Bonjour, J'ai vu plusieurs sujets qui étaient en rapport avec mon problème mais généralement, la marche a suivre parait propre a la personne en difficulté, c'est pourquoi j'ouvre un nouveau sujet . Alors voila AVG me detecte un cheval de troie nommé "b .exe" et se trouvant dans : "C:\Documents and Settings\Sam\Local Settings\Temp" J'aimerais savoir comment supprimer définitivement ce cheval de troie? Merci d'avance !

Copie le texte ci-dessous : File:: c:\documents and settings\sam\alcmtr.exe c:\documents and settings\sam\rthdcpl.exe c:\documents and settings\sam\skytel.exe c:\windows\system32\alcmtr.exe c:\windows\system32\rthdcpl.exe c:\windows\system32\skytel.exe DirLook:: c:\windows\system32\LogFiles Ouvre le Bloc-Notes puis colle le texte copié. (Démarrer\Tous les programmes\Accessoires\Bloc notes.) Sauvegarde ce fichier sous le nom de CFScript.txt Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci : Cela va relancer Combofix, Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide. Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal! Ne touche à rien tant que le scan n'est pas terminé. Après redémarrage, poste le contenu du rapport Combofix.txt . S'il n'y a pas de rédémarrage, poste quand même le rapport.

Il n'y a pas eu de redémarrage rapport: ComboFix 09-10-28.08 - sam 29/10/2009 20:28.2.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3071.2468 [GMT 1:00] Lancé depuis: c:\documents and settings\sam\Bureau\ComboFix.exe Commutateurs utilisés :: c:\documents and settings\sam\Bureau\CFScript.txt AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF} FILE :: "c:\documents and settings\sam\alcmtr.exe" "c:\documents and settings\sam\rthdcpl.exe" "c:\documents and settings\sam\skytel.exe" "c:\windows\system32\alcmtr.exe" "c:\windows\system32\rthdcpl.exe" "c:\windows\system32\skytel.exe" . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\sam\alcmtr.exe c:\documents and settings\sam\rthdcpl.exe c:\documents and settings\sam\skytel.exe c:\windows\system32\alcmtr.exe c:\windows\system32\rthdcpl.exe c:\windows\system32\skytel.exe . ((((((((((((((((((((((((((((( Fichiers créés du 2009-09-28 au 2009-10-29 )))))))))))))))))))))))))))))))))))) . 2009-10-29 18:24 . 2009-10-29 18:38 -------- d-----w- C:\UsbFix 2009-10-29 18:14 . 2009-10-29 18:14 -------- d-----w- C:\_OTM 2009-10-29 17:59 . 2009-10-29 18:45 -------- d-----w- c:\program files\trend micro 2009-10-29 17:59 . 2009-10-29 17:59 -------- d-----w- C:\rsit 2009-10-29 14:37 . 2009-10-29 14:37 -------- d-----w- c:\documents and settings\sam\Application Data\Malwarebytes 2009-10-29 14:37 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-10-29 14:37 . 2009-10-29 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-10-29 14:37 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-10-29 13:09 . 2009-10-29 13:09 -------- d-----w- c:\documents and settings\sam\Application Data\Uniblue 2009-10-29 13:09 . 2009-10-29 13:09 -------- d-----w- c:\program files\Uniblue 2009-10-29 12:14 . 2009-10-29 12:14 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys 2009-10-29 12:11 . 2009-10-29 12:11 -------- d-----w- c:\documents and settings\LocalService\Bureau 2009-10-29 12:09 . 2009-10-29 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft 2009-10-28 18:15 . 2009-10-28 18:15 -------- d-----w- c:\documents and settings\sam\Application Data\Sony 2009-10-28 17:48 . 2009-10-28 17:48 -------- d-----w- c:\documents and settings\sam\Application Data\Publish Providers 2009-10-28 17:48 . 2009-10-28 17:48 -------- d-----w- c:\documents and settings\sam\Application Data\NetMedia Providers 2009-10-28 17:48 . 2009-10-28 17:48 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Sony 2009-10-28 17:13 . 2009-10-28 17:13 -------- d-----w- c:\windows\system32\LogFiles 2009-10-28 12:46 . 2009-10-28 12:46 -------- d-----w- c:\program files\Microsoft Works 2009-10-28 12:45 . 2009-10-28 12:45 -------- d-----w- c:\program files\Microsoft.NET 2009-10-28 12:42 . 2009-10-28 12:42 -------- d-----w- c:\program files\Microsoft Visual Studio 8 2009-10-28 12:42 . 2009-10-28 12:46 -------- d-----w- c:\windows\SHELLNEW 2009-10-28 12:41 . 2009-10-28 12:41 -------- d-----r- C:\MSOCache 2009-10-28 10:03 . 2009-10-28 10:03 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\HP 2009-10-27 18:40 . 2009-10-27 18:40 -------- d-----w- c:\program files\ASIO4ALL v2 2009-10-27 18:40 . 2006-06-20 08:56 225280 ----a-w- c:\windows\system32\rewire.dll 2009-10-27 18:40 . 2009-10-28 13:20 -------- d-----w- c:\program files\Image-Line 2009-10-27 18:14 . 2009-10-27 18:14 -------- d-----w- c:\documents and settings\sam\Application Data\DAEMON Tools 2009-10-27 18:12 . 2009-10-27 18:12 715248 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-10-27 18:07 . 2009-10-27 18:07 -------- d--h--w- c:\windows\PIF 2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\program files\QuickTime 2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer 2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Apple 2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\program files\Apple Software Update 2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple 2009-10-27 18:01 . 2009-10-27 18:01 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Apple Computer 2009-10-27 15:22 . 2009-10-27 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\ALM 2009-10-27 15:22 . 2009-10-27 15:22 -------- d-----w- c:\program files\Bonjour 2009-10-27 15:18 . 2009-10-27 15:18 -------- d-----w- c:\program files\Fichiers communs\Macrovision Shared 2009-10-27 11:21 . 2009-10-27 12:23 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet 2009-10-26 18:57 . 2009-10-26 18:57 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Nokia 2009-10-26 17:06 . 2009-10-26 18:57 -------- d-----w- c:\documents and settings\Administrateur\Application Data\PC Suite 2009-10-26 13:03 . 2009-10-29 13:24 -------- d-----w- c:\documents and settings\sam\Application Data\uTorrent 2009-10-25 21:00 . 2009-10-25 21:00 -------- d-----w- c:\documents and settings\sam\Application Data\dvdcss 2009-10-25 20:52 . 2009-10-29 18:38 -------- d-----w- c:\documents and settings\sam\Application Data\vlc 2009-10-24 21:58 . 