-	c:\windows\system32\drivers\bthport.sys
2009-10-19 19:14 . 2003-05-21 00:25	63488	----a-w-	c:\windows\system32\ECBTEG.DLL
2009-10-19 19:14 . 2003-02-18 23:04	72825	----a-w-	c:\windows\system32\EBPMON24.DLL
2009-10-19 19:14 . 2003-02-12 23:10	69632	----a-w-	c:\windows\system32\EAL.EXE
2009-10-19 19:14 . 2002-12-01 23:00	91648	----a-w-	c:\windows\system32\E_SAGSET.DLL
2009-10-19 19:14 . 2002-02-28 23:00	44544	----a-w-	c:\windows\system32\EAL32.DLL
2009-10-19 19:14 . 2001-09-04 00:04	182	----a-w-	c:\windows\system32\EBPPORT4.DAT
2009-10-19 19:14 . 2000-06-06 23:01	34304	----a-w-	c:\windows\system32\EBPCHP.DLL
2009-10-19 19:14 . 2009-10-19 19:33	--------	d-----w-	c:\program files\EPSON
2009-10-19 19:13 . 2009-10-19 19:32	--------	d-----w-	C:\epson
2009-10-19 19:08 . 2009-10-26 19:04	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\vlc

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-28 12:47 . 2009-10-18 10:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-26 18:57 . 2004-08-05 12:00	81096	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-26 18:57 . 2004-08-05 12:00	501232	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-24 21:58 . 2009-10-24 21:58	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-10-24 21:58 . 2009-10-24 21:58	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-10-20 09:10 . 2009-10-18 10:01	--------	d-----w-	c:\program files\microsoft frontpage
2009-10-19 19:48 . 2009-10-19 19:48	--------	d-----w-	c:\program files\MSXML 4.0
2009-10-18 09:59 . 2009-10-18 09:59	--------	d-----w-	c:\program files\Services en ligne
2009-10-18 09:58 . 2009-10-18 09:58	21892	----a-w-	c:\windows\system32\emptyregdb.dat
2009-09-27 14:12 . 2009-09-27 14:12	888832	----a-w-	c:\windows\system32
vapi.dll
2009-09-27 14:12 . 2009-09-27 14:12	7655872	----a-w-	c:\windows\system32\drivers
v4_mini.sys
2009-09-27 14:12 . 2009-09-27 14:12	5900416	----a-w-	c:\windows\system32
v4_disp.dll
2009-09-27 14:12 . 2009-09-27 14:12	2194024	----a-w-	c:\windows\system32
vcuvid.dll
2009-09-27 14:12 . 2009-09-27 14:12	2007040	----a-w-	c:\windows\system32
vcuda.dll
2009-09-27 14:12 . 2009-09-27 14:12	1714792	----a-w-	c:\windows\system32
vcuvenc.dll
2009-09-27 14:12 . 2009-09-27 14:12	170600	----a-w-	c:\windows\system32
vcodins.dll
2009-09-27 14:12 . 2009-09-27 14:12	170600	----a-w-	c:\windows\system32
vcod.dll
2009-09-27 14:12 . 2009-09-27 14:12	1604482	----a-w-	c:\windows\system32
vdata.bin
2009-09-27 14:12 . 2009-09-27 14:12	10756096	----a-w-	c:\windows\system32
voglnt.dll
2009-09-11 14:34 . 2004-08-05 12:00	133632	----a-w-	c:\windows\system32\msv1_0.dll
2009-09-04 20:46 . 2004-08-05 12:00	58880	----a-w-	c:\windows\system32\msasn1.dll
2009-08-29 07:28 . 2004-08-05 12:00	832512	----a-w-	c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2004-08-05 12:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2004-08-05 12:00	17408	------w-	c:\windows\system32\corpol.dll
2009-08-26 08:15 . 2004-08-05 12:00	247326	----a-w-	c:\windows\system32\strmdll.dll
2009-08-17 21:33 . 2009-08-17 21:33	1193832	----a-w-	c:\windows\system32\FM20.DLL
2009-08-05 09:06 . 2004-08-05 12:00	205312	----a-w-	c:\windows\system32\mswebdvd.dll
2009-08-04 17:05 . 2004-08-05 12:00	2138112	----a-w-	c:\windows\system32
toskrnl.exe
2009-08-04 17:05 . 2004-08-04 00:49	2017792	----a-w-	c:\windows\system32
tkrnlpa.exe
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-29 30208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-10-29 30208]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2009-10-29 30208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Malwarebytes Anti-Malware (reboot)"="e:\malwarebytes' anti-malware\mbam.exe" [2009-09-10 1312080]
"SkyTel"="SkyTel.EXE" - c:\windows\system32\skytel.exe [2009-10-29 30208]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\system32thdcpl.exe [2009-10-29 30208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]
2009-10-19 06:23	11952	----a-w-	c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\AVG\AVG8\avgam.exe"=
"c:\Program Files\AVG\AVG8\avgupd.exe"=
"c:\Program Files\AVG\AVG8\avgnsx.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"e:\uTorrent.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\WINDOWS\system32\dpvsetup.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [18/10/2009 19:38 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [18/10/2009 19:38 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [18/10/2009 19:38 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [19/10/2009 07:23 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/10/2009 23:03 54752]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08
.
Contenu du dossier 'Tâches planifiées'

