Geedd.dll et tuvtqqo.dll

merci encore pour l'aide, voici le rapport vundo et à la suite le rapport hijackthis :


VundoFix V6.3.2

Checking Java version...

Java version is 1.4.2.5

Scan started at 19:12:12 23/01/2007

Listing files found while scanning....

C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt
C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt
C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\System32\ddeeg.bak2
C:\WINDOWS\System32\ddeeg.ini
C:\WINDOWS\System32\geedd.dll
C:\WINDOWS\System32\uqfbpjjs.dll

Beginning removal...

Attempting to delete C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt
C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt Has been deleted!

Attempting to delete C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt
C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt Has been deleted!

Attempting to delete C:\WINDOWS\System32\ddeeg.bak2
C:\WINDOWS\System32\ddeeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\ddeeg.ini
C:\WINDOWS\System32\ddeeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\geedd.dll
C:\WINDOWS\System32\geedd.dll Could not be deleted.

Performing Repairs to the registry.
Done!



Logfile of HijackThis v1.99.1
Scan saved at 20:47:00, on 23/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system\taskmngr.exe
C:\WINDOWS\system\services.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\SoftPerfect Personal Firewall\fw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Softwin\BitDefender10\bdlite.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {086F3ADF-92EA-4415-877E-C7DD7DD64F14} - C:\WINDOWS\system32\tuvtqqo.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\System32\uqfbpjjs.dll (file missing)
O2 - BHO: (no name) - {B562B4D7-1576-42EC-A54A-C590E49BDCC4} - C:\WINDOWS\System32\geedd.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [WINTASK] taskgmrs.exe
O4 - HKLM\..\Run: [Win32] ysztey.exe
O4 - HKLM\..\Run: [Spooler SubSystem App] C:\WINDOWS\System32\spooIsv.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Program Files\SoftPerfect Personal Firewall\fw.exe"
O4 - HKLM\..\RunServices: [WINTASK] taskgmrs.exe
O4 - HKLM\..\RunServices: [Win32] ysztey.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Win32] ysztey.exe
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: geedd - C:\WINDOWS\System32\geedd.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: tuvtqqo - C:\WINDOWS\SYSTEM32\tuvtqqo.dll
O20 - Winlogon Notify: urqnllk - urqnllk.dll (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: fsecure 2006 (fsecure) - Unknown owner - C:\WINDOWS\fswinsys.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: Network helper Service (MSDisk) - Unknown owner - C:\WINDOWS\System32\irdvxc.exe" /service (file missing)
O23 - Service: Microsoft Windows Software Update Service (mswsus) - Unknown owner - C:\WINDOWS\System32\mswsus.exe (file missing)
O23 - Service: TaskManager - Unknown owner - C:\WINDOWS\system\taskmngr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: Windows Host Services (WINHOST32) - Unknown owner - C:\WINDOWS\system\services.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

SDFix: Version 1.62

24/01/2007 - 0:16:27,01

Microsoft Windows XP [version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
msdirectx
MSDisk
mswsus

Path:
\??\C:\Documents and Settings\user\msdirectx.sys
"C:\WINDOWS\System32\irdvxc.exe" /service
C:\WINDOWS\System32\mswsus.exe

msdirectx Deleted
MSDisk Deleted
mswsus Deleted

Restoring Windows Registry Entries
Restoring Default Hosts File


Rebooting...

Normal Mode:
Checking Files:

Files will be copied to Backups folder and removed:

C:\WINDOWS\system32\eraseme_58636.exe - Deleted
C:\WINDOWS\system32\9.tmp - Deleted
C:\WINDOWS\system32\setup_06382.exe - Deleted
C:\WINDOWS\system32\TFTP1088 - Deleted
C:\WINDOWS\system32\TFTP2084 - Deleted
C:\WINDOWS\system32\TFTP3756 - Deleted

Could Not Remove C:\WINDOWS\system\services.exe!


Alternate Streams Check:

C:\WINDOWS\system32
No streams found.

Final Check:

Remaining Services:
------------------



Remaining Files:
---------------
C:\WINDOWS\system\services.exe Found

Backups Folder: - C:\SDFix\backups\backups.zip


Checking For Files with Hidden Attributes :

C:\NTDETECT.COM
C:\Program Files\RM-X© Video Converter\ASProtect.dll
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\tuvtqqo.dll
C:\WINDOWS\system\taskmngr.exe
C:\WINDOWS\system32\cdplayer.exe.manifest
C:\WINDOWS\system32\eim.exe
C:\WINDOWS\system32\logonui.exe.manifest
C:\WINDOWS\system32\ysztey.exe
C:\IO.SYS
C:\MSDOS.SYS
C:\pagefile.sys

Finished



VundoFix V6.3.2

Checking Java version...

Java version is 1.4.2.5

Scan started at 19:12:12 23/01/2007

Listing files found while scanning....

C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt
C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt
C:\Program Files\VSAdd-in\VSAdd-in.dll
C:\WINDOWS\System32\ddeeg.bak2
C:\WINDOWS\System32\ddeeg.ini
C:\WINDOWS\System32\geedd.dll
C:\WINDOWS\System32\uqfbpjjs.dll

Beginning removal...

Attempting to delete C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt
C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt Has been deleted!

Attempting to delete C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt
C:\Documents and settings\user\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt Has been deleted!

Attempting to delete C:\WINDOWS\System32\ddeeg.bak2
C:\WINDOWS\System32\ddeeg.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\System32\ddeeg.ini
C:\WINDOWS\System32\ddeeg.ini Has been deleted!