2004-08-03 21:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys 2009-10-24 21:58 . 2004-08-03 21:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys 2009-10-24 21:58 . 2008-03-21 11:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll 2009-10-24 21:57 . 2009-10-24 21:58 -------- d-----w- c:\documents and settings\sam\Application Data\PC Suite 2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\documents and settings\sam\Application Data\Nokia 2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite 2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\program files\Fichiers communs\PCSuite 2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\program files\Fichiers communs\Nokia 2009-10-24 21:57 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys 2009-10-24 21:56 . 2009-10-24 21:56 -------- d-----w- c:\program files\PC Connectivity Solution 2009-10-24 21:56 . 2009-02-09 06:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys 2009-10-24 21:56 . 2009-02-09 06:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys 2009-10-24 21:56 . 2009-02-09 06:37 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys 2009-10-24 21:56 . 2009-02-09 06:37 659968 ----a-w- c:\windows\system32\nmwcdcocls.dll 2009-10-24 21:56 . 2009-02-09 06:37 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys 2009-10-24 21:56 . 2009-02-09 06:32 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll 2009-10-24 21:56 . 2009-02-09 06:37 91136 ----a-w- c:\windows\system32\nmwcdcls.dll 2009-10-24 21:56 . 2009-10-24 21:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations 2009-10-24 19:43 . 2009-10-24 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage 2009-10-24 19:42 . 2009-10-29 19:04 -------- d-----w- c:\documents and settings\sam\Application Data\HPAppData 2009-10-24 19:41 . 2009-08-03 13:07 403816 ----a-w- c:\windows\system32\OGACheckControl.DLL 2009-10-24 19:34 . 2009-10-29 19:13 -------- d-----w- c:\documents and settings\sam\Tracing 2009-10-24 19:34 . 2009-10-28 13:12 69640 ----a-w- c:\documents and settings\sam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-10-22 15:20 . 2009-10-27 15:44 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Adobe 2009-10-22 15:09 . 2009-10-22 15:09 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Mozilla 2009-10-22 11:44 . 2009-10-20 21:53 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Microsoft Help 2009-10-22 11:44 . 2009-10-18 11:51 -------- d--h--w- c:\documents and settings\sam\Voisinage réseau 2009-10-22 11:44 . 2009-10-18 11:51 -------- d--h--w- c:\documents and settings\sam\Voisinage d'impression 2009-10-22 11:44 . 2009-10-18 11:51 -------- d-----r- c:\documents and settings\sam\Menu Démarrer 2009-10-22 09:39 . 2009-08-29 07:28 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll 2009-10-22 09:39 . 2009-08-29 07:28 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll 2009-10-22 09:39 . 2009-08-29 07:28 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll 2009-10-22 09:39 . 2009-08-29 07:28 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll 2009-10-22 09:39 . 2009-08-29 07:28 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll 2009-10-22 09:39 . 2009-08-29 07:28 63488 -c----w- c:\windows\system32\dllcache\icardie.dll 2009-10-22 09:39 . 2009-08-28 10:28 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe 2009-10-22 09:39 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat 2009-10-22 09:39 . 2009-10-22 09:39 -------- d-----w- c:\windows\system32\fr-fr 2009-10-22 07:56 . 2009-10-22 07:56 -------- d-----w- c:\windows\system32\XPSViewer 2009-10-22 07:55 . 2009-10-22 07:55 -------- d-----w- c:\program files\Reference Assemblies 2009-10-22 07:55 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-10-22 07:55 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll 2009-10-22 07:55 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll 2009-10-22 07:55 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll 2009-10-22 07:55 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-10-22 07:55 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll 2009-10-22 07:55 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll 2009-10-22 07:54 . 2009-10-22 07:54 -------- d-----w- c:\program files\MSXML 6.0 2009-10-21 09:01 . 2009-10-21 10:18 -------- d-----w- c:\windows\system32\CatRoot_bak 2009-10-20 21:53 . 2009-10-20 21:53 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help 2009-10-20 11:07 . 2009-10-20 11:08 -------- d-----w- c:\program files\Fichiers communs\AVSMedia 2009-10-20 11:07 . 2003-05-21 21:50 24576 ----a-w- c:\windows\system32\msxml3a.dll 2009-10-20 11:07 . 2003-05-21 21:50 344064 ----a-w- c:\windows\system32\msvcr70.dll 2009-10-20 11:07 . 2002-01-05 12:48 974848 ----a-w- c:\windows\system32\mfc70.dll 2009-10-20 11:07 . 2002-01-05 11:40 487424 ----a-w- c:\windows\system32\msvcp70.dll 2009-10-20 11:07 . 2004-07-03 19:08 139264 ----a-w- c:\windows\system32\xvidvfw.dll 2009-10-20 11:07 . 2004-07-03 18:59 524288 ----a-w- c:\windows\system32\xvidcore.dll 2009-10-20 11:07 . 2003-05-22 10:26 638976 ----a-w- c:\windows\system32\divx.dll 2009-10-20 11:07 . 2003-05-21 21:50 261632 ----a-w- c:\windows\system32\mcdvd_32.dll 2009-10-20 11:07 . 2002-08-19 22:41 413760 ----a-w- c:\windows\system32\mpg4c32.dll 2009-10-19 20:57 . 2009-10-22 08:40 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Adobe 2009-10-19 19:32 . 2003-04-10 16:29 31744 ----a-w- c:\windows\system32\E_DCINST.DLL 2009-10-19 19:29 . 2008-06-14 17:59 272768 -c----w- c:\windows\system32\dllcache\bthport.sys 2009-10-19 19:29 . 2008-06-14 17:59 272768 ------w- c:\windows\system32\drivers\bthport.sys 2009-10-19 19:14 . 2003-05-21 00:25 63488 ----a-w- c:\windows\system32\ECBTEG.DLL 2009-10-19 19:14 . 2003-02-18 23:04 72825 ----a-w- c:\windows\system32\EBPMON24.DLL 2009-10-19 19:14 . 2003-02-12 23:10 69632 ----a-w- c:\windows\system32\EAL.EXE 2009-10-19 19:14 . 2002-12-01 23:00 91648 ----a-w- c:\windows\system32\E_SAGSET.DLL 2009-10-19 19:14 . 2002-02-28 23:00 44544 ----a-w- c:\windows\system32\EAL32.DLL 2009-10-19 19:14 . 2001-09-04 00:04 182 ----a-w- c:\windows\system32\EBPPORT4.DAT 2009-10-19 19:14 . 