2009-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]

2009-10-29 c:\windows\Tasks\WebReg .job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2008-03-25 18:42]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\sam\Application Data\Mozilla\Firefox\Profiles\qk37eg6t.default\
FF - prefs.js: browser.startup.homepage - google.fr
FF - plugin: c:\program files\ma-config.com
phardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pOGAPlugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-nwiz - c:\program files\NVIDIA Corporation
View
wiz.exe
Notify-WgaLogon - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-29 20:10
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\adsldpc.dll
.
Heure de fin: 2009-10-29 20:11
ComboFix-quarantined-files.txt  2009-10-29 19:11

Avant-CF: 39 209 697 280 octets libres
Après-CF: 39 366 332 416 octets libres

WindowsXP-KB310994-SP2-Pro-BootDisk-FRA.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professionnel" /noexecute=optin /fastdetect /usepmtimer

- - End Of File - - A82BC294026FCD043C8BCE7FC82CCE75

Utilisateur anonyme · Answer

Copie le texte ci-dessous : 


File:: 
c:\documents and settings\sam\alcmtr.exe 
c:\documents and settings\sam\rthdcpl.exe 
c:\documents and settings\sam\skytel.exe 
c:\windows\system32\alcmtr.exe 
c:\windows\system32\rthdcpl.exe 
c:\windows\system32\skytel.exe 

DirLook:: 
c:\windows\system32\LogFiles 



Ouvre le Bloc-Notes puis colle le texte copié. 
(Démarrer\Tous les programmes\Accessoires\Bloc notes.) 
Sauvegarde ce fichier sous le nom de CFScript.txt

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci : 

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. 

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! 

Ne touche à rien tant que le scan n'est pas terminé. 

Après redémarrage, poste le contenu du rapport Combofix.txt . 

S'il n'y a pas de rédémarrage, poste quand même le rapport.

sam · Answer

Il n'y a pas eu de redémarrage rapport:


ComboFix 09-10-28.08 - sam 29/10/2009 20:28.2.2 - NTFSx86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.3071.2468 [GMT 1:00]
Lancé depuis: c:\documents and settings\sam\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\sam\Bureau\CFScript.txt
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\documents and settings\sam\alcmtr.exe"
"c:\documents and settings\samthdcpl.exe"
"c:\documents and settings\sam\skytel.exe"
"c:\windows\system32\alcmtr.exe"
"c:\windows\system32thdcpl.exe"
"c:\windows\system32\skytel.exe"
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\sam\alcmtr.exe
c:\documents and settings\samthdcpl.exe
c:\documents and settings\sam\skytel.exe
c:\windows\system32\alcmtr.exe
c:\windows\system32thdcpl.exe
c:\windows\system32\skytel.exe

.
(((((((((((((((((((((((((((((   Fichiers créés du 2009-09-28 au 2009-10-29  ))))))))))))))))))))))))))))))))))))
.

