infecté par Trojan.zlob & Cie

Question

Bonjour les experts, j ai de nouvelles infections sur l ordi... j ai fait Ewido, BitDefeneder & Hijackthis ci joint les rapports log qu est ce que je dois eliminer en complement?? merci pour votre aide bonne aprem a + ______________________________ --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 12:29:32 04/09/2006 + Scan result: :mozilla.161:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.162:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@247realmedia[2].txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.77:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.78:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.79:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.80:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.81:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.82:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.83:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.84:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.85:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@2o7[2].txt -> TrackingCookie.2o7 : Cleaned. :mozilla.167:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.168:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.109:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.110:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Adtech : Cleaned. :mozilla.257:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.258:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.259:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.67:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.17:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned. :mozilla.231:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@bluestreak[1].txt -> TrackingCookie.Bluestreak : Cleaned. :mozilla.242:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.111:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Comclick : Cleaned. :mozilla.112:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Comclick : Cleaned. :mozilla.113:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Comclick : Cleaned. :mozilla.42:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. :mozilla.61:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Estat : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@estat[1].txt -> TrackingCookie.Estat : Cleaned. :mozilla.90:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.91:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.92:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.93:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.94:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.95:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Falkag : Cleaned. :mozilla.219:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.233:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.16:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. :mozilla.45:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.46:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Onestat : Cleaned. :mozilla.236:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Paycounter : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.285:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.286:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.287:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.288:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.289:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.302:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.100:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.101:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.97:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.98:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.99:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.251:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.252:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.253:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.254:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.222:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned. :mozilla.223:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Sitestat : Cleaned. :mozilla.12:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned. :mozilla.15:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned. :mozilla.6:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned. :mozilla.7:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Smartadserver : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned. :mozilla.37:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.38:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.39:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.40:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Tradedoubler : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Cleaned. :mozilla.145:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Weborama : Cleaned. :mozilla.146:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Weborama : Cleaned. :mozilla.147:C:\Documents and Settings\Bapt_man\Application Data\Mozilla\Firefox\Profiles\wjbqttzo.default\cookies.txt -> TrackingCookie.Weborama : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@weborama[1].txt -> TrackingCookie.Weborama : Cleaned. C:\Documents and Settings\Bapt_man\Cookies\Bapt_man@zedo[1].txt -> TrackingCookie.Zedo : Cleaned. ::Report end _____________________________________ BitDefender Online Scanner -Scan Report

BitDefender Online Scanner

Scan report generated at: Mon, Sep 04, 2006 - 13:34:54

Scan path: C:\;D:\;E:\;F:\;

Statistics
Time	00:53:27
Files	330370
Folders	8058
Boot Sectors	7
Archives	4706
Packed Files	29148

Results
Identified Viruses	1
Infected Files	6
Suspect Files	0
Warnings	0
Disinfected	0
Deleted Files	6

Engines Info
Virus Definitions	452328
Engine build	AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)
Scan plugins	13
Archive plugins	38
Unpack plugins	6
E-mail plugins	6
System plugins	1

Scan Settings
First Action	Disinfect
Second Action	Delete
Heuristics	Yes
Enable Warnings	Yes
Scanned Extensions	*;
Exclude Extensions
Scan Emails	Yes
Scan Archives	Yes
Scan Packed	Yes
Scan Files	Yes
Scan Boot	Yes

Scanned File	Status
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002285.exe	Infected with: Trojan.Zlob.RR
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002285.exe	Disinfection failed
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002285.exe	Deleted
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002302.exe	Infected with: Trojan.Zlob.RR
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002302.exe	Disinfection failed
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002302.exe	Deleted
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002320.exe	Infected with: Trojan.Zlob.RR
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002320.exe	Disinfection failed
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002320.exe	Deleted
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002336.exe	Infected with: Trojan.Zlob.RR
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002336.exe	Disinfection failed
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002336.exe	Deleted
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002362.exe	Infected with: Trojan.Zlob.RR
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002362.exe	Disinfection failed
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002362.exe	Deleted
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002492.exe	Infected with: Trojan.Zlob.RR
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002492.exe	Disinfection failed
C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP14\A0002492.exe	Deleted

_________________________________ Logfile of HijackThis v1.99.1 Scan saved at 13:36:37, on 04/09/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE c:\program files\mcafee.com\agent\mcagent.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.dell.com/fr-fr R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: McAfee AntiPhishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing) O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla fswshx.dll O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [CTSVolFE.exe] "C:\Program Files\Creative\Mixer\CTSVolFE.exe" /r O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla fswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\McUpdate.exe O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe O4 - HKLM\..\Run: [VirusScan Online] C:\Program Files\McAfee.com\VSO\mcvsshld.exe O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" -osboot O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting etWaiting.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKCU\..\RunOnce: [ypagerps] cmd.exe /C del "C:\Program Files\Yahoo!\Messenger\ypagerps.dll" O4 - Startup: Aide mémoire.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin pjpi142_03.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin pjpi142_03.dll O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - (no file) O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe __________________________________

Utilisateur anonyme · Answer

Salut,

fait ça:

Fais ce nettoyage: (à faire réguliérement)

¤Telecharges et installes ceci:
CCleaner:
Ccleaner

dans la colonne de gauche clic sur "erreurs" coches toutes les cases, puis cliques en bas sur "chercher des erreurs" une fois finit, cliques sur "reparer les erreurs" et tu aura un message pour sauvegarder ta base de registre tu dis "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs.
Les sauvegardes que tu aura faites tu pourra les supprimer si ton ordinateur n'a plus de problémes

¤Relance Ccleaner, vas dans l'onglet "nettoyeur" present sur la gauche, decoches la derniere case (Avancé si elle est cochée) puis clic sur "lancer le nettoyage"

Puis:

Alors ceci; C:\System Volume Information\_restore(voir rapport Bidefender) indique que ta restauration du systeme etait infecté ou est infecté, pour être sûr, nous allons créer un point propre.

Clic sur "demarrer", cliques droit sur "poste de travail", "propriétés", onglet "restauration du systeme"

¤ coches la case "desactiver la Restauration du systéme sur tous les lecteurs", puis clic ur "appliquer"
¤ decoches la case et clic sur "appliquer" puis "ok".

Maintenant, que l'ont à effacés les point infectés, nous allons créer un point propre:

Clic sur "demarrer", "tous les programmes", "accessoires", "outils système", "restauration du système", choisis "créer un point de restauration" nommes le " ccm" par exemple, cliques sur "créer" puis "ok".
Voilà, maintenant le point de restauration est créer si un jour tu décides tu pourra revenir en arriere à la date que tu l'as créer donc à ce jour; en fesant la marche arriére tu pourra remettre ton ordinateur à la date ou l'on à créer ce point de restauration mais tu perdra les modifications que tu aura faites entre deux.

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked"

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.dell.com/fr-fr
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll (file missing)
4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O21 - SSODL: bestreak - {874443fe-aa33-4ebf-a6ac-73208787e62d} - (no file)

bapt_man13 · Answer

salut boulepate62,

j ai suivi toutes tes instructions.

par contre la ligne suivante n'etait pas dans le Scan de HijackThis:

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

je n ai donc pas pu la "fixer"

qu en penses tu?

et sinon, comment je fais pour verifier que tout est bien eliminé?

merci pour ton aide
a +

Infecté par Trojan.zlob & Cie

2 réponses

Votre réponse

Discussions similaires

Newsletters