2000-06-06 23:01 34304 ----a-w- c:\windows\system32\EBPCHP.DLL 2009-10-19 19:14 . 2009-10-19 19:33 -------- d-----w- c:\program files\EPSON 2009-10-19 19:13 . 2009-10-19 19:32 -------- d-----w- C:\epson 2009-10-19 19:08 . 2009-10-26 19:04 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc 2009-10-19 19:07 . 2009-10-27 15:22 -------- d-----w- c:\program files\Fichiers communs\Adobe 2009-10-19 18:51 . 2009-10-19 19:46 -------- d-----w- c:\documents and settings\Administrateur\Application Data\uTorrent 2009-10-19 18:33 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys 2009-10-19 18:25 . 2009-08-04 17:05 2059776 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe 2009-10-19 18:25 . 2009-08-04 17:05 2182400 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe 2009-10-19 18:25 . 2009-08-04 17:05 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2009-10-28 12:47 . 2009-10-18 10:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2009-10-26 18:57 . 2004-08-05 12:00 81096 ----a-w- c:\windows\system32\perfc00C.dat 2009-10-26 18:57 . 2004-08-05 12:00 501232 ----a-w- c:\windows\system32\perfh00C.dat 2009-10-24 21:58 . 2009-10-24 21:58 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf 2009-10-24 21:58 . 2009-10-24 21:58 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf 2009-10-20 09:10 . 2009-10-18 10:01 -------- d-----w- c:\program files\microsoft frontpage 2009-10-19 19:48 . 2009-10-19 19:48 -------- d-----w- c:\program files\MSXML 4.0 2009-10-18 09:59 . 2009-10-18 09:59 -------- d-----w- c:\program files\Services en ligne 2009-10-18 09:58 . 2009-10-18 09:58 21892 ----a-w- c:\windows\system32\emptyregdb.dat 2009-09-27 14:12 . 2009-09-27 14:12 888832 ----a-w- c:\windows\system32\nvapi.dll 2009-09-27 14:12 . 2009-09-27 14:12 7655872 ----a-w- c:\windows\system32\drivers\nv4_mini.sys 2009-09-27 14:12 . 2009-09-27 14:12 5900416 ----a-w- c:\windows\system32\nv4_disp.dll 2009-09-27 14:12 . 2009-09-27 14:12 2194024 ----a-w- c:\windows\system32\nvcuvid.dll 2009-09-27 14:12 . 2009-09-27 14:12 2007040 ----a-w- c:\windows\system32\nvcuda.dll 2009-09-27 14:12 . 2009-09-27 14:12 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll 2009-09-27 14:12 . 2009-09-27 14:12 170600 ----a-w- c:\windows\system32\nvcodins.dll 2009-09-27 14:12 . 2009-09-27 14:12 170600 ----a-w- c:\windows\system32\nvcod.dll 2009-09-27 14:12 . 2009-09-27 14:12 1604482 ----a-w- c:\windows\system32\nvdata.bin 2009-09-27 14:12 . 2009-09-27 14:12 10756096 ----a-w- c:\windows\system32\nvoglnt.dll 2009-09-11 14:34 . 2004-08-05 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll 2009-09-04 20:46 . 2004-08-05 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll 2009-08-29 07:28 . 2004-08-05 12:00 832512 ------w- c:\windows\system32\wininet.dll 2009-08-29 07:28 . 2004-08-05 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll 2009-08-29 07:28 . 2004-08-05 12:00 17408 ------w- c:\windows\system32\corpol.dll 2009-08-26 08:15 . 2004-08-05 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll 2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL 2009-08-05 09:06 . 2004-08-05 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-04 17:05 . 2004-08-05 12:00 2138112 ------w- c:\windows\system32\ntoskrnl.exe 2009-08-04 17:05 . 2004-08-04 00:49 2017792 ------w- c:\windows\system32\ntkrnlpa.exe . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\windows\system32\LogFiles ---- 2009-10-28 17:13 . 2009-10-29 14:50 11396728 ----a-w- c:\windows\system32\LogFiles\tdifw\log.txt ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-29 30208] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-10-29 30208] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2009-10-29 30208] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696] "Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720] "Malwarebytes Anti-Malware (reboot)"="e:\malwarebytes' anti-malware\mbam.exe" [2009-09-10 1312080] "SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-06-15 1826816] "RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter] 2009-10-19 06:23 11952 ----a-w- c:\windows\system32\avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\AVG\\AVG8\\avgam.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"= "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "e:\\uTorrent.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\WINDOWS\\system32\\dpvsetup.exe"= R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [18/10/2009 19:38 12552] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [18/10/2009 19:38 335240] R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [18/10/2009 19:38 108552] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [19/10/2009 07:23 297752] R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/10/2009 23:03 54752] S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864] S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960] --- Autres Services/Pilotes en mémoire --- *NewlyCreated* - CLASSPNP_2 *NewlyCreated* - MBR *Deregistered* - CLASSPNP_2 *Deregistered* - mbr [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] hpdevmgmt REG_MULTI_SZ hpqcxs08 . Contenu du dossier 'Tâches planifiées' 2009-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42] 2009-10-29 c:\windows\Tasks\WebReg .job - c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2008-03-25 18:42] . . ------- Examen supplémentaire ------- . uInternet Settings,ProxyOverride = *.local IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 FF - ProfilePath - c:\documents and settings\sam\Application Data\Mozilla\Firefox\Profiles\qk37eg6t.default\ FF - prefs.js: browser.startup.homepage - google.fr FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- PARAMETRES FIREFOX ---- c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-10-29 20:30 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- - - - - - - - > 'winlogon.exe'(736) c:\windows\system32\adsldpc.dll . Heure de fin: 2009-10-29 20:30 ComboFix-quarantined-files.txt 2009-10-29 19:30 ComboFix2.txt 2009-10-29 19:11 Avant-CF: 39 362 449 408 octets libres Après-CF: 39 352 795 136 octets libres - - End Of File - - 9B8EAB4D6698DCD2164982C9812986D3