2009-10-29 18:24 . 2009-10-29 18:38	--------	d-----w-	C:\UsbFix
2009-10-29 18:14 . 2009-10-29 18:14	--------	d-----w-	C:\_OTM
2009-10-29 17:59 . 2009-10-29 18:45	--------	d-----w-	c:\program files	rend micro
2009-10-29 17:59 . 2009-10-29 17:59	--------	d-----w-	C:sit
2009-10-29 14:37 . 2009-10-29 14:37	--------	d-----w-	c:\documents and settings\sam\Application Data\Malwarebytes
2009-10-29 14:37 . 2009-09-10 13:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-29 14:37 . 2009-10-29 14:37	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-29 14:37 . 2009-09-10 13:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-10-29 13:09 . 2009-10-29 13:09	--------	d-----w-	c:\documents and settings\sam\Application Data\Uniblue
2009-10-29 13:09 . 2009-10-29 13:09	--------	d-----w-	c:\program files\Uniblue
2009-10-29 12:14 . 2009-10-29 12:14	93360	----a-w-	c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 12:11 . 2009-10-29 12:11	--------	d-----w-	c:\documents and settings\LocalService\Bureau
2009-10-29 12:09 . 2009-10-29 13:25	--------	d-----w-	c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-28 18:15 . 2009-10-28 18:15	--------	d-----w-	c:\documents and settings\sam\Application Data\Sony
2009-10-28 17:48 . 2009-10-28 17:48	--------	d-----w-	c:\documents and settings\sam\Application Data\Publish Providers
2009-10-28 17:48 . 2009-10-28 17:48	--------	d-----w-	c:\documents and settings\sam\Application Data\NetMedia Providers
2009-10-28 17:48 . 2009-10-28 17:48	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Sony
2009-10-28 17:13 . 2009-10-28 17:13	--------	d-----w-	c:\windows\system32\LogFiles
2009-10-28 12:46 . 2009-10-28 12:46	--------	d-----w-	c:\program files\Microsoft Works
2009-10-28 12:45 . 2009-10-28 12:45	--------	d-----w-	c:\program files\Microsoft.NET
2009-10-28 12:42 . 2009-10-28 12:42	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-10-28 12:42 . 2009-10-28 12:46	--------	d-----w-	c:\windows\SHELLNEW
2009-10-28 12:41 . 2009-10-28 12:41	--------	d-----r-	C:\MSOCache
2009-10-28 10:03 . 2009-10-28 10:03	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\HP
2009-10-27 18:40 . 2009-10-27 18:40	--------	d-----w-	c:\program files\ASIO4ALL v2
2009-10-27 18:40 . 2006-06-20 08:56	225280	----a-w-	c:\windows\system32ewire.dll
2009-10-27 18:40 . 2009-10-28 13:20	--------	d-----w-	c:\program files\Image-Line
2009-10-27 18:14 . 2009-10-27 18:14	--------	d-----w-	c:\documents and settings\sam\Application Data\DAEMON Tools
2009-10-27 18:12 . 2009-10-27 18:12	715248	----a-w-	c:\windows\system32\drivers\sptd.sys
2009-10-27 18:07 . 2009-10-27 18:07	--------	d--h--w-	c:\windows\PIF
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\program files\QuickTime
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Apple
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\program files\Apple Software Update
2009-10-27 18:02 . 2009-10-27 18:02	--------	d-----w-	c:\documents and settings\All Users\Application Data\Apple
2009-10-27 18:01 . 2009-10-27 18:01	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Apple Computer
2009-10-27 15:22 . 2009-10-27 15:22	--------	d-----w-	c:\documents and settings\All Users\Application Data\ALM
2009-10-27 15:22 . 2009-10-27 15:22	--------	d-----w-	c:\program files\Bonjour
2009-10-27 15:18 . 2009-10-27 15:18	--------	d-----w-	c:\program files\Fichiers communs\Macrovision Shared
2009-10-27 11:21 . 2009-10-27 12:23	--------	d-----w-	c:\documents and settings\All Users\Application Data\FLEXnet
2009-10-26 18:57 . 2009-10-26 18:57	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\Nokia
2009-10-26 17:06 . 2009-10-26 18:57	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\PC Suite
2009-10-26 13:03 . 2009-10-29 13:24	--------	d-----w-	c:\documents and settings\sam\Application Data\uTorrent
2009-10-25 21:00 . 2009-10-25 21:00	--------	d-----w-	c:\documents and settings\sam\Application Data\dvdcss
2009-10-25 20:52 . 2009-10-29 18:38	--------	d-----w-	c:\documents and settings\sam\Application Data\vlc
2009-10-24 21:58 . 2004-08-03 21:08	25600	-c--a-w-	c:\windows\system32\dllcache\usbser.sys
2009-10-24 21:58 . 2004-08-03 21:08	25600	----a-w-	c:\windows\system32\drivers\usbser.sys
2009-10-24 21:58 . 2008-03-21 11:57	14640	------w-	c:\windows\system32\spmsgXP_2k3.dll
2009-10-24 21:57 . 2009-10-24 21:58	--------	d-----w-	c:\documents and settings\sam\Application Data\PC Suite
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\documents and settings\sam\Application Data\Nokia
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\PC Suite
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\program files\Fichiers communs\PCSuite