Attempting to delete C:\WINDOWS\System32\geedd.dll
C:\WINDOWS\System32\geedd.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\System32\ddeeg.ini
C:\WINDOWS\System32\ddeeg.ini Has been deleted!

Performing Repairs to the registry.
Done!



Logfile of HijackThis v1.99.1
Scan saved at 00:32:40, on 24/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system\taskmngr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system\services.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\SoftPerfect Personal Firewall\fw.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {086F3ADF-92EA-4415-877E-C7DD7DD64F14} - C:\WINDOWS\system32\tuvtqqo.dll
O2 - BHO: (no name) - {3BD045BA-F676-446D-837D-31728D7724F3} - C:\WINDOWS\System32\geedd.dll
O2 - BHO: (no name) - {46A4E9D9-B30E-452A-8157-DBBEC8573B03} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINDOWS\System32\uqfbpjjs.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Program Files\VSAdd-in\VSAdd-in.dll (file missing)
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [WINTASK] taskgmrs.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Program Files\SoftPerfect Personal Firewall\fw.exe"
O4 - HKLM\..\RunServices: [WINTASK] taskgmrs.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: geedd - C:\WINDOWS\System32\geedd.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: tuvtqqo - C:\WINDOWS\SYSTEM32\tuvtqqo.dll
O20 - Winlogon Notify: urqnllk - urqnllk.dll (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: fsecure 2006 (fsecure) - Unknown owner - C:\WINDOWS\fswinsys.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: TaskManager - Unknown owner - C:\WINDOWS\system\taskmngr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: Windows Host Services (WINHOST32) - Unknown owner - C:\WINDOWS\system\services.exe
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



voilà ce que j'ai pu faire, j'espère qu'on va pouvoir avancer ;-) merci encore je vais dormir et je pourrai m'y remettre demain apres le boulot ! bonne nuit...

je vais faire tout ça apres le boulot ! j'ai imprimé la marche à suivre pour le mode sans echec...
je posterai les rapports vers 19h30 donc....merci encore

ok je fais ça ce soir apres le boulot comme d'hab'....bonne journee

bon voilà les rapports, je tiens à preciser que j'etais obligé de suivre les instructions de hijackthis apres l'etape 4 (enfin je sais plus trop mais c'etait avant CClenear il me semble ou avant "services.msc) à savoir que je ne pouvais continuer sans redemarrer tel que demandé dans le message à l'ecran...d'autre part au niveau de killbox j'ai tout essayé mais impossible de retrouver tous les fichiers dans la liste (notamment ceux "oqqtvut")...voilà donc pour le moment ! please dis moi que c'est déjà mieux :-)

hijackthis :

Logfile of HijackThis v1.99.1
Scan saved at 19:55:23, on 25/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\SoftPerfect Personal Firewall\fw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O2 - BHO: (no name) - {086F3ADF-92EA-4415-877E-C7DD7DD64F14} - C:\WINDOWS\system32\tuvtqqo.dll
O2 - BHO: (no name) - {7726433C-49C3-4E70-B28E-2B7E34DC53D4} - C:\WINDOWS\System32\geedd.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Program Files\SoftPerfect Personal Firewall\fw.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: geedd - C:\WINDOWS\System32\geedd.dll
O20 - Winlogon Notify: tuvtqqo - C:\WINDOWS\SYSTEM32\tuvtqqo.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: fsecure 2006 (fsecure) - Unknown owner - C:\WINDOWS\fswinsys.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

avg :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 19:37:39 25/01/2007

+ Résultat de l'analyse:



C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP29\A0032503.dll -> Adware.Agent : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP30\A0036818.dll -> Adware.Solution : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0083637.exe -> Backdoor.Rbot.bvz : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ysztey.exe -> Backdoor.Rbot.bvz : Nettoyé et sauvegardé (mise en quarantaine).
C:\SDFix\backups\backups.zip/backups/services.exe -> Backdoor.SdBot.xd : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system\services.exe -> Backdoor.SdBot.xd : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport


killbox :

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 19:37:39 25/01/2007

+ Résultat de l'analyse:



C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP29\A0032503.dll -> Adware.Agent : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP30\A0036818.dll -> Adware.Solution : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0083637.exe -> Backdoor.Rbot.bvz : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\ysztey.exe -> Backdoor.Rbot.bvz : Nettoyé et sauvegardé (mise en quarantaine).
C:\SDFix\backups\backups.zip/backups/services.exe -> Backdoor.SdBot.xd : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system\services.exe -> Backdoor.SdBot.xd : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

pardon j'avais posté 2 fois le rapport avg !
je confirme j'ai fait un copier/coller de ta liste pour killbox mais ensuite en vérifiant comme demandé dans le fichier déroulant je n'ai retrouvé que la moitié des informations en l'occurence celles-ci :
C:\WINDOWS\SYSTEM32\tuvtqqo.dll
C:\WINDOWS\System32\geedd.dll
C:\WINDOWS\System32\ddeeg.bak
C:\WINDOWS\System32\ddeeg.bak1
C:\WINDOWS\System32\ddeeg.bak2
C:\WINDOWS\System32\ddeeg.ini
C:\WINDOWS\System32\ddeeg.ini1
C:\WINDOWS\System32\ddeeg.ini2
C:\WINDOWS\System32\ddeeg.tmp

ok je recommence ce soir et je posterai....merci

bon voici les rapports, cette fois ci killbox n'a pris en compte que : C:\WINDOWS\SYSTEM32\tuvtqqo.dll
C:\WINDOWS\System32\geedd.dll
C:\WINDOWS\System32\ddeeg.bak1
C:\WINDOWS\System32\ddeeg.ini

pourtant tu admettra qu'en faisant un copier coller ceux qui etaient entres ces lignes auraient du etre pris en compte !

