Pb avec le Trojan.Win32.Delf.zj

BUD038 -  
Bonjour à tous,

je n'arrive pas à supprimer un trojan de mon pc : Trojan.Win32.Delf.zj

je possède Securitoo de wanadoo, spybot, ad-aware mais rien à faire.

J'ai essayé plusieurs programmes de scan en ligne. J'ai aussi téléchargé HighJackThis mais je ne sais évidemment pas quoi faire avec ca... :P

Si y'a un bon samaritain qui s'y connait dans le coin.. aide moi s.v.p!!

Bud.

Configuration: Windows XP
Internet Explorer 6.0
Configuration: Windows XP
Internet Explorer 6.0

3 réponses

  1. soprno49150
    telecharge spybot c gratui essay avec sa sinon va sur le site de kaspersky et fai une analyse on line
    0
    2. BUD038 Auteur
      VOICI MON LOGFILE :

      Logfile of HijackThis v1.99.1
      Scan saved at 11:48:50, on 10/06/2007
      Platform: Windows XP SP1 (WinNT 5.01.2600)
      MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\PROGRA~1\SECURI~1\av_fw\backweb\8520111\Program\SERVIC~1.EXE
      C:\WINDOWS\System32\CTsvcCDA.exe
      C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
      C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
      C:\Program Files\Securitoo\av_fw\backweb\8520111\program\fsbwsys.exe
      C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
      C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
      C:\WINDOWS\System32\FTRTSVC.exe
      C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
      C:\WINDOWS\System32\nvsvc32.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
      C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
      C:\WINDOWS\SOUNDMAN.EXE
      C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      C:\Program Files\Winamp\winampa.exe
      C:\Program Files\Caere\OmniPagePro90\opware32.exe
      C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
      C:\WINDOWS\system32\ntvdm.exe
      C:\WINDOWS\System32\RUNDLL32.EXE
      C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
      C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
      C:\WINDOWS\System32\WDBtnMgr.exe
      C:\Program Files\Picasa2\PicasaMediaDetector.exe
      C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
      C:\WINDOWS\System32\ctfmon.exe
      C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
      C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
      C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
      C:\Program Files\My Book\WD Backup\uBBMonitor.exe
      C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
      C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
      C:\Program Files\Securitoo\av_fw\FSGUI\fsguiexe.exe
      C:\Program Files\Securitoo\av_fw\backweb\8520111\Program\fspex.exe
      C:\Program Files\Wanadoo\EspaceWanadoo.exe
      C:\Program Files\Wanadoo\ComComp.exe
      C:\PROGRA~1\Wanadoo\Toaster.exe
      C:\PROGRA~1\Wanadoo\Inactivity.exe
      C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
      C:\PROGRA~1\Wanadoo\PollingModule.exe
      C:\Program Files\Wanadoo\Watch.exe
      C:\Program Files\Internet Explorer\iexplore.exe
      C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
      C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10MT2.EXE
      C:\Program Files\Internet Explorer\IEXPLORE.EXE
      D:\UTILITAIRES\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
      O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
      O2 - BHO: (no name) - {14CA48B8-28D9-49A2-9F8E-05AEF99CF6CE} - c:\windows\system32\xtzrvnld.dll
      O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O2 - BHO: (no name) - {8D7ED48D-0228-4CEE-84A6-8855CC9D6837} - c:\windows\system32\jlhajlh.dll
      O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
      O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
      O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
      O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
      O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
      O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
      O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe
      O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe"
      O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
      O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
      O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
      O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
      O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
      O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
      O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
      O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
      O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
      O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
      O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
      O4 - Startup: reminder-Enregistrement du produit ScanSoft.lnk = C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
      O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
      O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
      O4 - Global Startup: WD Backup Monitor.lnk = C:\Program Files\My Book\WD Backup\uBBMonitor.exe
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
      O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
      O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
      O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
      O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.1.10/cfweb_activex.camfrogweb.com-advanced-2.0.1.10_instmodule.exe
      O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
      O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
      O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
      O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
      O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
      O17 - HKLM\System\CCS\Services\Tcpip\..\{AF4A6BD4-E99B-413B-94DF-03E0B1AD7E79}: NameServer = 80.10.246.1 80.10.246.132
      O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
      O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
      O20 - Winlogon Notify: glxvhsjw - C:\WINDOWS\SYSTEM32\jlhajlh.dll
      O23 - Service: Securitoo Antivirus Firewall (BackWeb Plug-in - 8520111) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\8520111\Program\SERVIC~1.EXE
      O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
      O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
      O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\8520111\program\fsbwsys.exe
      O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
      O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
      O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
      O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
      O23 - Service: ieupdater (Microsoft IE Updater) - Unknown owner - C:\DOCUME~1\BOURDI~1\LOCALS~1\Temp\ieupdate.exe (file missing)
      O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
      0
      1. BUD038 Auteur
        MON ANTIVIRUS A RECONNU 3 INFECTIONS :