Salut à vous deux , Chiqui , y en reste ! .... ^^ ici : [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-29 30208] "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-10-29 30208] "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2009-10-29 30208] pour suivre donc ... ;)

donc je fais comment ? merci beaucoup déjà!

Salut Ske ... joli coup d oeil ;) Donc je fais comment ? merci beaucoup déjà! Répondre à ma question aurait été un bon début :) Rends toi sur ce site : https://www.virustotal.com/gui/ Clique sur parcourir et cherche ce fichier : c:\program files\HP\HP Software Update\HPWuSchd2.exe Clique sur Send File. Un rapport va s'élaborer ligne à ligne. Attends la fin. Il doit comprendre la taille du fichier envoyé. Sauvegarde le rapport avec le bloc-note. Copie le dans ta réponse.

Antivirus Version Dernière mise à jour Résultat a-squared 4.5.0.41 2009.10.29 Trojan-Downloader.Win32.Small!IK AhnLab-V3 5.0.0.2 2009.10.29 - AntiVir 7.9.1.50 2009.10.29 TR/Dldr.Small.anxi Antiy-AVL 2.0.3.7 2009.10.27 Trojan/Win32.Small.gen Authentium 5.1.2.4 2009.10.29 - Avast 4.8.1351.0 2009.10.29 Win32:Malware-gen AVG 8.5.0.423 2009.10.29 - BitDefender 7.2 2009.10.29 Trojan.Downloader.JMME CAT-QuickHeal 10.00 2009.10.29 - ClamAV 0.94.1 2009.10.29 - Comodo 2770 2009.10.29 - DrWeb 5.0.0.12182 2009.10.29 Trojan.DownLoad.56293 eSafe 7.0.17.0 2009.10.29 - eTrust-Vet 35.1.7091 2009.10.29 - F-Prot 4.5.1.85 2009.10.29 - F-Secure 9.0.15370.0 2009.10.27 - Fortinet 3.120.0.0 2009.10.29 - GData 19 2009.10.29 Trojan.Downloader.JMME Ikarus T3.1.1.72.0 2009.10.29 Trojan-Downloader.Win32.Small Jiangmin 11.0.800 2009.10.29 - K7AntiVirus 7.10.883 2009.10.29 Trojan.Win32.Malware.1 Kaspersky 7.0.0.125 2009.10.29 Trojan-Downloader.Win32.Small.anxi McAfee 5785 2009.10.28 - McAfee+Artemis 5785 2009.10.28 Artemis!5DFFEF985B34 McAfee-GW-Edition 6.8.5 2009.10.29 Heuristic.BehavesLike.Win32.PasswordStealer.H Microsoft 1.5202 2009.10.29 Trojan:Win32/Meredrop NOD32 4556 2009.10.29 Win32/TrojanDownloader.Unruy.AA Norman 6.03.02 2009.10.29 - nProtect 2009.1.8.0 2009.10.29 - Panda 10.0.2.2 2009.10.28 - PCTools 4.4.2.0 2009.10.19 - Prevx 3.0 2009.10.29 - Rising 21.53.34.00 2009.10.29 - Sophos 4.47.0 2009.10.29 Troj/Dldr-CF Sunbelt 3.2.1858.2 2009.10.29 Trojan.Win32.Generic!BT Symantec 1.4.4.12 2009.10.29 - TheHacker 6.5.0.2.056 2009.10.28 - TrendMicro 8.950.0.1094 2009.10.29 - VBA32 3.12.10.11 2009.10.29 - ViRobot 2009.10.29.2011 2009.10.29 - VirusBuster 4.6.5.0 2009.10.29 Trojan.DL.Small.COWL Information additionnelle File size: 30208 bytes MD5...: 5dffef985b3401929cf3adbd629f31eb SHA1..: 5c7d2730108bcc12aa930bedffe613fc1e07b861 SHA256: 151ca03ed2c96770edda592a6707b0ca92180cab1fac05dce2075a79aca80eaa ssdeep: 768:YiUqDBpzTdMxdbyHlYlHR62oAEeqbCimnuKASjBpLB2ZmeYl61DIGDgeaHm3 VdJn:YiUqDBpzxGWHlYlHR62oAEeqbCimuKAP PEiD..: - PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x37b4 timedatestamp.....: 0x4ad611a8 (Wed Oct 14 18:00:08 2009) machinetype.......: 0x14c (I386) ( 3 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x2893 0x2a00 5.73 369abc0adf1f0151623728eef074c0d7 .rdata 0x4000 0x2ac 0x400 3.53 e44e795ae39dcb3073e4038cc9f1643e .data 0x5000 0x10b2c 0x4400 6.82 81f460f072da1bcf673378e0a55b1d9a ( 1 imports ) > KERNEL32.dll: GetFileAttributesExA, HeapDestroy, GetTickCount, HeapFree, HeapCreate, HeapAlloc, GetProcessHeap, CloseHandle, ReadFile, SetFilePointer, Sleep, CreateFileA, ExitProcess, GetModuleFileNameA, QueryPerformanceCounter, GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, IsBadReadPtr, lstrcmpiA, FreeLibrary, HeapReAlloc, GetModuleHandleA, GetStartupInfoA, GetCommandLineA ( 0 exports ) RDS...: NSRL Reference Data Set - pdfid.: - sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned trid..: Win32 Executable Generic (42.3%) Win32 Dynamic Link Library (generic) (37.6%) Generic Win/DOS Executable (9.9%) DOS Executable Generic (9.9%) Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=5dffef985b3401929cf3adbd629f31eb' target='_blank'>https://www.symantec.com?md5=5dffef985b3401929cf3adbd629f31eb</a>

• Double-clique sur OTM.exe afin de le lancer. • Copie (Ctrl+C) le texte suivant ci-dessous : :processes explorer.exe :files c:\progra~1\AVG\AVG8\avgtray.exe c:\program files\HP\HP Software Update\HPWuSchd2.exe c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe :reg [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG8_TRAY"=- "HP Software Update"=- "hpqSRMon"=- :commands [emptytemp] [reboot] • Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. • Clique maintenant sur le bouton MoveIt! puis ferme OTM. ▶ Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. ▶ Accepte en cliquant sur YES. • Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\ Le nom du rapport correspond au moment de sa création : date_heure.log

All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== FILES ========== c:\progra~1\AVG\AVG8\avgtray.exe moved successfully. c:\program files\HP\HP Software Update\hpwuschd2.exe moved successfully. c:\program files\HP\Digital Imaging\bin\hpqsrmon.exe moved successfully. ========== REGISTRY ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run not found. ========== COMMANDS ========== [EMPTYTEMP] User: Administrateur ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->FireFox cache emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32835 bytes User: NetworkService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 32835 bytes User: sam ->Temp folder emptied: 26271 bytes ->Temporary Internet Files folder emptied: 242608 bytes ->FireFox cache emptied: 52899566 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 50,77 mb OTM by OldTimer - Version 3.0.0.6 log created on 10292009_212356

Virus b .exe quelle marche a suivre? - Page 2

Réponse 21 / 31
Utilisateur anonyme

Copie le texte ci-dessous :

File::
c:\documents and settings\sam\alcmtr.exe
c:\documents and settings\sam\rthdcpl.exe
c:\documents and settings\sam\skytel.exe
c:\windows\system32\alcmtr.exe
c:\windows\system32\rthdcpl.exe
c:\windows\system32\skytel.exe

DirLook::
c:\windows\system32\LogFiles

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ceci :

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt .

S'il n'y a pas de rédémarrage, poste quand même le rapport.
0
Réponse 22 / 31
sam

Il n'y a pas eu de redémarrage rapport:

ComboFix 09-10-28.08 - sam 29/10/2009 20:28.2.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3071.2468 [GMT 1:00]
Lancé depuis: c:\documents and settings\sam\Bureau\ComboFix.exe
Commutateurs utilisés :: c:\documents and settings\sam\Bureau\CFScript.txt
AV: AVG Anti-Virus *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\documents and settings\sam\alcmtr.exe"
"c:\documents and settings\sam\rthdcpl.exe"
"c:\documents and settings\sam\skytel.exe"
"c:\windows\system32\alcmtr.exe"
"c:\windows\system32\rthdcpl.exe"
"c:\windows\system32\skytel.exe"
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\sam\alcmtr.exe
c:\documents and settings\sam\rthdcpl.exe
c:\documents and settings\sam\skytel.exe
c:\windows\system32\alcmtr.exe
c:\windows\system32\rthdcpl.exe
c:\windows\system32\skytel.exe

.
((((((((((((((((((((((((((((( Fichiers créés du 2009-09-28 au 2009-10-29 ))))))))))))))))))))))))))))))))))))
.

2009-10-29 18:24 . 2009-10-29 18:38 -------- d-----w- C:\UsbFix
2009-10-29 18:14 . 2009-10-29 18:14 -------- d-----w- C:\_OTM
2009-10-29 17:59 . 2009-10-29 18:45 -------- d-----w- c:\program files\trend micro
2009-10-29 17:59 . 2009-10-29 17:59 -------- d-----w- C:\rsit
2009-10-29 14:37 . 2009-10-29 14:37 -------- d-----w- c:\documents and settings\sam\Application Data\Malwarebytes
2009-10-29 14:37 . 2009-09-10 13:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-29 14:37 . 2009-10-29 14:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-10-29 14:37 . 2009-09-10 13:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-29 13:09 . 2009-10-29 13:09 -------- d-----w- c:\documents and settings\sam\Application Data\Uniblue
2009-10-29 13:09 . 2009-10-29 13:09 -------- d-----w- c:\program files\Uniblue
2009-10-29 12:14 . 2009-10-29 12:14 93360 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2009-10-29 12:11 . 2009-10-29 12:11 -------- d-----w- c:\documents and settings\LocalService\Bureau
2009-10-29 12:09 . 2009-10-29 13:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-10-28 18:15 . 2009-10-28 18:15 -------- d-----w- c:\documents and settings\sam\Application Data\Sony
2009-10-28 17:48 . 2009-10-28 17:48 -------- d-----w- c:\documents and settings\sam\Application Data\Publish Providers
2009-10-28 17:48 . 2009-10-28 17:48 -------- d-----w- c:\documents and settings\sam\Application Data\NetMedia Providers
2009-10-28 17:48 . 2009-10-28 17:48 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Sony
2009-10-28 17:13 . 2009-10-28 17:13 -------- d-----w- c:\windows\system32\LogFiles
2009-10-28 12:46 . 2009-10-28 12:46 -------- d-----w- c:\program files\Microsoft Works
2009-10-28 12:45 . 2009-10-28 12:45 -------- d-----w- c:\program files\Microsoft.NET
2009-10-28 12:42 . 2009-10-28 12:42 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2009-10-28 12:42 . 2009-10-28 12:46 -------- d-----w- c:\windows\SHELLNEW
2009-10-28 12:41 . 2009-10-28 12:41 -------- d-----r- C:\MSOCache
2009-10-28 10:03 . 2009-10-28 10:03 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\HP
2009-10-27 18:40 . 2009-10-27 18:40 -------- d-----w- c:\program files\ASIO4ALL v2
2009-10-27 18:40 . 2006-06-20 08:56 225280 ----a-w- c:\windows\system32\rewire.dll
2009-10-27 18:40 . 2009-10-28 13:20 -------- d-----w- c:\program files\Image-Line
2009-10-27 18:14 . 2009-10-27 18:14 -------- d-----w- c:\documents and settings\sam\Application Data\DAEMON Tools
2009-10-27 18:12 . 2009-10-27 18:12 715248 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-10-27 18:07 . 2009-10-27 18:07 -------- d--h--w- c:\windows\PIF
2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\program files\QuickTime
2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Apple
2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\program files\Apple Software Update
2009-10-27 18:02 . 2009-10-27 18:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-10-27 18:01 . 2009-10-27 18:01 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Apple Computer
2009-10-27 15:22 . 2009-10-27 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\ALM
2009-10-27 15:22 . 2009-10-27 15:22 -------- d-----w- c:\program files\Bonjour
2009-10-27 15:18 . 2009-10-27 15:18 -------- d-----w- c:\program files\Fichiers communs\Macrovision Shared
2009-10-27 11:21 . 2009-10-27 12:23 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet
2009-10-26 18:57 . 2009-10-26 18:57 -------- d-----w- c:\documents and settings\Administrateur\Application Data\Nokia
2009-10-26 17:06 . 2009-10-26 18:57 -------- d-----w- c:\documents and settings\Administrateur\Application Data\PC Suite
2009-10-26 13:03 . 2009-10-29 13:24 -------- d-----w- c:\documents and settings\sam\Application Data\uTorrent
2009-10-25 21:00 . 2009-10-25 21:00 -------- d-----w- c:\documents and settings\sam\Application Data\dvdcss
2009-10-25 20:52 . 2009-10-29 18:38 -------- d-----w- c:\documents and settings\sam\Application Data\vlc
2009-10-24 21:58 . 2004-08-03 21:08 25600 -c--a-w- c:\windows\system32\dllcache\usbser.sys
2009-10-24 21:58 . 2004-08-03 21:08 25600 ----a-w- c:\windows\system32\drivers\usbser.sys
2009-10-24 21:58 . 2008-03-21 11:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2009-10-24 21:57 . 2009-10-24 21:58 -------- d-----w- c:\documents and settings\sam\Application Data\PC Suite
2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\documents and settings\sam\Application Data\Nokia
2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\program files\Fichiers communs\PCSuite
2009-10-24 21:57 . 2009-10-24 21:57 -------- d-----w- c:\program files\Fichiers communs\Nokia
2009-10-24 21:57 . 2008-08-26 08:26 18816 ----a-w- c:\windows\system32\drivers\pccsmcfd.sys
2009-10-24 21:56 . 2009-10-24 21:56 -------- d-----w- c:\program files\PC Connectivity Solution
2009-10-24 21:56 . 2009-02-09 06:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerfltj.sys
2009-10-24 21:56 . 2009-02-09 06:37 7808 ----a-w- c:\windows\system32\drivers\usbser_lowerflt.sys
2009-10-24 21:56 . 2009-02-09 06:37 22016 ----a-w- c:\windows\system32\drivers\ccdcmbo.sys
2009-10-24 21:56 . 2009-02-09 06:37 659968 ----a-w- c:\windows\system32\nmwcdcocls.dll
2009-10-24 21:56 . 2009-02-09 06:37 17664 ----a-w- c:\windows\system32\drivers\ccdcmb.sys
2009-10-24 21:56 . 2009-02-09 06:32 1112288 ----a-w- c:\windows\system32\wdfcoinstaller01007.dll
2009-10-24 21:56 . 2009-02-09 06:37 91136 ----a-w- c:\windows\system32\nmwcdcls.dll
2009-10-24 21:56 . 2009-10-24 21:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-10-24 19:43 . 2009-10-24 19:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-10-24 19:42 . 2009-10-29 19:04 -------- d-----w- c:\documents and settings\sam\Application Data\HPAppData
2009-10-24 19:41 . 2009-08-03 13:07 403816 ----a-w- c:\windows\system32\OGACheckControl.DLL
2009-10-24 19:34 . 2009-10-29 19:13 -------- d-----w- c:\documents and settings\sam\Tracing
2009-10-24 19:34 . 2009-10-28 13:12 69640 ----a-w- c:\documents and settings\sam\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-22 15:20 . 2009-10-27 15:44 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Adobe
2009-10-22 15:09 . 2009-10-22 15:09 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Mozilla