2009-10-24 21:57 . 2009-10-24 21:57	--------	d-----w-	c:\program files\Fichiers communs\Nokia
2009-10-24 21:57 . 2008-08-26 08:26	18816	----a-w-	c:\windows\system32\drivers\pccsmcfd.sys
2009-10-24 21:56 . 2009-10-24 21:56	--------	d-----w-	c:\program files\PC Connectivity Solution
2009-10-24 21:56 . 2009-02-09 06:37	7808	----a-w-	c:\windows\system32\drivers\usbser_lowerfltj.sys
2009-10-24 21:56 . 2009-02-09 06:37	7808	----a-w-	c:\windows\system32\drivers\usbser_lowerflt.sys
2009-10-24 21:56 . 2009-02-09 06:37	22016	----a-w-	c:\windows\system32\drivers\ccdcmbo.sys
2009-10-24 21:56 . 2009-02-09 06:37	659968	----a-w-	c:\windows\system32
mwcdcocls.dll
2009-10-24 21:56 . 2009-02-09 06:37	17664	----a-w-	c:\windows\system32\drivers\ccdcmb.sys
2009-10-24 21:56 . 2009-02-09 06:32	1112288	----a-w-	c:\windows\system32\wdfcoinstaller01007.dll
2009-10-24 21:56 . 2009-02-09 06:37	91136	----a-w-	c:\windows\system32
mwcdcls.dll
2009-10-24 21:56 . 2009-10-24 21:56	--------	d-----w-	c:\documents and settings\All Users\Application Data\Installations
2009-10-24 19:43 . 2009-10-24 19:43	--------	d-----w-	c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-10-24 19:42 . 2009-10-29 19:04	--------	d-----w-	c:\documents and settings\sam\Application Data\HPAppData
2009-10-24 19:41 . 2009-08-03 13:07	403816	----a-w-	c:\windows\system32\OGACheckControl.DLL
2009-10-24 19:34 . 2009-10-29 19:13	--------	d-----w-	c:\documents and settings\sam\Tracing
2009-10-24 19:34 . 2009-10-28 13:12	69640	----a-w-	c:\documents and settings\sam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-22 15:20 . 2009-10-27 15:44	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Adobe
2009-10-22 15:09 . 2009-10-22 15:09	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Mozilla
2009-10-22 11:44 . 2009-10-20 21:53	--------	d-----w-	c:\documents and settings\sam\Local Settings\Application Data\Microsoft Help
2009-10-22 11:44 . 2009-10-18 11:51	--------	d--h--w-	c:\documents and settings\sam\Voisinage réseau
2009-10-22 11:44 . 2009-10-18 11:51	--------	d--h--w-	c:\documents and settings\sam\Voisinage d'impression
2009-10-22 11:44 . 2009-10-18 11:51	--------	d-----r-	c:\documents and settings\sam\Menu Démarrer
2009-10-22 09:39 . 2009-08-29 07:28	52224	-c----w-	c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-22 09:39 . 2009-08-29 07:28	459264	-c----w-	c:\windows\system32\dllcache\msfeeds.dll
2009-10-22 09:39 . 2009-08-29 07:28	6067200	-c----w-	c:\windows\system32\dllcache\ieframe.dll
2009-10-22 09:39 . 2009-08-29 07:28	268288	-c----w-	c:\windows\system32\dllcache\iertutil.dll
2009-10-22 09:39 . 2009-08-29 07:28	380928	-c----w-	c:\windows\system32\dllcache\ieapfltr.dll
2009-10-22 09:39 . 2009-08-29 07:28	63488	-c----w-	c:\windows\system32\dllcache\icardie.dll
2009-10-22 09:39 . 2009-08-28 10:28	13824	-c----w-	c:\windows\system32\dllcache\ieudinit.exe
2009-10-22 09:39 . 2009-06-29 08:33	2452872	-c----w-	c:\windows\system32\dllcache\ieapfltr.dat
2009-10-22 09:39 . 2009-10-22 09:39	--------	d-----w-	c:\windows\system32\fr-fr
2009-10-22 07:56 . 2009-10-22 07:56	--------	d-----w-	c:\windows\system32\XPSViewer
2009-10-22 07:55 . 2009-10-22 07:55	--------	d-----w-	c:\program files\Reference Assemblies
2009-10-22 07:55 . 2008-07-06 12:06	89088	-c----w-	c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-10-22 07:55 . 2008-07-06 12:06	575488	-c----w-	c:\windows\system32\dllcache\xpsshhdr.dll
2009-10-22 07:55 . 2008-07-06 12:06	575488	------w-	c:\windows\system32\xpsshhdr.dll
2009-10-22 07:55 . 2008-07-06 12:06	117760	------w-	c:\windows\system32\prntvpt.dll
2009-10-22 07:55 . 2008-07-06 10:50	597504	-c----w-	c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-10-22 07:55 . 2008-07-06 12:06	1676288	-c----w-	c:\windows\system32\dllcache\xpssvcs.dll
2009-10-22 07:55 . 2008-07-06 12:06	1676288	------w-	c:\windows\system32\xpssvcs.dll
2009-10-22 07:54 . 2009-10-22 07:54	--------	d-----w-	c:\program files\MSXML 6.0
2009-10-21 09:01 . 2009-10-21 10:18	--------	d-----w-	c:\windows\system32\CatRoot_bak
2009-10-20 21:53 . 2009-10-20 21:53	--------	d-----w-	c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-10-20 11:07 . 2009-10-20 11:08	--------	d-----w-	c:\program files\Fichiers communs\AVSMedia
2009-10-20 11:07 . 2003-05-21 21:50	24576	----a-w-	c:\windows\system32\msxml3a.dll
2009-10-20 11:07 . 2003-05-21 21:50	344064	----a-w-	c:\windows\system32\msvcr70.dll
2009-10-20 11:07 . 2002-01-05 12:48	974848	----a-w-	c:\windows\system32\mfc70.dll
2009-10-20 11:07 . 2002-01-05 11:40	487424	----a-w-	c:\windows\system32\msvcp70.dll
2009-10-20 11:07 . 2004-07-03 19:08	139264	----a-w-	c:\windows\system32\xvidvfw.dll