        C:\Documents and Settings\Bourdillon\Local Settings\Temp\zssnwujh.sys Infection: Trojan.Win32.Delf.zj Action : Supprimé.
        C:\WINDOWS\system32\drivers\axvebyop.sys Infection: Trojan.Win32.Delf.zj Action : Supprimé.
        C:\WINDOWS\Temp\zssnwujh.sys Infection: Trojan.Win32.Delf.zj Action : Supprimé.

        AU REDEMARRAGE SUIVANT TOUJOURS LES MEMES SONT LA... HELP ME PLEASE ;-(
        0
      2. BUD038 Auteur
        je viens d'utiliser SDFix, voici le report.txt :

        Running From: C:\SDFix

        Safe Mode:
        Checking Services:

        Name:
        Microsoft IE Updater

        ImagePath:
        C:\DOCUME~1\BOURDI~1\LOCALS~1\Temp\ieupdate.exe /start

        Microsoft IE Updater - Deleted

        Restoring Windows Registry Values
        Restoring Windows Default Hosts File

        Rebooting...

        Normal Mode:
        Checking Files:

        Below files will be copied to Backups folder then removed:

        C:\WINDOWS\system32\RunOnce.t__ - Deleted
        C:\WINDOWS\system32\RunOnce.tm_ - Deleted

        Removing Temp Files...

        ADS Check:

        Checking if ADS is attached to system32 Folder
        C:\WINDOWS\system32
        No streams found.

        Checking if ADS is attached to svchost.exe
        C:\WINDOWS\system32\svchost.exe
        No streams found.

        Checking if ADS is attached to ntoskrnl.exe
        C:\WINDOWS\system32\ntoskrnl.exe
        No streams found.

        Final Check:

        Remaining Services:
        ------------------

        Authorized Application Key Export:

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
        "C:\\Program Files\\Securitoo\\av_fw\\backweb\\8520111\\program\\fspex.exe"="C:\\Program Files\\Securitoo\\av_fw\\backweb\\8520111\\program\\fspex.exe:*:enabled:Securitoo Antivirus Firewall"
        "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"

        [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
        "C:\\Program Files\\Securitoo\\av_fw\\backweb\\8520111\\program\\fspex.exe"="C:\\Program Files\\Securitoo\\av_fw\\backweb\\8520111\\program\\fspex.exe:*:enabled:Securitoo Antivirus Firewall"
        "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"="C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"

        Remaining Files:
        ---------------

        Backups Folder: - C:\SDFix\backups\backups.zip

        Listing Files with Hidden Attributes:

        C:\Documents and Settings\Bourdillon\Bureau\ie.exe
        C:\Program Files\Picasa2\setup.exe
        C:\WINDOWS\LastGood.Tmp\INF\oem6.inf
        C:\WINDOWS\LastGood.Tmp\INF\oem6.PNF

        Listing User Accounts:

        comptes d'utilisateurs de \\BOURDILL-ILDNRJ

        Administrateur Bourdillon HelpAssistant
        Invit‚ SUPPORT_388945a0
        La commande s'est termin‚e correctement.

        Finished

        ET VOICI LE NOUVEAU LOG HIJACKTHIS :

