[Trojan] Infecté par Win32:VBStat-c

Résolu
chibiluk -  
Bonjour,
Mon antivirus a détecté ce trojan mais est incapable de s'en débarassé.
J'ai donc télécharger Hijackthis afin de résoudre ce problème avec votre aide si vous le voulez bien. Je vous remercie d'avance. Avant de créer un log Hijack dois-je le renommer en scanner?
Configuration: Windows XP
Firefox 2.0.0.4

19 réponses

  1.  Regis59 Contributeur sécurité
    Bienvenue sur le forum d’entraide de CommentCaMarche.net

    Nous connaissons votre situation et nous vous conseillons de ne surtout pas vous inquiéter.
    De plus, au vu du nombre croissant de désinfections effectuées sur le forum, nous vous demandons un peu de patience et surtout de ne pas créer plusieurs postes pour le même problème.
    Merci de votre compréhension.

    Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
    http://www.atribune.org/ccount/click.php?id=4

    Double-clique VundoFix.exe afin de le lancer.
    Coche Run VundoFix as a task.
    Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok
    Clique sur le bouton Scan for Vundo.
    Lorsque le scan est complété, clique sur le bouton Remove Vundo.
    Une invite te demandera si tu veux supprimer les fichiers, clique YES
    Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
    Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
    Démarre ton PC à nouveau.
    Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

    A+
    1
    1. Regis59 Contributeur sécurité
      Re,

      Vas sur le site https://virusscan.jotti.org/
      - Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
      C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
      - Clic sur submit toujours en haut à droite
      - Le scan va se lancer, ça va prendre un petit instant
      - En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
      Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799
      1
      1. Regis59 Contributeur sécurité
        Re,

        Télécharge: Pocket Killbox ici
        http://www.downloads.subratam.org/KillBox.exe

        :: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::
        http://pageperso.aol.fr/balltrap34/killbox.htm

        puis lancer HijackThis:

        clique sur "do a system scan only"

        * Cocher la case au début de ces lignes:

        O2 - BHO: (no name) - {2DECFF05-41D3-4276-BAD3-23074C12FB4D} - C:\WINDOWS\system32\pmnnl.dll (file missing)

        O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe

        O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\nkxjpxda.dll",realset

        O20 - Winlogon Notify: winxvb32 - winxvb32.dll (file missing)

        * Valider avec fix checked

        Double clic sur killbox.exe (Pocket Killbox)

        - Avec la méthode du bloc note, voir vidéo, voici la liste a supprimer:

        C:\WINDOWS\system32\nvsvct5.exe
        C:\WINDOWS\system32\nkxjpxda.dll

        Redemarre et remet un Hijackthis.

        A+
        1
        1. chibiluk Auteur
          Voici mon log après avoir renommé Hijackthis.exe en Scanner.exe

          Logfile of HijackThis v1.99.1
          Scan saved at 16:13:37, on 04/06/2007
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16441)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
          C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
          C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
          C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          C:\Program Files\Alwil Software\Avast4\ashServ.exe
          C:\Program Files\Equant\Dialer\EACSvrMngr.exe
          C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
          C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
          C:\Program Files\OCS Inventory Agent\ocsservice.exe
          C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
          C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
          C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Apoint\Apoint.exe
          C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
          C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
          C:\Program Files\Apoint\Apntex.exe
          C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
          C:\WINDOWS\system32\dla\tfswctrl.exe
          C:\WINDOWS\system32\nvsvct5.exe
          C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          C:\Documents and Settings\All Users\Application Data\novsvida.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\hkcmd.exe
          C:\WINDOWS\system32\igfxsrvc.exe
          C:\WINDOWS\system32\igfxpers.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Digital Line Detect\DLG.exe
          C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
          C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Mozilla Firefox\firefox.exe
          C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe

          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
          O2 - BHO: (no name) - {2AF8C526-9F8C-4171-9C3D-45AC6D2A284D} - C:\WINDOWS\system32\pmnnl.dll
          O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
          O2 - BHO: (no name) - {9A853E36-4A35-4DBF-9C03-AD9423798E35} - C:\WINDOWS\system32\pmnmljh.dll
          O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINDOWS\system32\menbtgse.dll
          O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
          O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
          O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
          O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
          O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
          O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe
          O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
          O4 - HKLM\..\Run: [novsvida.exe] C:\Documents and Settings\All Users\Application Data\novsvida.exe
          O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
          O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
          O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
          O4 - HKLM\..\Run: [Genuine] rundll32.exe "C:\WINDOWS\system32\danywpdh.dll",realset
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
          O4 - Global Startup: Digital Line Detect.lnk = ?
          O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
          O11 - Options group: [INTERNATIONAL] International*
          O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
          O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
          O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
          O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = bride.fr
          O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
          O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
          O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
          O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
          O20 - Winlogon Notify: pmnmljh - C:\WINDOWS\SYSTEM32\pmnmljh.dll
          O20 - Winlogon Notify: pmnnl - C:\WINDOWS\system32\pmnnl.dll
          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
          O20 - Winlogon Notify: winxvb32 - C:\WINDOWS\SYSTEM32\winxvb32.dll
          O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
          O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
          O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
          O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
          O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
          O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
          O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
          O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
          O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
          O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
          O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
          O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
          O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
          O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
          O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
          O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
          O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
          0
          2. chibiluk Auteur
            RAPPORT HIJACK