2009-10-22 11:44 . 2009-10-20 21:53 -------- d-----w- c:\documents and settings\sam\Local Settings\Application Data\Microsoft Help
2009-10-22 11:44 . 2009-10-18 11:51 -------- d--h--w- c:\documents and settings\sam\Voisinage réseau
2009-10-22 11:44 . 2009-10-18 11:51 -------- d--h--w- c:\documents and settings\sam\Voisinage d'impression
2009-10-22 11:44 . 2009-10-18 11:51 -------- d-----r- c:\documents and settings\sam\Menu Démarrer
2009-10-22 09:39 . 2009-08-29 07:28 52224 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
2009-10-22 09:39 . 2009-08-29 07:28 459264 -c----w- c:\windows\system32\dllcache\msfeeds.dll
2009-10-22 09:39 . 2009-08-29 07:28 6067200 -c----w- c:\windows\system32\dllcache\ieframe.dll
2009-10-22 09:39 . 2009-08-29 07:28 268288 -c----w- c:\windows\system32\dllcache\iertutil.dll
2009-10-22 09:39 . 2009-08-29 07:28 380928 -c----w- c:\windows\system32\dllcache\ieapfltr.dll
2009-10-22 09:39 . 2009-08-29 07:28 63488 -c----w- c:\windows\system32\dllcache\icardie.dll
2009-10-22 09:39 . 2009-08-28 10:28 13824 -c----w- c:\windows\system32\dllcache\ieudinit.exe
2009-10-22 09:39 . 2009-06-29 08:33 2452872 -c----w- c:\windows\system32\dllcache\ieapfltr.dat
2009-10-22 09:39 . 2009-10-22 09:39 -------- d-----w- c:\windows\system32\fr-fr
2009-10-22 07:56 . 2009-10-22 07:56 -------- d-----w- c:\windows\system32\XPSViewer
2009-10-22 07:55 . 2009-10-22 07:55 -------- d-----w- c:\program files\Reference Assemblies
2009-10-22 07:55 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-10-22 07:55 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-10-22 07:55 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-10-22 07:55 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-10-22 07:55 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-10-22 07:55 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-10-22 07:55 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-10-22 07:54 . 2009-10-22 07:54 -------- d-----w- c:\program files\MSXML 6.0
2009-10-21 09:01 . 2009-10-21 10:18 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-10-20 21:53 . 2009-10-20 21:53 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-10-20 11:07 . 2009-10-20 11:08 -------- d-----w- c:\program files\Fichiers communs\AVSMedia
2009-10-20 11:07 . 2003-05-21 21:50 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-10-20 11:07 . 2003-05-21 21:50 344064 ----a-w- c:\windows\system32\msvcr70.dll
2009-10-20 11:07 . 2002-01-05 12:48 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-10-20 11:07 . 2002-01-05 11:40 487424 ----a-w- c:\windows\system32\msvcp70.dll
2009-10-20 11:07 . 2004-07-03 19:08 139264 ----a-w- c:\windows\system32\xvidvfw.dll
2009-10-20 11:07 . 2004-07-03 18:59 524288 ----a-w- c:\windows\system32\xvidcore.dll
2009-10-20 11:07 . 2003-05-22 10:26 638976 ----a-w- c:\windows\system32\divx.dll
2009-10-20 11:07 . 2003-05-21 21:50 261632 ----a-w- c:\windows\system32\mcdvd_32.dll
2009-10-20 11:07 . 2002-08-19 22:41 413760 ----a-w- c:\windows\system32\mpg4c32.dll
2009-10-19 20:57 . 2009-10-22 08:40 -------- d-----w- c:\documents and settings\Administrateur\Local Settings\Application Data\Adobe
2009-10-19 19:32 . 2003-04-10 16:29 31744 ----a-w- c:\windows\system32\E_DCINST.DLL
2009-10-19 19:29 . 2008-06-14 17:59 272768 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-10-19 19:29 . 2008-06-14 17:59 272768 ------w- c:\windows\system32\drivers\bthport.sys
2009-10-19 19:14 . 2003-05-21 00:25 63488 ----a-w- c:\windows\system32\ECBTEG.DLL
2009-10-19 19:14 . 2003-02-18 23:04 72825 ----a-w- c:\windows\system32\EBPMON24.DLL
2009-10-19 19:14 . 2003-02-12 23:10 69632 ----a-w- c:\windows\system32\EAL.EXE
2009-10-19 19:14 . 2002-12-01 23:00 91648 ----a-w- c:\windows\system32\E_SAGSET.DLL
2009-10-19 19:14 . 2002-02-28 23:00 44544 ----a-w- c:\windows\system32\EAL32.DLL
2009-10-19 19:14 . 2001-09-04 00:04 182 ----a-w- c:\windows\system32\EBPPORT4.DAT
2009-10-19 19:14 . 2000-06-06 23:01 34304 ----a-w- c:\windows\system32\EBPCHP.DLL
2009-10-19 19:14 . 2009-10-19 19:33 -------- d-----w- c:\program files\EPSON
2009-10-19 19:13 . 2009-10-19 19:32 -------- d-----w- C:\epson
2009-10-19 19:08 . 2009-10-26 19:04 -------- d-----w- c:\documents and settings\Administrateur\Application Data\vlc
2009-10-19 19:07 . 2009-10-27 15:22 -------- d-----w- c:\program files\Fichiers communs\Adobe
2009-10-19 18:51 . 2009-10-19 19:46 -------- d-----w- c:\documents and settings\Administrateur\Application Data\uTorrent
2009-10-19 18:33 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-10-19 18:25 . 2009-08-04 17:05 2059776 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe
2009-10-19 18:25 . 2009-08-04 17:05 2182400 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-19 18:25 . 2009-08-04 17:05 2138112 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-28 12:47 . 2009-10-18 10:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-26 18:57 . 2004-08-05 12:00 81096 ----a-w- c:\windows\system32\perfc00C.dat
2009-10-26 18:57 . 2004-08-05 12:00 501232 ----a-w- c:\windows\system32\perfh00C.dat
2009-10-24 21:58 . 2009-10-24 21:58 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2009-10-24 21:58 . 2009-10-24 21:58 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01007.Wdf
2009-10-20 09:10 . 2009-10-18 10:01 -------- d-----w- c:\program files\microsoft frontpage
2009-10-19 19:48 . 2009-10-19 19:48 -------- d-----w- c:\program files\MSXML 4.0
2009-10-18 09:59 . 2009-10-18 09:59 -------- d-----w- c:\program files\Services en ligne
2009-10-18 09:58 . 2009-10-18 09:58 21892 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-27 14:12 . 2009-09-27 14:12 888832 ----a-w- c:\windows\system32\nvapi.dll
2009-09-27 14:12 . 2009-09-27 14:12 7655872 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-09-27 14:12 . 2009-09-27 14:12 5900416 ----a-w- c:\windows\system32\nv4_disp.dll
2009-09-27 14:12 . 2009-09-27 14:12 2194024 ----a-w- c:\windows\system32\nvcuvid.dll
2009-09-27 14:12 . 2009-09-27 14:12 2007040 ----a-w- c:\windows\system32\nvcuda.dll
2009-09-27 14:12 . 2009-09-27 14:12 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-09-27 14:12 . 2009-09-27 14:12 170600 ----a-w- c:\windows\system32\nvcodins.dll
2009-09-27 14:12 . 2009-09-27 14:12 170600 ----a-w- c:\windows\system32\nvcod.dll
2009-09-27 14:12 . 2009-09-27 14:12 1604482 ----a-w- c:\windows\system32\nvdata.bin
2009-09-27 14:12 . 2009-09-27 14:12 10756096 ----a-w- c:\windows\system32\nvoglnt.dll
2009-09-11 14:34 . 2004-08-05 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 20:46 . 2004-08-05 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-29 07:28 . 2004-08-05 12:00 832512 ------w- c:\windows\system32\wininet.dll
2009-08-29 07:28 . 2004-08-05 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-29 07:28 . 2004-08-05 12:00 17408 ------w- c:\windows\system32\corpol.dll
2009-08-26 08:15 . 2004-08-05 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
2009-08-17 21:33 . 2009-08-17 21:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-05 09:06 . 2004-08-05 12:00 205312 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-04 17:05 . 2004-08-05 12:00 2138112 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 17:05 . 2004-08-04 00:49 2017792 ------w- c:\windows\system32\ntkrnlpa.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\windows\system32\LogFiles ----