        Logfile of HijackThis v1.99.1
        Scan saved at 16:38:00, on 10/06/2007
        Platform: Windows XP SP1 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\PROGRA~1\SECURI~1\av_fw\backweb\8520111\Program\SERVIC~1.EXE
        C:\WINDOWS\System32\CTsvcCDA.exe
        C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
        C:\Program Files\Securitoo\av_fw\Anti-Virus\FSGK32.EXE
        C:\Program Files\Securitoo\av_fw\backweb\8520111\program\fsbwsys.exe
        C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
        C:\Program Files\Securitoo\av_fw\Common\FSMB32.EXE
        C:\Program Files\Securitoo\av_fw\Anti-Virus\fssm32.exe
        C:\WINDOWS\System32\FTRTSVC.exe
        C:\WINDOWS\System32\nvsvc32.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Securitoo\av_fw\Common\FCH32.EXE
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Securitoo\av_fw\Common\FAMEH32.EXE
        C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
        C:\WINDOWS\SOUNDMAN.EXE
        C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
        C:\Program Files\Winamp\winampa.exe
        C:\Program Files\Caere\OmniPagePro90\opware32.exe
        C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE
        C:\WINDOWS\system32\ntvdm.exe
        C:\WINDOWS\System32\RUNDLL32.EXE
        C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
        C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
        C:\WINDOWS\System32\WDBtnMgr.exe
        C:\Program Files\Picasa2\PicasaMediaDetector.exe
        C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
        C:\WINDOWS\System32\ctfmon.exe
        C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
        C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
        C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
        C:\Program Files\My Book\WD Backup\uBBMonitor.exe
        C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
        C:\Program Files\Securitoo\av_fw\Anti-Virus\fsav32.exe
        C:\Program Files\Securitoo\av_fw\FSGUI\fsguiexe.exe
        C:\Program Files\Securitoo\av_fw\backweb\8520111\Program\fspex.exe
        C:\Program Files\Wanadoo\EspaceWanadoo.exe
        C:\Program Files\Wanadoo\ComComp.exe
        C:\PROGRA~1\Wanadoo\Toaster.exe
        C:\PROGRA~1\Wanadoo\Inactivity.exe
        C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
        C:\PROGRA~1\Wanadoo\PollingModule.exe
        C:\Program Files\Wanadoo\Watch.exe
        C:\WINDOWS\System32\LVComsX.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\Program Files\Internet Explorer\iexplore.exe
        D:\UTILITAIRES\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
        O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
        O2 - BHO: (no name) - {14CA48B8-28D9-49A2-9F8E-05AEF99CF6CE} - c:\windows\system32\xtzrvnld.dll
        O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O2 - BHO: (no name) - {8D7ED48D-0228-4CEE-84A6-8855CC9D6837} - c:\windows\system32\jlhajlh.dll
        O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
        O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
        O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
        O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe
        O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
        O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
        O4 - HKLM\..\Run: [OmniPage] C:\Program Files\Caere\OmniPagePro90\opware32.exe
        O4 - HKLM\..\Run: [FSASWREG] "C:\Program Files\Securitoo\av_fw\Anti-Spyware\fsaswreg.exe"
        O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Securitoo\av_fw\Common\FSM32.EXE" /splash
        O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Securitoo\av_fw\TNB\TNBUtil.exe" /CHECKALL /WAITFORSW
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
        O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
        O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
        O4 - HKLM\..\Run: [MAAgent] C:\Program Files\MarkAny\ContentSafer\MAAgent.exe
        O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
        O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
        O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
        O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
        O4 - Startup: reminder-Enregistrement du produit ScanSoft.lnk = C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
        O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
        O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O4 - Global Startup: WD Backup Monitor.lnk = C:\Program Files\My Book\WD Backup\uBBMonitor.exe
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
        O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
        O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
        O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/2.0.1.10/cfweb_activex.camfrogweb.com-advanced-2.0.1.10_instmodule.exe
        O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
        O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
        O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
        O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
        O16 - DPF: {CE69F98F-2AF3-4306-BAC6-A79070EDA1B4} (Zylom Loader Object) - http://eu.download.games.yahoo.com/zylom/activex/zylomloader.cab
        O17 - HKLM\System\CCS\Services\Tcpip\..\{AF4A6BD4-E99B-413B-94DF-03E0B1AD7E79}: NameServer = 80.10.246.130 80.10.246.3
        O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
        O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
        O20 - Winlogon Notify: glxvhsjw - C:\WINDOWS\SYSTEM32\jlhajlh.dll
        O23 - Service: Securitoo Antivirus Firewall (BackWeb Plug-in - 8520111) - Unknown owner - C:\PROGRA~1\SECURI~1\av_fw\backweb\8520111\Program\SERVIC~1.EXE
        O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
        O23 - Service: F-Secure Gatekeeper Handler Starter - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\Anti-Virus\fsgk32st.exe
        O23 - Service: fsbwsys - F-Secure Corp. - C:\Program Files\Securitoo\av_fw\backweb\8520111\program\fsbwsys.exe
        O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\FWES\Program\fsdfwd.exe
        O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\Common\FSMA32.EXE
        O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
        O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

        JE VOUDRAIS DE L'AIDE... MERCI PAR AVANCE POUR VOS REPONSES.
        0

    Discussions similaires

    PDM:Trojan.generic.win32 depuis 2 jours
    CTF05

    5 réponses
    Infection par Trojan.Win32.Bazon.a
    Capdec

    16 réponses
    PDM Trojan.Win32.Generic
    SuperFun

    108 réponses
    suprimer le virus heur trojan win32 generic
    synetik93

    15 réponses
    porbleme TROJAN.WIN32.SEPEH
    flayer

    1 réponse