2009-10-20 11:07 . 2004-07-03 18:59	524288	----a-w-	c:\windows\system32\xvidcore.dll
2009-10-20 11:07 . 2003-05-22 10:26	638976	----a-w-	c:\windows\system32\divx.dll
2009-10-20 11:07 . 2003-05-21 21:50	261632	----a-w-	c:\windows\system32\mcdvd_32.dll
2009-10-20 11:07 . 2002-08-19 22:41	413760	----a-w-	c:\windows\system32\mpg4c32.dll
2009-10-19 20:57 . 2009-10-22 08:40	--------	d-----w-	c:\documents and settings\Administrateur\Local Settings\Application Data\Adobe
2009-10-19 19:32 . 2003-04-10 16:29	31744	----a-w-	c:\windows\system32\E_DCINST.DLL
2009-10-19 19:29 . 2008-06-14 17:59	272768	-c----w-	c:\windows\system32\dllcache\bthport.sys
2009-10-19 19:29 . 2008-06-14 17:59	272768	------w-	c:\windows\system32\drivers\bthport.sys
2009-10-19 19:14 . 2003-05-21 00:25	63488	----a-w-	c:\windows\system32\ECBTEG.DLL
2009-10-19 19:14 . 2003-02-18 23:04	72825	----a-w-	c:\windows\system32\EBPMON24.DLL
2009-10-19 19:14 . 2003-02-12 23:10	69632	----a-w-	c:\windows\system32\EAL.EXE
2009-10-19 19:14 . 2002-12-01 23:00	91648	----a-w-	c:\windows\system32\E_SAGSET.DLL
2009-10-19 19:14 . 2002-02-28 23:00	44544	----a-w-	c:\windows\system32\EAL32.DLL
2009-10-19 19:14 . 2001-09-04 00:04	182	----a-w-	c:\windows\system32\EBPPORT4.DAT
2009-10-19 19:14 . 2000-06-06 23:01	34304	----a-w-	c:\windows\system32\EBPCHP.DLL
2009-10-19 19:14 . 2009-10-19 19:33	--------	d-----w-	c:\program files\EPSON
2009-10-19 19:13 . 2009-10-19 19:32	--------	d-----w-	C:\epson
2009-10-19 19:08 . 2009-10-26 19:04	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\vlc
2009-10-19 19:07 . 2009-10-27 15:22	--------	d-----w-	c:\program files\Fichiers communs\Adobe
2009-10-19 18:51 . 2009-10-19 19:46	--------	d-----w-	c:\documents and settings\Administrateur\Application Data\uTorrent
2009-10-19 18:33 . 2008-10-24 11:10	453632	-c----w-	c:\windows\system32\dllcache\mrxsmb.sys
2009-10-19 18:25 . 2009-08-04 17:05	2059776	-c----w-	c:\windows\system32\dllcache
tkrnlpa.exe
2009-10-19 18:25 . 2009-08-04 17:05	2182400	-c----w-	c:\windows\system32\dllcache
toskrnl.exe
2009-10-19 18:25 . 2009-08-04 17:05	2138112	-c----w-	c:\windows\system32\dllcache
tkrnlmp.exe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-28 12:47 . 2009-10-18 10:30	--------	d-----w-	c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-26 18:57 . 2004-08-05 12:00	81096	----a-w-	c:\windows\system32\perfc00C.dat
2009-10-26 18:57 . 2004-08-05 12:00	501232	----a-w-	c:\windows\system32\perfh00C.dat
2009-10-24 21:58 . 2009-10-24 21:58	0	---ha-w-	c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-10-24 21:58 . 2009-10-24 21:58	0	---ha-w-	c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-10-20 09:10 . 2009-10-18 10:01	--------	d-----w-	c:\program files\microsoft frontpage
2009-10-19 19:48 . 2009-10-19 19:48	--------	d-----w-	c:\program files\MSXML 4.0
2009-10-18 09:59 . 2009-10-18 09:59	--------	d-----w-	c:\program files\Services en ligne
2009-10-18 09:58 . 2009-10-18 09:58	21892	----a-w-	c:\windows\system32\emptyregdb.dat
2009-09-27 14:12 . 2009-09-27 14:12	888832	----a-w-	c:\windows\system32
vapi.dll
2009-09-27 14:12 . 2009-09-27 14:12	7655872	----a-w-	c:\windows\system32\drivers
v4_mini.sys
2009-09-27 14:12 . 2009-09-27 14:12	5900416	----a-w-	c:\windows\system32
v4_disp.dll
2009-09-27 14:12 . 2009-09-27 14:12	2194024	----a-w-	c:\windows\system32
vcuvid.dll
2009-09-27 14:12 . 2009-09-27 14:12	2007040	----a-w-	c:\windows\system32
vcuda.dll
2009-09-27 14:12 . 2009-09-27 14:12	1714792	----a-w-	c:\windows\system32
vcuvenc.dll
2009-09-27 14:12 . 2009-09-27 14:12	170600	----a-w-	c:\windows\system32
vcodins.dll
2009-09-27 14:12 . 2009-09-27 14:12	170600	----a-w-	c:\windows\system32
vcod.dll
2009-09-27 14:12 . 2009-09-27 14:12	1604482	----a-w-	c:\windows\system32
vdata.bin
2009-09-27 14:12 . 2009-09-27 14:12	10756096	----a-w-	c:\windows\system32
voglnt.dll
2009-09-11 14:34 . 2004-08-05 12:00	133632	----a-w-	c:\windows\system32\msv1_0.dll
2009-09-04 20:46 . 2004-08-05 12:00	58880	----a-w-	c:\windows\system32\msasn1.dll
2009-08-29 07:28 . 2004-08-05 12:00	832512	------w-	c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2004-08-05 12:00	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2004-08-05 12:00	17408	------w-	c:\windows\system32\corpol.dll
2009-08-26 08:15 . 2004-08-05 12:00	247326	----a-w-	c:\windows\system32\strmdll.dll
2009-08-17 21:33 . 2009-08-17 21:33	1193832	----a-w-	c:\windows\system32\FM20.DLL
2009-08-05 09:06 . 2004-08-05 12:00	205312	----a-w-	c:\windows\system32\mswebdvd.dll
2009-08-04 17:05 . 2004-08-05 12:00	2138112	------w-	c:\windows\system32
toskrnl.exe
2009-08-04 17:05 . 2004-08-04 00:49	2017792	------w-	c:\windows\system32
tkrnlpa.exe
.

