Virus/Trojan winupdateFermé

Question

Bonjour, 

J'ai un virus sur mon ordinateur et je viens à vous car j'ai besoin d'aide.

Rapport hijackthis 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:34:49, on 17/04/2012
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\afwServ.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Acunetix\Web Vulnerability Scanner 7\WVSScheduler7.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Application Updater\ApplicationUpdater.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\IObit\IObit Security 360\IS360srv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\MySQL\MySQL Server 5.4\bin\mysqld.exe
C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
C:\WINDOWS\system32\PnkBstrA.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
C:\Program Files\Fichiers communs\WireHelpSvc.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Winupdt\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\winupdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32	askmgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Spigot\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe
C:\Program Files\IObit\Advanced SystemCare 5\Suo10_SmartRAM.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Update\1.3.21.111\GoogleCrashHandler.exe
C:\Program Files\Java\jre6\bin\javaw.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Jordan\Bureau\hijackthis_telechargement_01net.exe
C:\DOCUME~1\Jordan\LOCALS~1\Temp\01net\HiJackThis.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe
C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.jerecherche.org/keyword/%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://jerecherche.org
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.jerecherche.org/keyword/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.search-web.net
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://jerecherche.org/?nav=if&zon=Spie
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.jerecherche.org?zone=projr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://jerecherche.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://jerecherche.org?nav=if&zon=Spie
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://jerecherche.org?nav=if&zon=Stbpie
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = <-loopback>;
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files\IObit Toolbar\IE\5.4\iobitToolbarIE.dll
R3 - URLSearchHook: setuprog Toolbar - {f4ef4468-9bbb-45a1-a2ce-f0c430a9a7e5} - (no file)
R3 - URLSearchHook: uTorrentBar_FR Toolbar - {05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} - (no file)
F2 - REG:system.ini: UserInit=,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\J70uDsY0Y0Mc\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe,C:\Winupdt\J70uDsY0Y0Mc\
O2 - BHO: uTorrentBar_FR Toolbar - {05eeb91a-aef7-4f8a-978f-fb83e7b03f8e} - (no file)
O2 - BHO: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files\IObit Toolbar\IE\5.4\iobitToolbarIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PDF Suite Helper - {1AD61D5B-58A3-4592-9B34-DC84688FF805} - (no file)
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: setuprog Toolbar - {f4ef4468-9bbb-45a1-a2ce-f0c430a9a7e5} - (no file)
O3 - Toolbar: IObit Toolbar - {0BDA0769-FD72-49F4-9266-E1FB004F4D8F} - C:\Program Files\IObit Toolbar\IE\5.4\iobitToolbarIE.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SearchSettings] "C:\Program Files\Fichiers communs\Spigot\Search Settings\SearchSettings.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 5] "C:\Program Files\IObit\Advanced SystemCare 5\ASCTray.exe" /AutoStart
O4 - HKCU\..\Run: [SmartRAM] "C:\Program Files\IObit\Advanced SystemCare 5\Suo10_SmartRAM.exe" /m
O4 - HKCU\..\Run: [chromium] C:\Documents and Settings\Jordan\Local Settings\Application Data\Google\Chrome\Application\chrome.exe --no-startup-window
O4 - HKCU\..\Run: [winupdater] C:\Winupdt\CvaxZEsMEfhp\CvaxZEsMEfhp\winupdate.exe
O4 - HKCU\..\Run: [Windows Defender] C:\Documents and Settings\Jordan\Local Settings\Temp\windefender.exe
O4 - HKCU\..\Run: [Client] C:\Documents and Settings\Jordan\Bureau\DarkRAT v11.2 - Fully Working\DarkRAT v11.2 - Fully Working	est.exe
O4 - HKCU\..\Run: [NameProtec] C:\Documents and Settings\Jordan\Prorection.jar
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -update plugin (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10h_Plugin.exe -update plugin (User 'Default user')
O4 - Startup: Protection.lnk = C:\Documents and Settings\Jordan\Protection.jar
O8 - Extra context menu item: &Envoyer à OneNote - res://C:\PROGRA~1\MICROS~4\Office14\ONBttnIE.dll/105
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office14\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: PartyPoker.fr - {725EC34E-943C-4df6-B0B2-FBDE7F242276} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: PartyPoker.fr - {725EC34E-943C-4df6-B0B2-FBDE7F242276} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: PokerStars.fr - {90EAE591-7E7E-434a-8E28-ECFD00071806} - C:\Program Files\PokerStars.FR\PokerStarsUpdate.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.chat-land.org
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O23 - Service: Acunetix WVS Scheduler v7 (AcuWVSSchedulerv7) - Acunetix Ltd. - C:\Program Files\Acunetix\Web Vulnerability Scanner 7\WVSScheduler7.exe
O23 - Service: Advanced SystemCare Service 5 (AdvancedSystemCareService5) - IObit - C:\Program Files\IObit\Advanced SystemCare 5\ASCService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Application Updater - Spigot, Inc. - C:\Program Files\Application Updater\ApplicationUpdater.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Firewall - ALWIL Software - C:\Program Files\Alwil Software\Avast5\afwServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: frameworkPostgreSQL - Unknown owner - C:/PROGRA~1/Rapid7/FRAMEW~1/POSTGR~1/bin/pg_ctl.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS360service - IObit - C:\Program Files\IObit\IObit Security 360\IS360srv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Fichiers communs\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Process Monitor (LVPrcSrv) - Unknown owner - (no file)
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation
Tune
TuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PDF Suite 2010 Service - VSO Software - (no file)
O23 - Service: PMBDeviceInfoProvider - Sony Corporation - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TeamViewer 6 (TeamViewer6) - TeamViewer GmbH - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe
O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.11\bin\httpd.exe
O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.1.33\bin\mysqld.exe
O23 - Service: WireHelpSvc - Unknown owner - C:\Program Files\Fichiers communs\WireHelpSvc.exe