Logfile of HijackThis v1.99.1
Scan saved at 19:53:14, on 26/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\SoftPerfect Personal Firewall\fw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O2 - BHO: (no name) - {086F3ADF-92EA-4415-877E-C7DD7DD64F14} - C:\WINDOWS\system32\tuvtqqo.dll
O2 - BHO: (no name) - {94D871AD-09B5-4761-B57A-B68DC528621E} - C:\WINDOWS\System32\geedd.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Program Files\SoftPerfect Personal Firewall\fw.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: geedd - C:\WINDOWS\System32\geedd.dll
O20 - Winlogon Notify: tuvtqqo - C:\WINDOWS\SYSTEM32\tuvtqqo.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: fsecure 2006 (fsecure) - Unknown owner - C:\WINDOWS\fswinsys.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 20:37:29 25/01/2007

+ Résultat de l'analyse:



C:\Program Files\Hijackthis Version Française\backups\backup-20070125-201256-595.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070351.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070352.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070353.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070354.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070356.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070357.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070358.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070359.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070360.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070361.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070362.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070363.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070364.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070365.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070366.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070367.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070368.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070370.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070372.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070373.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070374.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070375.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP34\A0071395.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\WINDOWS\system32\tuvtqqo.dll -> Adware.Virtumonde : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070369.exe -> Backdoor.IRCBot.ul : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP34\A0075410.exe -> Backdoor.IRCBot.ul : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0054169.exe -> Backdoor.Rbot.bmw : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0082607.exe -> Backdoor.Rbot.bug : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0094688.exe -> Backdoor.Rbot.bvz : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0094687.exe -> Backdoor.SdBot.xd : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP13\A0026439.exe -> Proxy.Ranky : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP13\A0026440.exe -> Proxy.Ranky : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP13\A0026442.exe -> Proxy.Ranky : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP13\A0026443.exe -> Proxy.Ranky : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP13\A0026444.exe -> Proxy.Ranky : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP13\A0026445.exe -> Proxy.Ranky : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070350.dll -> Trojan.Agent.acl : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP10\A0011264.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP10\A0012264.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP10\A0012288.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP10\A0012298.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP11\A0012309.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP11\A0012321.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP11\A0012331.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0013331.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0014339.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0014349.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0015349.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0015357.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0016356.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0017356.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0018357.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP12\A0018366.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP8\A0007195.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP8\A0008195.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP8\A0009195.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP8\A0009211.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP9\A0010211.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP9\A0010223.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP9\A0010236.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP9\A0010247.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP9\A0010256.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP9\A0010264.exe -> Worm.Mytob.f : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

Pocket Killbox version 2.0.0.648
Running on Windows XP as user(Administrator)
was started @ jeudi, janvier 25, 2007, 7:38 PM

Killbox Closed(Exit) @ 7:44:56 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on Windows XP as user(Administrator)
was started @ jeudi, janvier 25, 2007, 7:45 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\tuvtqqo.dll


# 2 [Delete on Reboot]
Path = C:\WINDOWS\System32\geedd.dll


# 3 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.bak1


# 4 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.bak2


# 5 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.ini


# 6 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.ini2


# 7 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.tmp


# 8 [Delete on Reboot]
Path = C:\WINDOWS\system\taskmngr.exe


I Rebooted @ 7:47:32 PM
Killbox Closed(Exit) @ 7:47:44 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on Windows XP as user(Administrator)
was started @ jeudi, janvier 25, 2007, 8:39 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\tuvtqqo.dll


# 2 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\geedd.dll


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 8:46:16 PM
# 3 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\tuvtqqo.dll


# 4 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\geedd.dll


PendingFileRenameOperations Registry Data has been Removed by External Process! @ 8:46:54 PM
Killbox Closed(Exit) @ 8:47:01 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on Windows XP as user(Administrator)
was started @ vendredi, janvier 26, 2007, 7:31 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\tuvtqqo.dll


# 2 [Delete on Reboot]
Path = C:\WINDOWS\System32\geedd.dll


# 3 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.bak1


# 4 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.ini


I Rebooted @ 7:33:13 PM
Killbox Closed(Exit) @ 7:33:21 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on Windows XP as user(Administrator)
was started @ vendredi, janvier 26, 2007, 7:36 PM

Killbox Closed(Exit) @ 7:37:50 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on Windows XP as user(Administrator)
was started @ vendredi, janvier 26, 2007, 7:37 PM

Killbox Closed(Exit) @ 7:39:47 PM
__________________________________________________

Pocket Killbox version
Running on Windows XP as user(Administrator)
was started @ vendredi, janvier 26, 2007, 7:40 PM

Killbox Closed(Exit) @ 7:41:52 PM
__________________________________________________

Pocket Killbox version 2.0.0.648
Running on Windows XP as user(Administrator)
was started @ vendredi, janvier 26, 2007, 7:42 PM