((((((((((((((((((((((((((((((((((((((((((((   Look   )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\system32\LogFiles ----

2009-10-28 17:13 . 2009-10-29 14:50	11396728	----a-w-	c:\windows\system32\LogFiles	difw\log.txt


(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-29 30208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-10-29 30208]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2009-10-29 30208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Malwarebytes Anti-Malware (reboot)"="e:\malwarebytes' anti-malware\mbam.exe" [2009-09-10 1312080]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-06-15 1826816]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\avgrsstarter]
2009-10-19 06:23	11952	----a-w-	c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"c:\Program Files\AVG\AVG8\avgam.exe"=
"c:\Program Files\AVG\AVG8\avgupd.exe"=
"c:\Program Files\AVG\AVG8\avgnsx.exe"=
"c:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"c:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"c:\Program Files\Windows Live\Sync\WindowsLiveSync.exe"=
"c:\Program Files\Mozilla Firefox\firefox.exe"=
"%windir%\Network Diagnostic\xpnetdiag.exe"=
"e:\uTorrent.exe"=
"c:\Program Files\Bonjour\mDNSResponder.exe"=
"c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"c:\WINDOWS\system32\dpvsetup.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [18/10/2009 19:38 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [18/10/2009 19:38 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [18/10/2009 19:38 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [19/10/2009 07:23 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/10/2009 23:03 54752]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt	REG_MULTI_SZ   	hpqcxs08
.
Contenu du dossier 'Tâches planifiées'