            Logfile of HijackThis v1.99.1
            Scan saved at 09:26:23, on 05/06/2007
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v7.00 (7.00.6000.16441)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
            C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
            C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
            C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            C:\Program Files\Alwil Software\Avast4\ashServ.exe
            C:\Program Files\Equant\Dialer\EACSvrMngr.exe
            C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
            C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
            C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
            C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
            C:\Program Files\OCS Inventory Agent\ocsservice.exe
            C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
            C:\WINDOWS\system32\svchost.exe
            C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
            C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
            C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Apoint\Apoint.exe
            C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
            C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
            C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
            C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
            C:\WINDOWS\system32\dla\tfswctrl.exe
            C:\Program Files\Apoint\Apntex.exe
            C:\WINDOWS\system32\nvsvct5.exe
            C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            C:\Documents and Settings\All Users\Application Data\novsvida.exe
            C:\WINDOWS\system32\hkcmd.exe
            C:\WINDOWS\system32\igfxpers.exe
            C:\WINDOWS\system32\igfxsrvc.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\Digital Line Detect\DLG.exe
            C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
            C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
            C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\wuauclt.exe
            C:\Program Files\Internet Explorer\IEXPLORE.EXE
            C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe

            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
            R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
            R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
            O2 - BHO: (no name) - {2DECFF05-41D3-4276-BAD3-23074C12FB4D} - C:\WINDOWS\system32\pmnnl.dll (file missing)
            O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
            O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
            O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
            O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
            O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
            O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
            O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
            O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
            O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe
            O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
            O4 - HKLM\..\Run: [novsvida.exe] C:\Documents and Settings\All Users\Application Data\novsvida.exe
            O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
            O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
            O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
            O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\nkxjpxda.dll",realset
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
            O4 - Global Startup: Digital Line Detect.lnk = ?
            O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
            O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
            O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
            O11 - Options group: [INTERNATIONAL] International*
            O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
            O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
            O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
            O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
            O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
            O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = bride.fr
            O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
            O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
            O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
            O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
            O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
            O20 - Winlogon Notify: winxvb32 - C:\WINDOWS\SYSTEM32\winxvb32.dll
            O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
            O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
            O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
            O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
            O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
            O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
            O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
            O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
            O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
            O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
            O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
            O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
            O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
            O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
            O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
            O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
            O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
            O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

            RAPPORT VUNDOFIX

            VundoFix V6.4.2

            Checking Java version...

            Java version is 1.4.2.3
            Old versions of java are exploitable and should be removed.

            Scan started at 09:13:08 05/06/2007

            Listing files found while scanning....

            C:\WINDOWS\system32\adxpjxkn.ini
            C:\WINDOWS\system32\cbxwxwv.dll
            C:\WINDOWS\system32\danywpdh.dll
            C:\WINDOWS\system32\ddccbbb.dll
            C:\WINDOWS\system32\hdpwynad.ini
            C:\WINDOWS\system32\lnnmp.bak1
            C:\WINDOWS\system32\lnnmp.bak2
            C:\WINDOWS\system32\lnnmp.ini
            C:\WINDOWS\system32\lnnmp.ini2
            C:\WINDOWS\system32\lnnmp.tmp
            C:\WINDOWS\system32\menbtgse.dll
            C:\WINDOWS\system32\mhjuyvnx.dll
            C:\WINDOWS\system32\nkxjpxda.dll
            C:\WINDOWS\system32\pmnmljh.dll
            C:\WINDOWS\system32\pmnnl.dll
            C:\WINDOWS\system32\rqrpnlj.dll
            C:\WINDOWS\system32\xuyrrhpi.dll

            Beginning removal...

            Attempting to delete C:\WINDOWS\system32\adxpjxkn.ini
            C:\WINDOWS\system32\adxpjxkn.ini Has been deleted!

