Bonjour, j'avais "iworm_attck_v122.02 a" et "OHPE ver 4.12_23" qui apparaissaient dans ma barre des taches. J'ai suivi votre procédure, et je vous soumets donc les rapports d'analyse. Je vous remercie d'avance, et vous félicite pour ce service que vous rendez aux "pieds tendres" de l'informatique. --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 11:48:52 16/07/2006 + Scan result: C:\WINDOWS\system32\__delete_on_reboot__a_t_m_c_l_k_._e_x_e_ -> Downloader.Zlob.rk : No action taken. C:\WINDOWS\system32\simpole.tlb -> Downloader.Zlob.rk : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@microsoftconsumermarketing.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@advertising[1].txt -> TrackingCookie.Advertising : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@ads18.bpath[2].txt -> TrackingCookie.Bpath : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@casalemedia[2].txt -> TrackingCookie.Casalemedia : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@clickbank[1].txt -> TrackingCookie.Clickbank : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@com[1].txt -> TrackingCookie.Com : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@estat[1].txt -> TrackingCookie.Estat : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@adopt.euroclick[2].txt -> TrackingCookie.Euroclick : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@ehg-apcc.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@hitbox[1].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@image.masterstats[1].txt -> TrackingCookie.Masterstats : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@www.myaffiliateprogram[1].txt -> TrackingCookie.Myaffiliateprogram : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@www.smartadserver[2].txt -> TrackingCookie.Smartadserver : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@weborama[2].txt -> TrackingCookie.Weborama : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@programs.wegcash[2].txt -> TrackingCookie.Wegcash : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@yadro[2].txt -> TrackingCookie.Yadro : No action taken. C:\Documents and Settings\Propriétaire\Cookies\propriétaire@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken. C:\WINDOWS\system32\1024 -> Trojan.Small : No action taken. C:\WINDOWS\system32\1024\ld5064.tmp -> Trojan.Small : No action taken. C:\WINDOWS\system32\1024\ldCFDA.tmp -> Trojan.Small : No action taken. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run\\kernel32.dll -> Trojan.Small : No action taken. ::Report end BitDefender Online Scanner Scan report generated at: Sun, Jul 16, 2006 - 17:07:23 Scan path: A:\;C:\;D:\;E:\;F:\; Statistics Time 04:28:07 Files 402156 Folders 4843 Boot Sectors 3 Archives 19414 Packed Files 27719 Results Identified Viruses 7 Infected Files 15 Suspect Files 0 Warnings 0 Disinfected 0 Deleted Files 26 Engines Info Virus Definitions 408010 Engine build AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38) Scan plugins 13 Archive plugins 39 Unpack plugins 5 E-mail plugins 6 System plugins 1 Scan Settings First Action Disinfect Second Action Delete Heuristics Yes Enable Warnings Yes Scanned Extensions *; Exclude Extensions Scan Emails Yes Scan Archives Yes Scan Packed Yes Scan Files Yes Scan Boot Yes Scanned File Status C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\02D361D1.tmp=>(Quarantine-2) Infected with: Trojan.Zlob.AG C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\02D361D1.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\02D361D1.tmp=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\03126A21.tmp=>(Quarantine-2) Infected with: Trojan.Downloader.Zlob.LN C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\03126A21.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\03126A21.tmp=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\290B00E7.tmp=>(Quarantine-2) Infected with: Trojan.Zlob.AG C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\290B00E7.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\290B00E7.tmp=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\43C97CE8.tmp=>(Quarantine-2) Infected with: Trojan.Downloader.Zlob.LN C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\43C97CE8.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\43C97CE8.tmp=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\44425740.tmp=>(Quarantine-2) Infected with: Trojan.Downloader.Zlob.LN C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\44425740.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\44425740.tmp=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A58163F.tmp=>(Quarantine-2) Infected with: Trojan.Zlob.AG C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A58163F.