2009-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]

2009-10-29 c:\windows\Tasks\WebReg .job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2008-03-25 18:42]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\sam\Application Data\Mozilla\Firefox\Profiles\qk37eg6t.default\
FF - prefs.js: browser.startup.homepage - google.fr
FF - plugin: c:\program files\ma-config.com
phardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins
pOGAPlugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-29 20:30
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\adsldpc.dll
.
Heure de fin: 2009-10-29 20:30
ComboFix-quarantined-files.txt  2009-10-29 19:30
ComboFix2.txt  2009-10-29 19:11

Avant-CF: 39 362 449 408 octets libres
Après-CF: 39 352 795 136 octets libres

- - End Of File - - 9B8EAB4D6698DCD2164982C9812986D3

Utilisateur anonyme · Answer

ok , toujours des soucis ?

sKe69 · Answer

Salut à vous deux ,


Chiqui , y en reste ! .... ^^


ici :


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-29 30208] 
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-10-29 30208] 
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2009-10-29 30208] 


pour suivre donc ... ;)

sam · Answer

donc je fais comment ? merci beaucoup déjà!

Utilisateur anonyme · Answer

Salut Ske ... joli coup d oeil ;) 

Donc je fais comment ? merci beaucoup déjà!

Répondre à ma question aurait été un bon début :) 


Rends toi sur ce site : 

https://www.virustotal.com/gui/ 

Clique sur parcourir et cherche ce fichier : c:\program files\HP\HP Software Update\HPWuSchd2.exe

Clique sur Send File. 

Un rapport va s'élaborer ligne à ligne. 

Attends la fin. Il doit comprendre la taille du fichier envoyé. 

Sauvegarde le rapport avec le bloc-note. 

Copie le dans ta réponse.