# 1 [Delete on Reboot]
Path = C:\WINDOWS\SYSTEM32\tuvtqqo.dll


# 2 [Delete on Reboot]
Path = C:\WINDOWS\System32\geedd.dll


# 3 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.bak1


# 4 [Delete on Reboot]
Path = C:\WINDOWS\System32\ddeeg.ini


I Rebooted @ 7:44:33 PM
Killbox Closed(Exit) @ 7:44:39 PM
__________________________________________________

salut, je crois que ça persiste toujours, vraiment coriaces ces ptits trucs !!! voici les rapports :

Logfile of HijackThis v1.99.1
Scan saved at 14:40:45, on 27/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\SoftPerfect Personal Firewall\fw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

O2 - BHO: (no name) - {086F3ADF-92EA-4415-877E-C7DD7DD64F14} - C:\WINDOWS\system32\tuvtqqo.dll
O2 - BHO: (no name) - {51FD8014-4ADE-4259-B964-7839672BAA9D} - C:\WINDOWS\System32\geedd.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] "C:\Program Files\SoftPerfect Personal Firewall\fw.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: geedd - C:\WINDOWS\System32\geedd.dll
O20 - Winlogon Notify: tuvtqqo - C:\WINDOWS\SYSTEM32\tuvtqqo.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: fsecure 2006 (fsecure) - Unknown owner - C:\WINDOWS\fswinsys.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)



"user" - 07-01-27 14:20:23 Service Pack 1
ComboFix 07-01-25 - Running from: "C:\Documents and Settings\user\Bureau"
Command switches used :: /v geedd

(((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log )))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\ddeeg.bak1
C:\WINDOWS\system32\ddeeg.ini


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


"C:\WINDOWS\system32\geedd.dll"
"C:\WINDOWS\system32\ddeeg.ini"

((((((((((((((((((((((((((((((( Files Created from 2006-12-27 to 2007-01-27 ))))))))))))))))))))))))))))))))))


2007-01-25 19:38 <REP> d-------- C:\!KillBox
2007-01-24 20:22 1,460 --ah----- C:\WINDOWS\system32\lknc.exe
2007-01-24 19:45 203 --a------ C:\1.vbs
2007-01-24 19:02 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-24 00:20 12,800 --ah----- C:\WINDOWS\system32\wugcl.exe
2007-01-24 00:15 <REP> d-------- C:\SDFix
2007-01-24 00:12 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2007-01-24 00:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2007-01-24 00:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2007-01-24 00:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2007-01-24 00:12 <REP> d-------- C:\DOCUME~1\ADMINI~1\Mes documents
2007-01-24 00:12 <REP> d-------- C:\DOCUME~1\ADMINI~1\Favoris
2007-01-24 00:12 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2007-01-23 23:40 <REP> d-------- C:\DOCUME~1\user\Application Data\Lavasoft
2007-01-23 23:39 <REP> d-------- C:\Program Files\Lavasoft
2007-01-23 22:19 <REP> d-------- C:\Program Files\CCleaner
2007-01-23 20:46 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-01-23 19:12 <REP> d-------- C:\VundoFix Backups
2007-01-21 19:39 608,256 --------- C:\WINDOWS\system32\xpsp2res.dll
2007-01-21 19:39 593,408 --a------ C:\WINDOWS\system32\h323msp.dll
2007-01-21 19:39 552,448 --a------ C:\WINDOWS\system32\rtcdll.dll
2007-01-21 19:39 441,344 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-01-21 19:39 36,864 --a------ C:\WINDOWS\system32\mf3216.dll
2007-01-21 18:54 467,224 --a------ C:\WINDOWS\system32\wuapi.dll
2007-01-21 18:54 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-01-21 18:54 195,352 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-01-21 18:54 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2007-01-21 18:54 175,896 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-01-21 18:54 128,792 --a------ C:\WINDOWS\system32\wucltui.dll
2007-01-21 18:54 <REP> d-------- C:\WINDOWS\SoftwareDistribution
2007-01-21 18:38 0 --a------ C:\WINDOWS\system32\servic.exe
2007-01-18 22:44 <REP> d-------- C:\DOCUME~1\user\.activetrader
2007-01-18 22:43 <REP> d-------- C:\Program Files\ActiveTraderFR4
2007-01-18 22:20 <REP> d-------- C:\Program Files\AxBx
2007-01-18 22:11 <REP> d-------- C:\DOCUME~1\user\Application Data\SoftPerfect Personal Firewall
2007-01-18 22:09 15,594 --a------ C:\WINDOWS\system32\drivers\spfdrv.sys
2007-01-18 22:09 <REP> d-------- C:\Program Files\SoftPerfect Personal Firewall
2007-01-16 21:07 <REP> d-------- C:\DOCUME~1\user\Application Data\Bitdefender
2007-01-16 20:25 277,044 --------- C:\WINDOWS\system32\geedd.dll
2007-01-16 20:21 <REP> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\BitDefender
2007-01-16 20:08 0 --a------ C:\WINDOWS\system32\winmsfws.exe
2007-01-16 19:59 150,382 --a------ C:\WINDOWS\system32\ei_68827.exe
2007-01-15 19:04 22,029 --------- C:\WINDOWS\system32\tuvtqqo.dll
2007-01-14 20:28 198,424 --a------ C:\WINDOWS\system32\iuengine.dll
2007-01-14 13:28 <REP> d-------- C:\Program Files\Alwil Software