            Attempting to delete C:\WINDOWS\system32\cbxwxwv.dll
            C:\WINDOWS\system32\cbxwxwv.dll Has been deleted!

            Attempting to delete C:\WINDOWS\system32\danywpdh.dll
            C:\WINDOWS\system32\danywpdh.dll Has been deleted!

            Attempting to delete C:\WINDOWS\system32\ddccbbb.dll
            C:\WINDOWS\system32\ddccbbb.dll Has been deleted!

            Attempting to delete C:\WINDOWS\system32\hdpwynad.ini
            C:\WINDOWS\system32\hdpwynad.ini Has been deleted!

            Attempting to delete C:\WINDOWS\system32\lnnmp.bak1
            C:\WINDOWS\system32\lnnmp.bak1 Has been deleted!

            Attempting to delete C:\WINDOWS\system32\lnnmp.bak2
            C:\WINDOWS\system32\lnnmp.bak2 Has been deleted!

            Attempting to delete C:\WINDOWS\system32\lnnmp.ini
            C:\WINDOWS\system32\lnnmp.ini Has been deleted!

            Attempting to delete C:\WINDOWS\system32\lnnmp.ini2
            C:\WINDOWS\system32\lnnmp.ini2 Has been deleted!

            Attempting to delete C:\WINDOWS\system32\lnnmp.tmp
            C:\WINDOWS\system32\lnnmp.tmp Has been deleted!

            Attempting to delete C:\WINDOWS\system32\menbtgse.dll
            C:\WINDOWS\system32\menbtgse.dll Has been deleted!

            Attempting to delete C:\WINDOWS\system32\mhjuyvnx.dll
            C:\WINDOWS\system32\mhjuyvnx.dll Has been deleted!

            Attempting to delete C:\WINDOWS\system32\nkxjpxda.dll
            C:\WINDOWS\system32\nkxjpxda.dll Could not be deleted.

            Attempting to delete C:\WINDOWS\system32\pmnmljh.dll
            C:\WINDOWS\system32\pmnmljh.dll Could not be deleted.

            Attempting to delete C:\WINDOWS\system32\pmnnl.dll
            C:\WINDOWS\system32\pmnnl.dll Has been deleted!

            Attempting to delete C:\WINDOWS\system32\rqrpnlj.dll
            C:\WINDOWS\system32\rqrpnlj.dll Has been deleted!

            Performing Repairs to the registry.
            Done!

            Beginning removal...

            Attempting to delete C:\WINDOWS\system32\nkxjpxda.dll
            C:\WINDOWS\system32\nkxjpxda.dll Has been deleted!

            Attempting to delete C:\WINDOWS\system32\pmnmljh.dll
            C:\WINDOWS\system32\pmnmljh.dll Has been deleted!

            Performing Repairs to the registry.
            Done!
            0
            1. chibiluk Auteur
              Voici les résultats du scan - Rien n'a été détecté

              A-Squared Found nothing
              AntiVir Found nothing
              ArcaVir Found nothing
              Avast Found nothing
              AVG Antivirus Found nothing
              BitDefender Found nothing
              ClamAV Found nothing
              Dr.Web Found nothing
              F-Prot Antivirus Found nothing
              F-Secure Anti-Virus Found nothing
              Fortinet Found nothing
              Kaspersky Anti-Virus Found nothing
              NOD32 Found nothing
              Norman Virus Control Found nothing
              Panda Antivirus Found nothing
              Rising Antivirus Found nothing
              VirusBuster Found nothing
              VBA32 Found nothing
              0
              1. Regis59 Contributeur sécurité
                ok et tu peux faire pareil avec:
                C:\Documents and Settings\All Users\Application Data\novsvida.exe

                A+
                0
                1. chibiluk Auteur
                  Je n'ai plus ce fichier
                  0
                  1. Regis59 Contributeur sécurité
                    OK Remet un hijackthis