gen-hackman · Answer

ca sent le patch ^^

sam · Answer

Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.41 2009.10.29 Trojan-Downloader.Win32.Small!IK AhnLab-V3 5.0.0.2 2009.10.29 - AntiVir 7.9.1.50 2009.10.29 TR/Dldr.Small.anxi Antiy-AVL 2.0.3.7 2009.10.27 Trojan/Win32.Small.gen Authentium 5.1.2.4 2009.10.29 - Avast 4.8.1351.0 2009.10.29 Win32:Malware-gen AVG 8.5.0.423 2009.10.29 - BitDefender 7.2 2009.10.29 Trojan.Downloader.JMME CAT-QuickHeal 10.00 2009.10.29 - ClamAV 0.94.1 2009.10.29 - Comodo 2770 2009.10.29 - DrWeb 5.0.0.12182 2009.10.29 Trojan.DownLoad.56293 eSafe 7.0.17.0 2009.10.29 - eTrust-Vet 35.1.7091 2009.10.29 - F-Prot 4.5.1.85 2009.10.29 - F-Secure 9.0.15370.0 2009.10.27 - Fortinet 3.120.0.0 2009.10.29 - GData 19 2009.10.29 Trojan.Downloader.JMME Ikarus T3.1.1.72.0 2009.10.29 Trojan-Downloader.Win32.Small Jiangmin 11.0.800 2009.10.29 - K7AntiVirus 7.10.883 2009.10.29 Trojan.Win32.Malware.1 Kaspersky 7.0.0.125 2009.10.29 Trojan-Downloader.Win32.Small.anxi McAfee 5785 2009.10.28 - McAfee+Artemis 5785 2009.10.28 Artemis!5DFFEF985B34 McAfee-GW-Edition 6.8.5 2009.10.29 Heuristic.BehavesLike.Win32.PasswordStealer.H Microsoft 1.5202 2009.10.29 Trojan:Win32/Meredrop NOD32 4556 2009.10.29 Win32/TrojanDownloader.Unruy.AA Norman 6.03.02 2009.10.29 - nProtect 2009.1.8.0 2009.10.29 - Panda 10.0.2.2 2009.10.28 - PCTools 4.4.2.0 2009.10.19 - Prevx 3.0 2009.10.29 - Rising 21.53.34.00 2009.10.29 - Sophos 4.47.0 2009.10.29 Troj/Dldr-CF Sunbelt 3.2.1858.2 2009.10.29 Trojan.Win32.Generic!BT Symantec 1.4.4.12 2009.10.29 - TheHacker 6.5.0.2.056 2009.10.28 - TrendMicro 8.950.0.1094 2009.10.29 - VBA32 3.12.10.11 2009.10.29 - ViRobot 2009.10.29.2011 2009.10.29 - VirusBuster 4.6.5.0 2009.10.29 Trojan.DL.Small.COWL Information additionnelle File size: 30208 bytes MD5...: 5dffef985b3401929cf3adbd629f31eb SHA1..: 5c7d2730108bcc12aa930bedffe613fc1e07b861 SHA256: 151ca03ed2c96770edda592a6707b0ca92180cab1fac05dce2075a79aca80eaa ssdeep: 768:YiUqDBpzTdMxdbyHlYlHR62oAEeqbCimnuKASjBpLB2ZmeYl61DIGDgeaHm3 VdJn:YiUqDBpzxGWHlYlHR62oAEeqbCimuKAP PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x37b4 timedatestamp.....: 0x4ad611a8 (Wed Oct 14 18:00:08 2009) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x2893 0x2a00 5.73 369abc0adf1f0151623728eef074c0d7 .rdata 0x4000 0x2ac 0x400 3.53 e44e795ae39dcb3073e4038cc9f1643e .data 0x5000 0x10b2c 0x4400 6.82 81f460f072da1bcf673378e0a55b1d9a ( 1 imports ) > KERNEL32.dll: GetFileAttributesExA, HeapDestroy, GetTickCount, HeapFree, HeapCreate, HeapAlloc, GetProcessHeap, CloseHandle, ReadFile, SetFilePointer, Sleep, CreateFileA, ExitProcess, GetModuleFileNameA, QueryPerformanceCounter, GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, IsBadReadPtr, lstrcmpiA, FreeLibrary, HeapReAlloc, GetModuleHandleA, GetStartupInfoA, GetCommandLineA ( 0 exports ) RDS...: NSRL Reference Data Set - pdfid.: - sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ThreatExpert info: https://www.symantec.com?md5=5dffef985b3401929cf3adbd629f31eb

Utilisateur anonyme · Answer

• Double-clique sur OTM.exe afin de le lancer. 

• Copie (Ctrl+C) le texte suivant ci-dessous : 



:processes 
explorer.exe 

:files 
c:\progra~1\AVG\AVG8\avgtray.exe
c:\program files\HP\HP Software Update\HPWuSchd2.exe
c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe

:reg 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"AVG8_TRAY"=-
"HP Software Update"=-
"hpqSRMon"=-

:commands 
[emptytemp] 
[reboot] 



• Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

• Clique maintenant sur le bouton MoveIt! puis ferme OTM. 

&#9654; Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
&#9654; Accepte en cliquant sur YES. 

• Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

sam · Answer

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
c:\progra~1\AVG\AVG8\avgtray.exe moved successfully.
c:\program files\HP\HP Software Update\hpwuschd2.exe moved successfully.
c:\program files\HP\Digital Imaging\bin\hpqsrmon.exe moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Run not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Run not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersio­n\Run not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes
 
User: All Users
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes
 
User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes
 
User: sam
->Temp folder emptied: 26271 bytes
->Temporary Internet Files folder emptied: 242608 bytes
->FireFox cache emptied: 52899566 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 50,77 mb
 
 
OTM by OldTimer - Version 3.0.0.6 log created on 10292009_212356

sam · Answer

C'est bon?

Utilisateur anonyme · Answer

re,

Tu vas devoir Désinstaller \ réinstaller AVG , ensuite tu lances un scan avec celui ci , une fois mis a jours .

Virus b .exe quelle marche a suivre?

31 réponses

Discussions similaires

Newsletters