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-27 14:23 444552 ---hs---- C:\WINDOWS\system32\ddeeg.bak1
2007-01-24 19:02 -------- d-------- C:\Program Files\grisoft
2007-01-23 23:40 -------- d-------- C:\Documents and Settings\user\Application Data\lavasoft
2007-01-21 18:54 -------- d--h----- C:\Program Files\windowsupdate
2007-01-18 22:50 -------- d-------- C:\Documents and Settings\user\Application Data\softperfect personal firewall
2007-01-16 21:07 -------- d-------- C:\Documents and Settings\user\Application Data\bitdefender
2006-12-29 19:55 -------- d-------- C:\Documents and Settings\user\Application Data\avg7
2006-12-26 22:54 25521880 --a------ C:\Program Files\avg75afwt_423a810.exe
2006-12-26 22:47 -------- d---s---- C:\Documents and Settings\user\Application Data\microsoft
2006-12-26 20:25 12628148 --a------ C:\Program Files\nentfrst.exe
2006-12-26 19:57 -------- d-------- C:\Documents and Settings\user\Application Data\azureus
2006-12-26 19:55 -------- d-------- C:\Documents and Settings\user\Application Data\vso
2006-12-26 19:55 -------- d-------- C:\Documents and Settings\user\Application Data\copytodvd
2006-12-23 19:30 -------- d-------- C:\Program Files\privacyeraser computing
2006-12-22 19:57 -------- d-------- C:\Documents and Settings\user\Application Data\vlc
2006-12-22 19:56 -------- d-------- C:\Program Files\vlc
2006-12-19 08:43 -------- d-------- C:\Program Files\azureus
2006-12-17 23:00 2097184 --a------ C:\Program Files\sneec900.bin
2006-12-17 22:22 81920 --a------ C:\Documents and Settings\user\Application Data\ezpinst.exe
2006-12-17 22:22 7176 --a------ C:\Documents and Settings\user\Application Data\pcouffin.cat
2006-12-17 22:22 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2006-12-17 22:22 47360 --a------ C:\Documents and Settings\user\Application Data\pcouffin.sys
2006-12-17 22:22 34 --a------ C:\Documents and Settings\user\Application Data\pcouffin.log
2006-12-17 22:22 1144 --a------ C:\Documents and Settings\user\Application Data\pcouffin.inf
2006-12-17 22:22 -------- d-------- C:\Program Files\vso
2006-12-17 22:11 -------- d-------- C:\Program Files\divx
2006-12-16 21:09 -------- d-------- C:\Program Files\rm-x© video converter
2006-12-16 20:06 -------- d-------- C:\Documents and Settings\user\Application Data\sonic
2006-12-16 20:06 -------- d-------- C:\Documents and Settings\user\Application Data\leadertech
2006-12-13 22:01 -------- d-------- C:\Program Files\sopcast
2006-12-13 22:01 -------- d-------- C:\Documents and Settings\user\Application Data\sopcast
2006-12-13 21:38 2068720 --a------ C:\Program Files\sopcast.zip
2006-12-12 17:30 520192 --a------ C:\WINDOWS\system32\divxsm.exe
2006-12-12 17:30 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2006-12-12 17:30 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2006-12-12 17:30 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2006-12-12 17:25 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-12-12 17:25 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-12-12 17:25 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-12-12 17:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2006-12-12 17:25 635486 --a------ C:\WINDOWS\system32\divx.dll
2006-12-12 17:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll
2006-12-12 17:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2006-12-12 17:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll
2006-12-12 17:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2006-12-12 17:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2006-12-12 17:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2006-12-12 17:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2006-12-12 17:24 12288 --a------ C:\WINDOWS\system32\divxwmpexttype.dll
2006-12-12 17:24 118784 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe
2006-12-07 16:25 0 --a------ C:\WINDOWS\system32\hqghumea.dll
2006-12-06 10:26 -------- d-------- C:\Documents and Settings\user\Application Data\divx
2006-12-05 23:48 16527960 --a------ C:\Program Files\divxinstaller.exe
2006-12-05 23:40 -------- d-------- C:\Program Files\msn messenger
2006-12-05 23:29 16277288 --a------ C:\Program Files\install_messenger.exe
2006-12-05 23:17 -------- d-------- C:\Program Files\free.fr
2006-12-05 17:54 -------- d-------- C:\Program Files\Fichiers communs\adobe
2006-12-05 17:54 -------- d-------- C:\Documents and Settings\user\Application Data\adobeum
2006-12-05 17:54 -------- d-------- C:\Documents and Settings\user\Application Data\adobe
2006-11-15 22:01 116984 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-11-15 22:01 115960 --------- C:\WINDOWS\system32\pxcpyi64.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"Cpqset"="C:\\Program Files\\HPQ\\Default Settings\\cpqset.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start"
"UpdateManager"="\"C:\\Program Files\\Fichiers communs\\Sonic\\Update Manager\\sgtray.exe\" /r"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\jusched.exe"
"BDMCon"="\"C:\\Program Files\\Softwin\\BitDefender10\\bdmcon.exe\" /reg"
"BDAgent"="\"C:\\Program Files\\Softwin\\BitDefender10\\bdagent.exe\""
"SoftPerfect Personal Firewall"="\"C:\\Program Files\\SoftPerfect Personal Firewall\\fw.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="sockspy.dll"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{086F3ADF-92EA-4415-877E-C7DD7DD64F14}"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Win32"="msinnt.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Win32"="msinnt.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geedd
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvtqqo

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0


Completion time: 07-01-27 14:23:12
C:\ComboFix2.txt ... 07-01-27 14:15



"user" - 07-01-27 14:10:09 Service Pack 1
ComboFix 07-01-25 - Running from: "C:\Documents and Settings\user\Bureau"
Command switches used :: /v tuvtqqo

(((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log )))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\tuvtqqo.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


"C:\WINDOWS\system32\tuvtqqo.dll"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\.exe
C:\DOCUME~1\user\Application Data\SearchToolbarCorp
C:\Program Files\VSAdd-in


((((((((((((((((((((((((((((((( Files Created from 2006-12-27 to 2007-01-27 ))))))))))))))))))))))))))))))))))


2007-01-27 14:00 444,552 ---hs---- C:\WINDOWS\system32\ddeeg.bak1
2007-01-25 19:38 <REP> d-------- C:\!KillBox
2007-01-24 20:22 1,460 --ah----- C:\WINDOWS\system32\lknc.exe
2007-01-24 19:45 203 --a------ C:\1.vbs
2007-01-24 19:02 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-01-24 00:20 12,800 --ah----- C:\WINDOWS\system32\wugcl.exe
2007-01-24 00:15 <REP> d-------- C:\SDFix
2007-01-24 00:12 <REP> dr------- C:\DOCUME~1\ADMINI~1\Menu D‚marrer
2007-01-24 00:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage r‚seau
2007-01-24 00:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1\Voisinage d'impression
2007-01-24 00:12 <REP> d--h----- C:\DOCUME~1\ADMINI~1\ModŠles
2007-01-24 00:12 <REP> d-------- C:\DOCUME~1\ADMINI~1\Mes documents
2007-01-24 00:12 <REP> d-------- C:\DOCUME~1\ADMINI~1\Favoris
2007-01-24 00:12 <REP> d-------- C:\DOCUME~1\ADMINI~1\Bureau
2007-01-23 23:40 <REP> d-------- C:\DOCUME~1\user\Application Data\Lavasoft
2007-01-23 23:39 <REP> d-------- C:\Program Files\Lavasoft
2007-01-23 22:19 <REP> d-------- C:\Program Files\CCleaner
2007-01-23 20:46 <REP> d-------- C:\Program Files\Hijackthis Version Fran‡aise
2007-01-23 19:12 <REP> d-------- C:\VundoFix Backups
2007-01-21 19:39 608,256 --------- C:\WINDOWS\system32\xpsp2res.dll
2007-01-21 19:39 593,408 --a------ C:\WINDOWS\system32\h323msp.dll
2007-01-21 19:39 552,448 --a------ C:\WINDOWS\system32\rtcdll.dll
2007-01-21 19:39 441,344 --a------ C:\WINDOWS\system32\ipnathlp.dll
2007-01-21 19:39 36,864 --a------ C:\WINDOWS\system32\mf3216.dll
2007-01-21 18:54 467,224 --a------ C:\WINDOWS\system32\wuapi.dll
2007-01-21 18:54 41,240 --a------ C:\WINDOWS\system32\wups.dll
2007-01-21 18:54 195,352 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-01-21 18:54 18,200 --a------ C:\WINDOWS\system32\wups2.dll
2007-01-21 18:54 175,896 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-01-21 18:54 128,792 --a------ C:\WINDOWS\system32\wucltui.dll
2007-01-21 18:54 <REP> d-------- C:\WINDOWS\SoftwareDistribution
2007-01-21 18:38 0 --a------ C:\WINDOWS\system32\servic.exe
2007-01-18 22:44 <REP> d-------- C:\DOCUME~1\user\.activetrader
2007-01-18 22:43 <REP> d-------- C:\Program Files\ActiveTraderFR4
2007-01-18 22:20 <REP> d-------- C:\Program Files\AxBx
2007-01-18 22:11 <REP> d-------- C:\DOCUME~1\user\Application Data\SoftPerfect Personal Firewall
2007-01-18 22:09 15,594 --a------ C:\WINDOWS\system32\drivers\spfdrv.sys
2007-01-18 22:09 <REP> d-------- C:\Program Files\SoftPerfect Personal Firewall
2007-01-16 21:07 <REP> d-------- C:\DOCUME~1\user\Application Data\Bitdefender
2007-01-16 20:25 277,044 --------- C:\WINDOWS\system32\geedd.dll
2007-01-16 20:21 <REP> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\BitDefender
2007-01-16 20:08 0 --a------ C:\WINDOWS\system32\winmsfws.exe
2007-01-16 19:59 150,382 --a------ C:\WINDOWS\system32\ei_68827.exe
2007-01-15 19:04 22,029 --------- C:\WINDOWS\system32\tuvtqqo.dll
2007-01-14 20:28 198,424 --a------ C:\WINDOWS\system32\iuengine.dll
2007-01-14 13:28 <REP> d-------- C:\Program Files\Alwil Software