Jotech · Answer

Personne ?

Malekal_morte- · Answer

Salut,

Marrant.

Tu peux envoyer un de ces winupdate.exe sur http://upload.malekal.Com


~~

Télécharge et installe Malwarebyte : https://www.malekal.com/tutoriel-malwarebyte-anti-malware/  
Mets le à jour, fais un scan rapide, supprime tout et poste le rapport ici.  
!!! Malwarebyte doit être à jour avant de faire le scan !!! 
Supprime bien ce qui est détecté : bouton supprimer sélection.

puis :

Tu peux suivre les indications de cette page pour t'aider : https://www.malekal.com/tutorial-otl/    

* Télécharge http://www.geekstogo.com/forum/files/file/398-otl-oldtimers-list-it/ sur ton bureau.    
(Sous Vista/Win7, il faut cliquer droit sur OTL et choisir Exécuter en tant qu'administrateur)    

Dans le cas d'Avast!, ne pas lancer le programme dans la Sandbox (voir lien d'aide ci-dessus).

* Lance OTL    
* En haut à droite de Analyse rapide, coche "tous les utilisateurs"
* Sur OTL, sous Personnalisation, copie-colle le script ci-dessous :    
netsvcs   
msconfig   
safebootminimal   
safebootnetwork   
activex   
drivers32   
%ALLUSERSPROFILE%\Application Data\*.   
%ALLUSERSPROFILE%\Application Data\*.exe /s   
%APPDATA%\*.   
%APPDATA%\*.exe /s   
%temp%\.exe /s   
%SYSTEMDRIVE%\*.exe   
%systemroot%\*. /mp /s
%systemroot%\system32\consrv.dll
%systemroot%\system32\*.dll /lockedfiles   
%systemroot%\Tasks\*.job /lockedfiles   
%systemroot%\system32\drivers\*.sys /lockedfiles   
%systemroot%\System32\config\*.sav   
/md5start   
explorer.exe   
winlogon.exe   
wininit.exe   
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems /s
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\AppCertDlls /s
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList /s
CREATERESTOREPOINT   
nslookup www.google.fr /c   
SAVEMBR:0   
hklm\software\clients\startmenuinternet|command /rs   
hklm\software\clients\startmenuinternet|command /64 /rs    
* Clique sur le bouton Analyse.    
* Quand le scan est fini, utilise le site http://pjjoint.malekal.com/ pour envoyer le rapport OTL.txt (et Extra.txt si présent), donne le ou les liens pjjoint qui pointent vers ces rapports ici dans un nouveau message.

Virus/Trojan winupdate

2 réponses

Discussions similaires

Newsletters