2009-10-28 17:13 . 2009-10-29 14:50 11396728 ----a-w- c:\windows\system32\LogFiles\tdifw\log.txt

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-29 30208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-10-29 30208]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2009-10-29 30208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]
"Malwarebytes Anti-Malware (reboot)"="e:\malwarebytes' anti-malware\mbam.exe" [2009-09-10 1312080]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-06-15 1826816]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-10-19 06:23 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [18/10/2009 19:38 12552]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [18/10/2009 19:38 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [18/10/2009 19:38 108552]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [19/10/2009 07:23 297752]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/10/2009 23:03 54752]
S3 fsssvc;Service Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [05/08/2009 21:48 704864]
S3 maconfservice;Ma-Config Service;c:\program files\ma-config.com\maconfservice.exe [23/09/2009 13:50 238960]

--- Autres Services/Pilotes en mémoire ---

*NewlyCreated* - CLASSPNP_2
*NewlyCreated* - MBR
*Deregistered* - CLASSPNP_2
*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contenu du dossier 'Tâches planifiées'

2009-10-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]

2009-10-29 c:\windows\Tasks\WebReg .job
- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2008-03-25 18:42]
.
.
------- Examen supplémentaire -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\sam\Application Data\Mozilla\Firefox\Profiles\qk37eg6t.default\
FF - prefs.js: browser.startup.homepage - google.fr
FF - plugin: c:\program files\ma-config.com\nphardwaredetection.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-29 20:30
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\adsldpc.dll
.
Heure de fin: 2009-10-29 20:30
ComboFix-quarantined-files.txt 2009-10-29 19:30
ComboFix2.txt 2009-10-29 19:11

Avant-CF: 39 362 449 408 octets libres
Après-CF: 39 352 795 136 octets libres

- - End Of File - - 9B8EAB4D6698DCD2164982C9812986D3
0
Réponse 23 / 31
Utilisateur anonyme

ok , toujours des soucis ?
0
Réponse 24 / 31
sKe69 Messages postés 21955 Statut Contributeur sécurité 463

Salut à vous deux ,

Chiqui , y en reste ! .... ^^

ici :