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-24 19:02 -------- d-------- C:\Program Files\grisoft
2007-01-23 23:40 -------- d-------- C:\Documents and Settings\user\Application Data\lavasoft
2007-01-21 18:54 -------- d--h----- C:\Program Files\windowsupdate
2007-01-18 22:50 -------- d-------- C:\Documents and Settings\user\Application Data\softperfect personal firewall
2007-01-16 21:07 -------- d-------- C:\Documents and Settings\user\Application Data\bitdefender
2006-12-29 19:55 -------- d-------- C:\Documents and Settings\user\Application Data\avg7
2006-12-26 22:54 25521880 --a------ C:\Program Files\avg75afwt_423a810.exe
2006-12-26 22:47 -------- d---s---- C:\Documents and Settings\user\Application Data\microsoft
2006-12-26 20:25 12628148 --a------ C:\Program Files\nentfrst.exe
2006-12-26 19:57 -------- d-------- C:\Documents and Settings\user\Application Data\azureus
2006-12-26 19:55 -------- d-------- C:\Documents and Settings\user\Application Data\vso
2006-12-26 19:55 -------- d-------- C:\Documents and Settings\user\Application Data\copytodvd
2006-12-23 19:30 -------- d-------- C:\Program Files\privacyeraser computing
2006-12-22 19:57 -------- d-------- C:\Documents and Settings\user\Application Data\vlc
2006-12-22 19:56 -------- d-------- C:\Program Files\vlc
2006-12-19 08:43 -------- d-------- C:\Program Files\azureus
2006-12-17 23:00 2097184 --a------ C:\Program Files\sneec900.bin
2006-12-17 22:22 81920 --a------ C:\Documents and Settings\user\Application Data\ezpinst.exe
2006-12-17 22:22 7176 --a------ C:\Documents and Settings\user\Application Data\pcouffin.cat
2006-12-17 22:22 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2006-12-17 22:22 47360 --a------ C:\Documents and Settings\user\Application Data\pcouffin.sys
2006-12-17 22:22 34 --a------ C:\Documents and Settings\user\Application Data\pcouffin.log
2006-12-17 22:22 1144 --a------ C:\Documents and Settings\user\Application Data\pcouffin.inf
2006-12-17 22:22 -------- d-------- C:\Program Files\vso
2006-12-17 22:11 -------- d-------- C:\Program Files\divx
2006-12-16 21:09 -------- d-------- C:\Program Files\rm-x© video converter
2006-12-16 20:06 -------- d-------- C:\Documents and Settings\user\Application Data\sonic
2006-12-16 20:06 -------- d-------- C:\Documents and Settings\user\Application Data\leadertech
2006-12-13 22:01 -------- d-------- C:\Program Files\sopcast
2006-12-13 22:01 -------- d-------- C:\Documents and Settings\user\Application Data\sopcast
2006-12-13 21:38 2068720 --a------ C:\Program Files\sopcast.zip
2006-12-12 17:30 520192 --a------ C:\WINDOWS\system32\divxsm.exe
2006-12-12 17:30 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2006-12-12 17:30 200704 --a------ C:\WINDOWS\system32\ssldivx.dll
2006-12-12 17:30 1044480 --a------ C:\WINDOWS\system32\libdivx.dll
2006-12-12 17:25 806912 --a------ C:\WINDOWS\system32\divx_xx0c.dll
2006-12-12 17:25 806912 --a------ C:\WINDOWS\system32\divx_xx07.dll
2006-12-12 17:25 790528 --a------ C:\WINDOWS\system32\divx_xx11.dll
2006-12-12 17:25 73728 --a------ C:\WINDOWS\system32\dpl100.dll
2006-12-12 17:25 635486 --a------ C:\WINDOWS\system32\divx.dll
2006-12-12 17:25 593920 --a------ C:\WINDOWS\system32\dpugui11.dll
2006-12-12 17:25 57344 --a------ C:\WINDOWS\system32\dpv11.dll
2006-12-12 17:25 53248 --a------ C:\WINDOWS\system32\dpugui10.dll
2006-12-12 17:25 344064 --a------ C:\WINDOWS\system32\dpus11.dll
2006-12-12 17:25 294912 --a------ C:\WINDOWS\system32\dpu11.dll
2006-12-12 17:25 294912 --a------ C:\WINDOWS\system32\dpu10.dll
2006-12-12 17:25 196608 --a------ C:\WINDOWS\system32\dtu100.dll
2006-12-12 17:24 12288 --a------ C:\WINDOWS\system32\divxwmpexttype.dll
2006-12-12 17:24 118784 --a------ C:\WINDOWS\system32\divxcodecupdatechecker.exe
2006-12-07 16:25 0 --a------ C:\WINDOWS\system32\hqghumea.dll
2006-12-06 10:26 -------- d-------- C:\Documents and Settings\user\Application Data\divx
2006-12-05 23:48 16527960 --a------ C:\Program Files\divxinstaller.exe
2006-12-05 23:40 -------- d-------- C:\Program Files\msn messenger
2006-12-05 23:29 16277288 --a------ C:\Program Files\install_messenger.exe
2006-12-05 23:17 -------- d-------- C:\Program Files\free.fr
2006-12-05 17:54 -------- d-------- C:\Program Files\Fichiers communs\adobe
2006-12-05 17:54 -------- d-------- C:\Documents and Settings\user\Application Data\adobeum
2006-12-05 17:54 -------- d-------- C:\Documents and Settings\user\Application Data\adobe
2006-11-15 22:01 116984 --------- C:\WINDOWS\system32\pxinsi64.exe
2006-11-15 22:01 115960 --------- C:\WINDOWS\system32\pxcpyi64.exe