                    a+
                    0
                    1. chibiluk Auteur
                      Logfile of HijackThis v1.99.1
                      Scan saved at 17:00:04, on 11/06/2007
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16441)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                      C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                      C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                      C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                      C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                      C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                      C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                      C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                      C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                      C:\Program Files\OCS Inventory Agent\ocsservice.exe
                      C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Apoint\Apoint.exe
                      C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                      C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
                      C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
                      C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
                      C:\WINDOWS\system32\dla\tfswctrl.exe
                      C:\WINDOWS\system32\hkcmd.exe
                      C:\WINDOWS\system32\igfxpers.exe
                      C:\Program Files\Apoint\Apntex.exe
                      C:\WINDOWS\system32\igfxsrvc.exe
                      C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Digital Line Detect\DLG.exe
                      C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                      C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: (no name) - {2DECFF05-41D3-4276-BAD3-23074C12FB4D} - C:\WINDOWS\system32\pmnnl.dll (file missing)
                      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                      O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
                      O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
                      O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                      O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
                      O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                      O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe
                      O4 - HKLM\..\Run: [novsvida.exe] C:\Documents and Settings\All Users\Application Data\novsvida.exe
                      O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                      O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                      O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                      O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\nkxjpxda.dll",realset
                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                      O4 - Global Startup: Digital Line Detect.lnk = ?
                      O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                      O11 - Options group: [INTERNATIONAL] International*
                      O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
                      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
                      O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
                      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
                      O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                      O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
                      O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
                      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                      O20 - Winlogon Notify: winxvb32 - winxvb32.dll (file missing)
                      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                      O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                      O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
                      O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                      O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                      O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                      O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
                      O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                      O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
                      O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                      O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                      O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                      0
                      1. chibiluk Auteur
                        Il semblerait que ce fichier soit vu par Hijack "C:\Documents and Settings\All Users\Application Data\novsvida.exe " mais il n'apparait nulle part dans mon explorateur. J'ai bien sur activé la vision des fichiers cachés.
                        0
                        1. chibiluk Auteur
                          Logfile of HijackThis v1.99.1
                          Scan saved at 10:42:32, on 12/06/2007
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v7.00 (7.00.6000.16441)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                          C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                          C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                          C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                          C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                          C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                          C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                          C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                          C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                          C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                          C:\Program Files\OCS Inventory Agent\ocsservice.exe
                          C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
                          C:\WINDOWS\system32\userinit.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\Program Files\Apoint\Apoint.exe
                          C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                          C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
                          C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
                          C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
                          C:\WINDOWS\system32\dla\tfswctrl.exe
                          C:\WINDOWS\system32\hkcmd.exe
                          C:\WINDOWS\system32\igfxsrvc.exe
                          C:\WINDOWS\system32\igfxpers.exe
                          C:\Program Files\Apoint\Apntex.exe
                          C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Digital Line Detect\DLG.exe
                          C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                          C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe
                          C:\WINDOWS\system32\userinit.exe
                          C:\WINDOWS\system32\wuauclt.exe

                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                          R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                          R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                          O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                          O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                          O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
                          O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
                          O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                          O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
                          O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                          O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                          O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                          O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                          O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                          O4 - Global Startup: Digital Line Detect.lnk = ?
                          O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                          O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                          O11 - Options group: [INTERNATIONAL] International*
                          O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
                          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
                          O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
                          O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
                          O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                          O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                          O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
                          O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
                          O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                          O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                          O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                          O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                          O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                          O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
                          O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                          O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                          O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                          O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                          O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                          O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
                          O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                          O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
                          O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                          O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                          O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                          0
                          1. Regis59 Contributeur sécurité
                            Salut

                            Ou en sont tes soucis?

                            A+
                            0
                            1. chibiluk Auteur
                              Je pense que c'est bon. Je passe en résolu.
                              0
                              1. chibiluk Auteur
                                Je ne peux pas changer le titre de départ pour marquer "[résolu]" ?
                                0
                                1. Regis59 Contributeur sécurité
                                  C'est bon, c est coché ;)
                                  0
                                  1. Regis59 Contributeur sécurité
                                    Bonjour,

                                    Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
                                    Procèdes comme ceci :
                                    http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

                                    A bientôt
                                    0
                                    1. sam
                                      Que la pais soit avec vous
                                      telecharger symantec antivirus et tous va marché bien

                                      ou nod32
                                      que la pais soit avec vous
                                      0
                                      1. didi
                                        bonjour
                                        moi aussi mon antivirus a détecté ce trojan mais est incapable de s'en débarassé et moi je n'y comrend rien.

                                        afin de résoudre ce problème j'aurai besoin de votre aide si vous le voulez bien. Je vous remercie d'avance.

                                        Configuration: Windows XP
                                        antivirus: avast 4.7
                                        -1

                                        Discussions similaires

                                        Problème avec "PUADIManager:Win32/OfferCore
                                        Knaki

                                        3 réponses
                                        PUADlManager:Win32/OfferCore
                                        tenmalade

                                        2 réponses
                                        Aide pour un virus
                                        cerise92700

                                        41 réponses
                                        PUADlManager:Win32/OfferCore
                                        bernardarrad

                                        3 réponses
                                        Trojan impossible à supprimer!
                                        Gridouu

                                        12 réponses