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-29 30208]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2009-10-29 30208]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2009-10-29 30208]

pour suivre donc ... ;)
0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 25 / 31
sam

donc je fais comment ? merci beaucoup déjà!
0
Réponse 26 / 31
gen-hackman

ca sent le patch ^^
0
Réponse 27 / 31
sam

Antivirus Version Dernière mise à jour Résultat
a-squared 4.5.0.41 2009.10.29 Trojan-Downloader.Win32.Small!IK
AhnLab-V3 5.0.0.2 2009.10.29 -
AntiVir 7.9.1.50 2009.10.29 TR/Dldr.Small.anxi
Antiy-AVL 2.0.3.7 2009.10.27 Trojan/Win32.Small.gen
Authentium 5.1.2.4 2009.10.29 -
Avast 4.8.1351.0 2009.10.29 Win32:Malware-gen
AVG 8.5.0.423 2009.10.29 -
BitDefender 7.2 2009.10.29 Trojan.Downloader.JMME
CAT-QuickHeal 10.00 2009.10.29 -
ClamAV 0.94.1 2009.10.29 -
Comodo 2770 2009.10.29 -
DrWeb 5.0.0.12182 2009.10.29 Trojan.DownLoad.56293
eSafe 7.0.17.0 2009.10.29 -
eTrust-Vet 35.1.7091 2009.10.29 -
F-Prot 4.5.1.85 2009.10.29 -
F-Secure 9.0.15370.0 2009.10.27 -
Fortinet 3.120.0.0 2009.10.29 -
GData 19 2009.10.29 Trojan.Downloader.JMME
Ikarus T3.1.1.72.0 2009.10.29 Trojan-Downloader.Win32.Small
Jiangmin 11.0.800 2009.10.29 -
K7AntiVirus 7.10.883 2009.10.29 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2009.10.29 Trojan-Downloader.Win32.Small.anxi
McAfee 5785 2009.10.28 -
McAfee+Artemis 5785 2009.10.28 Artemis!5DFFEF985B34
McAfee-GW-Edition 6.8.5 2009.10.29 Heuristic.BehavesLike.Win32.PasswordStealer.H
Microsoft 1.5202 2009.10.29 Trojan:Win32/Meredrop
NOD32 4556 2009.10.29 Win32/TrojanDownloader.Unruy.AA
Norman 6.03.02 2009.10.29 -
nProtect 2009.1.8.0 2009.10.29 -
Panda 10.0.2.2 2009.10.28 -
PCTools 4.4.2.0 2009.10.19 -
Prevx 3.0 2009.10.29 -
Rising 21.53.34.00 2009.10.29 -
Sophos 4.47.0 2009.10.29 Troj/Dldr-CF
Sunbelt 3.2.1858.2 2009.10.29 Trojan.Win32.Generic!BT
Symantec 1.4.4.12 2009.10.29 -
TheHacker 6.5.0.2.056 2009.10.28 -
TrendMicro 8.950.0.1094 2009.10.29 -
VBA32 3.12.10.11 2009.10.29 -
ViRobot 2009.10.29.2011 2009.10.29 -
VirusBuster 4.6.5.0 2009.10.29 Trojan.DL.Small.COWL

Information additionnelle

File size: 30208 bytes
MD5...: 5dffef985b3401929cf3adbd629f31eb
SHA1..: 5c7d2730108bcc12aa930bedffe613fc1e07b861
SHA256: 151ca03ed2c96770edda592a6707b0ca92180cab1fac05dce2075a79aca80eaa
ssdeep: 768:YiUqDBpzTdMxdbyHlYlHR62oAEeqbCimnuKASjBpLB2ZmeYl61DIGDgeaHm3
VdJn:YiUqDBpzxGWHlYlHR62oAEeqbCimuKAP
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x37b4
timedatestamp.....: 0x4ad611a8 (Wed Oct 14 18:00:08 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2893 0x2a00 5.73 369abc0adf1f0151623728eef074c0d7
.rdata 0x4000 0x2ac 0x400 3.53 e44e795ae39dcb3073e4038cc9f1643e
.data 0x5000 0x10b2c 0x4400 6.82 81f460f072da1bcf673378e0a55b1d9a

( 1 imports )
> KERNEL32.dll: GetFileAttributesExA, HeapDestroy, GetTickCount, HeapFree, HeapCreate, HeapAlloc, GetProcessHeap, CloseHandle, ReadFile, SetFilePointer, Sleep, CreateFileA, ExitProcess, GetModuleFileNameA, QueryPerformanceCounter, GetProcAddress, LoadLibraryA, VirtualAlloc, VirtualFree, IsBadReadPtr, lstrcmpiA, FreeLibrary, HeapReAlloc, GetModuleHandleA, GetStartupInfoA, GetCommandLineA

( 0 exports )
RDS...: NSRL Reference Data Set
-
pdfid.: -
sigcheck:
publisher....: n/a
copyright....: n/a
product......: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned
trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=5dffef985b3401929cf3adbd629f31eb' target='_blank'>https://www.symantec.com?md5=5dffef985b3401929cf3adbd629f31eb</a>
0
Réponse 28 / 31
Utilisateur anonyme

• Double-clique sur OTM.exe afin de le lancer.

• Copie (Ctrl+C) le texte suivant ci-dessous :

:processes
explorer.exe

:files
c:\progra~1\AVG\AVG8\avgtray.exe
c:\program files\HP\HP Software Update\HPWuSchd2.exe
c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe

:reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"=-
"HP Software Update"=-
"hpqSRMon"=-

:commands
[emptytemp]
[reboot]

• Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

• Clique maintenant sur le bouton MoveIt! puis ferme OTM.

▶ Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
▶ Accepte en cliquant sur YES.

• Poste le rapport situé dans ce dossier : C:\_OTM\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log
0
Réponse 29 / 31
sam

All processes killed
========== PROCESSES ==========
No active process named explorer.exe was found!
========== FILES ==========
c:\progra~1\AVG\AVG8\avgtray.exe moved successfully.
c:\program files\HP\HP Software Update\hpwuschd2.exe moved successfully.
c:\program files\HP\Digital Imaging\bin\hpqsrmon.exe moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrateur
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
File delete failed. C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
->Temporary Internet Files folder emptied: 32835 bytes

User: sam
->Temp folder emptied: 26271 bytes
->Temporary Internet Files folder emptied: 242608 bytes
->FireFox cache emptied: 52899566 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 50,77 mb

OTM by OldTimer - Version 3.0.0.6 log created on 10292009_212356
0
Réponse 30 / 31
sam

C'est bon?
0
Réponse 31 / 31
Utilisateur anonyme

re,

Tu vas devoir Désinstaller \ réinstaller AVG , ensuite tu lances un scan avec celui ci , une fois mis a jours .
0

Virus b .exe quelle marche a suivre? - Page 2

Discussions similaires

Newsletters