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"Cpqset"="C:\\Program Files\\HPQ\\Default Settings\\cpqset.exe"
"iTunesHelper"="C:\\Program Files\\iTunes\\iTunesHelper.exe"
"eabconfg.cpl"="C:\\Program Files\\HPQ\\Quick Launch Buttons\\EabServr.exe /Start"
"UpdateManager"="\"C:\\Program Files\\Fichiers communs\\Sonic\\Update Manager\\sgtray.exe\" /r"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\j2re1.4.2_05\\bin\\jusched.exe"
"BDMCon"="\"C:\\Program Files\\Softwin\\BitDefender10\\bdmcon.exe\" /reg"
"BDAgent"="\"C:\\Program Files\\Softwin\\BitDefender10\\bdagent.exe\""
"SoftPerfect Personal Firewall"="\"C:\\Program Files\\SoftPerfect Personal Firewall\\fw.exe\""
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="sockspy.dll"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"
"{086F3ADF-92EA-4415-877E-C7DD7DD64F14}"=""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Win32"="msinnt.exe"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"Win32"="msinnt.exe"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geedd
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tuvtqqo

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
Usnsvc REG_MULTI_SZ usnsvc\0\0


Completion time: 07-01-27 14:15:28

Bonjour
je reviens de we et je vois qu'il y a de bonnes news, je vais continuer la procedure ce soir...je voulais au passage te poser 1 ou 2 questions pour ne plus être embetté par la suite : j'utilise bitdefender que j'ai acheté recemment mais sans firewall...celui de windows est il suffisant ou bien vaut il mieux que j'en utilise un autre ? enfin mon windows SP1 est il sûr ou bien vaut-il mieux de passer à sp2 ? merci bien...

ce pare feu est il gratuit ?

voici donc le rapport kaspersky et j'ai fais un hijackthis juste apres dans la foulee...(j'en avais fait un juste avant aussi pour fixer les objets)...

Tuesday, January 30, 2007 8:12:14 PM
Système d'exploitation : Microsoft Windows XP Home Edition, Service Pack 1 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 30/01/2007
Enregistrements dans la base antivirus Kaspersky : 248827


Paramètres d'analyse
Analyser avec la base antivirus suivante standard
Analyser les archives vrai
Analyser les bases de messagerie vrai

Cible de l'analyse Poste de travail
C:\
D:\

Statistiques de l'analyse
Total d'objets analysés 27031
Nombre de virus trouvés 2
Nombre d'objets infectés 1 / 0
Nombre d'objets suspects 1
Durée de l'analyse 00:29:45

Nom de l'objet infecté Nom du virus Dernière action
C:\!KillBox\geedd.dll( 1) L'objet est verrouillé ignoré

C:\!KillBox\tuvtqqo.dll( 2) L'objet est verrouillé ignoré

C:\Avenger\1.vbs L'objet est verrouillé ignoré

C:\Avenger\wugcl.exe Suspect : Packed.Win32.CryptExe ignoré

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\user\Cookies\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré

C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\user\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\user\Local Settings\Temp\~DFEDF3.tmp L'objet est verrouillé ignoré

C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré

C:\Documents and Settings\user\NTUSER.DAT L'objet est verrouillé ignoré

C:\Documents and Settings\user\ntuser.dat.LOG L'objet est verrouillé ignoré

C:\Documents and Settings\user\Recent\1.lnk L'objet est verrouillé ignoré

C:\Documents and Settings\user\UserData\index.dat L'objet est verrouillé ignoré

C:\Program Files\Sonic\Express Labeler\stax.exe Infecté : Trojan-Spy.Win32.Banker.cel ignoré

C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0066273.exe L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0069274.exe L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070271.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070272.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070348.exe L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070349.exe L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070355.exe L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP33\A0070371.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0079581.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0095031.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0095032.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0095033.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0095034.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP37\A0095036.dll L'objet est verrouillé ignoré

C:\System Volume Information\_restore{A11A92AF-7A14-461E-AB03-D3ADB6BA3A1A}\RP38\change.log L'objet est verrouillé ignoré

C:\WINDOWS\Debug\oakley.log L'objet est verrouillé ignoré

C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré

C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré

C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré

C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré

C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré

C:\WINDOWS\Temp\tmp00004081\tmp00000000 L'objet est verrouillé ignoré

C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré

C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré

C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré

Analyse terminée.



Logfile of HijackThis v1.99.1
Scan saved at 20:18:44, on 30/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\SoftPerfect Personal Firewall\fw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] C:\Program Files\SoftPerfect Personal Firewall\fw.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: fsecure 2006 (fsecure) - Unknown owner - C:\WINDOWS\fswinsys.exe (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

re
j'ai fais la manip services .msc avec la desactivation fsecure par contre en relançant hijackthis je n'ai pas retrouvé la ligne alors voici le nouveau rapport de scan...

Logfile of HijackThis v1.99.1
Scan saved at 22:07:27, on 30/01/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\SoftPerfect Personal Firewall\fw.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\hijackthis vf.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [SoftPerfect Personal Firewall] C:\Program Files\SoftPerfect Personal Firewall\fw.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Anti-Pub.lnk = C:\Program Files\Antipub\antipub.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

re
tout semble tres bien fonctionner maintenant mais j'ai des soucis pour supprimer :

C:\!KillBox
C:\Avenger

pour le 1er j'ai le message suivant :

"impossible de supprimer geedd.dll (1) : impossible de lire à partir du fichier ou de la disquette source"

pour le 2nd j'ai le message :

""impossible de supprimer 1.vbs : impossible de lire à partir du fichier ou de la disquette source"



d'autre part est-ce que je dois aussi supprimer "SDFix" et "CCleaner" ?

et bien je crois que je suis sauvé...merci 1000 fois pour cette précieuse aide sans laquelle je ne m'en serais jamais sorti seul !!! et bravo pour tes compétences en la matière...