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4A58163F.tmp=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\523D1B8E.exe=>(Quarantine-2) Infected with: Trojan.Zlob.AI C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\523D1B8E.exe=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\523D1B8E.exe=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52953C9F.exe=>(Quarantine-2) Infected with: Trojan.Downloader.Zlob.LN C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52953C9F.exe=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\52953C9F.exe=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\590B18B1.dll=>(Quarantine-2) Infected with: Trojan.Fakealert.CE C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\590B18B1.dll=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\590B18B1.dll=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\597B3398.tmp=>(Quarantine-2) Infected with: Trojan.Zlob.AG C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\597B3398.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\597B3398.tmp=>(Quarantine-2) Deleted C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64524F1C.tmp=>(Quarantine-2) Infected with: Trojan.Downloader.Zlob.LN C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64524F1C.tmp=>(Quarantine-2) Disinfection failed C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\64524F1C.tmp=>(Quarantine-2) Deleted C:\hp\bin\Terminator.exe Infected with: Trojan.Killapp.30208.A C:\hp\bin\Terminator.exe Disinfection failed C:\hp\bin\Terminator.exe Deleted C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056002.exe Infected with: Trojan.Zlob.AJ C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056002.exe Disinfection failed C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056002.exe Deleted C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056006.tlb Infected with: Trojan.Zlob.AH C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056006.tlb Disinfection failed C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056006.tlb Deleted C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056009.exe Infected with: Trojan.Killapp.30208.A C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056009.exe Disinfection failed C:\System Volume Information\_restore{DC728D2A-F789-45D0-A904-D810A757CF8D}\RP459\A0056009.exe Deleted C:\WINDOWS\system32\ReinstallBackups\0016\DriverFiles\i386\portcls.sys Clean C:\WINDOWS\system32\ReinstallBackups\0016\DriverFiles\i386\stream.sys Clean C:\WINDOWS\system32\ReinstallBackups\0016\DriverFiles\i386\wdmaud.drv Clean C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\cpu.inf Clean C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\cpu.inf=>(unicode) Clean C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\cpu.PNF Clean C:\WINDOWS\system32\ReinstallBackups\0017\DriverFiles\i386\processr.sys Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\hid.dll Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\hidclass.sys Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\hidparse.sys Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\hidusb.sys Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\Sai0464.cat Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\sai0464.dll Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\sai0464.inf Clean C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\sai0464.PNF Clean C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\apcups.inf Clean C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\apcups.PNF Clean C:\WINDOWS\system32\ReinstallBackups\0019\DriverFiles\APC_PCP1.cat Clean C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\Sai0464.cat Clean C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\sai0464.inf Clean C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\sai0464.PNF Clean C:\WINDOWS\system32\ReinstallBackups\0020\DriverFiles\SaiH0464.sys Clean C:\WINDOWS\system32\remotepg.dll Clean C:\WINDOWS\system32\remotesp.tsp Clean C:\WINDOWS\system32\rend.dll Clean C:\WINDOWS\system32\REnum.exe Clean C:\WINDOWS\system32\replace.exe Clean C:\WINDOWS\system32\reset.exe Clean C:\WINDOWS\system32\Restore\filelist.xml Clean C:\WINDOWS\system32\Restore\MachineGuid.txt Clean C:\WINDOWS\system32\Restore\MachineGuid.txt=>REMOVED_NULLS Clean C:\WINDOWS\system32\Restore\rstrlog.dat Clean C:\WINDOWS\system32\Restore\rstrui.exe Clean C:\WINDOWS\system32\Restore\srdiag.exe Clean C:\WINDOWS\system32\Restore\srframe.mmf Clean C:\WINDOWS\system32\resutils.dll Clean C:\WINDOWS\system32\rexec.exe Clean C:\WINDOWS\system32\riched20.dll Clean C:\WINDOWS\system32\riched32.dll Clean C:\WINDOWS\system32\rmoc3260.dll Clean C:\WINDOWS\system32\rnaph.dll Clean C:\WINDOWS\system32\rnr20.dll Clean C:\WINDOWS\system32\rob10_d3d.dll Clean C:\WINDOWS\system32\rob10_d3dCaps.dll Clean C:\WINDOWS\system32\rob10_gl.dll Clean C:\WINDOWS\system32\rob10_none.dll Clean C:\WINDOWS\system32\rob10_tess.dll Clean C:\WINDOWS\system32\rob10_util.dll Clean C:\WINDOWS\system32\route.exe Clean C:\WINDOWS\system32\routemon.exe Clean C:\WINDOWS\system32\routetab.dll Clean C:\WINDOWS\system32\rpcns4.dll Clean C:\WINDOWS\system32\rpcrt4.dll Clean C:\WINDOWS\system32\rpcss.dll Clean C:\WINDOWS\system32\rsaci.rat Clean C:\WINDOWS\system32\rsaenh.dll Clean C:\WINDOWS\system32\rsh.exe Clean C:\WINDOWS\system32\rshx32.dll Clean C:\WINDOWS\system32\rsm.exe Clean C:\WINDOWS\system32\rsmps.dll Clean C:\WINDOWS\system32\rsmsink.exe Clean C:\WINDOWS\system32\rsmui.exe Clean C:\WINDOWS\system32\rsvp.exe Clean C:\WINDOWS\system32\rsvp.ini Clean C:\WINDOWS\system32\rsvpcnts.h Clean C:\WINDOWS\system32\rsvpmsg.dll Clean C:\WINDOWS\system32\rsvpperf.dll Clean C:\WINDOWS\system32\rsvpsp.dll Clean C:\WINDOWS\system32\rtcshare.exe Clean C:\WINDOWS\system32\rtipxmib.dll Clean Logfile of HijackThis v1.99.1 Scan saved at 17:26:07, on 16/07/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe C:\Program Files\Norton AntiVirus\navapsvc.exe C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe C:\WINDOWS\System32\ups.exe C:\windows\system\hpsysdrv.exe C:\HP\KBD\KBD.EXE C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe C:\PROGRA~1\Wanadoo\CnxMon.exe C:\PROGRA~1\MESSAG~1\StartMessager.exe C:\Program Files\Wanadoo\taskbaricon.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\Saitek\Software\Profiler.exe C:\Program Files\Saitek\Software\SaiSmart.exe C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Larousse\Encyclopédie Universelle Larousse\bin\hyperappel.exe C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr8.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr8.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr8.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-fr8.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr8.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-fr8.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://srch-fr8.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://srch-fr8.hpwis.com/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.hpe.com/h41271/404D.aspx?cc=us&ll=en&url=http://domainredirects.ext.hpe.com/fr8.hpwis.com/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://customer.symantec.com/cgi-bin/privacy.pl?Country=FR&ISOLang=FR R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - c:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: (no name) - {6ab7158b-4bff-4160-ad7d-4d622df548cf} - C:\WINDOWS\system32\hp100.tmp (file missing) O2 - BHO: Norton Personal Firewall 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Norton Personal Firewall 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Fichiers communs\Symantec Shared\AdBlocking\NISShExt.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ShowShifter TVTV EPG Daemon] "C:\Program Files\Home Media Networks Limited\ShowShifter\TVTVD.exe" O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\Wanadoo\CnxMon.exe O4 - HKLM\..\Run: [MessagerStarter Wanadoo] C:\PROGRA~1\MESSAG~1\StartMessager.exe Messager Wanadoo O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\Program Files\Wanadoo\taskbaricon.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [Profiler] C:\Program Files\Saitek\Software\Profiler.exe O4 - HKLM\..\Run: [SaiSmart] C:\Program Files\Saitek\Software\SaiSmart.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MoneyAgent] "c:\Program Files\Microsoft Money\System\mnyexpr.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: PowerReg Scheduler.exe O4 - Startup: wkcalrem.LNK = C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkCalRem.exe O4 - Global Startup: APC UPS Status.lnk = C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe O4 - Global Startup: Hyperappel de l'Encyclopédie Universelle Larousse.lnk = ? O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O16 - DPF: PackageHtmlCab - http://acces.blonde.com/package/PackageHtmlCab.CAB O16 - DPF: {01010E00-5E80-11D8-9E86-0007E96C65AE} (SupportSoft SmartIssue) - https://support.norton.com/sp/en/us/home/current/info O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - https://support.norton.com/sp/en/us/home/current/info O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://support.norton.com/sp/en/us/home/current/info O16 - DPF: {2472DCCC-68CE-49DA-AA81-E7E6D83C1DFA} (PackageHTML) - http://acces.blonde.com/package/op/PackageHtmlCab.CAB O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) - http://207.188.7.150/030aae9615bd98c3df06/netzip/RdxIE601.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.apple.com.edgesuite.net/detection/ITDetector.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Fichiers communs\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Personal Firewall\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\ccSetMgr.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: Service Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Fichiers communs\Symantec Shared\CCPD-LC\symlcsvc.exe

Iworm_attck - Page 3

Réponse 41 / 42

Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537

Bonsoir,

De rien, ça a été avec plaisir.

Je te reverrais aussi avec plaisir, mais c'est pas à te souhaiter lol, ça voudrais dire que tu as de nouveaux ennuis.

Si tu y penses, tu indiques que le problème posé dans le post est résolu. Il y a une case à cocher pour ça.

Bon surf.

Réponse 42 / 42

Regis59 Messages postés 21143 Date d'inscription Statut Contributeur sécurité Dernière intervention 1 349

Salut

Tous les honneurs reviennent a Lyonnais ! lol

Bonne continuation a toi Magar

Newsletters