Je suis attaquer par Brave Sentry

Question

Aidez moi SVP !
je suis attaquer par un virus appeler Brave Sentry, c'est enfaite un virus qui s'installe sur votre ordinateur en se faisant passer pour un antivirus et disant que vous êtes infecter pour acheter leur antivirus. Si quelqu'un peut m'aider ce serait vraiment génial. A chaque fois que je démarre mon ordinateur et une session un message d'erreur disant ceci : code dangereux détecté dans le fichier C:\WINDOWS\system32\pmkjj.dll.

J'ai fait aussi une analyse grâce à HijackThis et voici le résultat :

Logfile of HijackThis v1.99.1
Scan saved at 19:55:16, on 12/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ServicePackFiles\winlogon.exe
C:\WINDOWS\ServicePackFiles\free.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCSVR.EXE
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Documents and Settings\Isabelle\Mes documents\Mes images\hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O2 - BHO: (no name) - {941508F8-CCD9-44E0-AC29-4F1E141373F7} - C:\WINDOWS\system32\ddcbaxw.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: (no name) - {A041A971-9819-402B-9695-38E5DCB49AE8} - C:\WINDOWS\system32\pmkjj.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [xem] C:\WINDOWS\ServicePackFiles\winlogon.exe
O4 - HKLM\..\Run: [Microsoft WWW] C:\WINDOWS\ServicePackFiles\free.exe 
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Brave-Sentry] C:\Program Files\BraveSentry\BraveSentry.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.01net.com/telecharger/
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs:   c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: ddcbaxw - C:\WINDOWS\SYSTEM32\ddcbaxw.dll
O20 - Winlogon Notify: instcat - C:\WINDOWS\SYSTEM32\instcat.dll
O20 - Winlogon Notify: pmkjj - C:\WINDOWS\system32\pmkjj.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32pcc.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: system32 - {3D801EA0-A617-4E47-A889-B90B88412F3E} - sysprinters.dll (file missing)
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~2\174112\Program\SERVIC~1.EXE
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure\Common\FSMA32.EXE
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

Voilà si une personne peut m'aider elle est bien sur la bienvenue !

Djodjo74 · Answer

J'ai fait une deuxiéme analyse avec SmitFraudFix si sa peut vous aider voici le résultat :

SmitFraudFix v2.202

Rapport fait à 21:18:21,29, 12/07/2007
Executé à partir de C:\Documents and Settings\Isabelle\Mes documents\Mes images\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ServicePackFiles\winlogon.exe
C:\WINDOWS\ServicePackFiles\free.exe
C:\Program Files\F-Secure\Common\FSMA32.EXE
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\F-Secure\Common\FSMB32.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\Program Files\F-Secure\Common\FCH32.EXE
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\F-Secure\Common\FAMEH32.EXE
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\F-Secure\Common\FSGK32.EXE
C:\Program Files\F-Secure\Anti-Virus\fsav32.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\desktop.html PRESENT !
C:\WINDOWS\xpupdate.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Isabelle


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Isabelle\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Isabelle\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\BraveSentry\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="  c:\windows\system32\ldcore.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/100 VE Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 15.243.128.51
DNS Server Search Order: 15.243.160.51

Description: Intel(R) PRO/100 VE Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 0.0.0.0

HKLM\SYSTEM\CCS\Services\Tcpip\..\{1CF8E9A5-1E4C-4A2A-882F-A09709B609A1}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
HKLM\SYSTEM\CS1\Services\Tcpip\..\{1CF8E9A5-1E4C-4A2A-882F-A09709B609A1}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
HKLM\SYSTEM\CS3\Services\Tcpip\..\{1CF8E9A5-1E4C-4A2A-882F-A09709B609A1}: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS3\Services\Tcpip\..\{DE246E2C-8697-44FE-A5BB-FA04D12D4DEC}: DhcpNameServer=15.243.128.51 15.243.160.51
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1 0.0.0.0


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

green day · Answer

Salut 

# Démarre en mode sans échec : 
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter 
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée. 
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal ! 
(Si F8 ne marche pas utilise la touche F5). 
---------------------------------------------------------------------------- 
# Relance le programme Smitfraud :
Cette fois choisit l’option 2, répond oui a tous ; 
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum 


ensuite, 

Téléchargez VundoFix.exe (par Atribune) sur ton Bureau : 

 http://www.atribune.org/ccount/click.php?id=4

*Double-clique VundoFix.exe afin de le lancer.
* Cliquez sur le bouton Scan for Vundo.
* Lorsque le scan est complété, cliquez sur le bouton Remove Vundo.
* Une invite vous demandera  supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
 * le PC va s'éteindre ("shutdown") :  clique OK
 * Démarrez votre PC à nouveau
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse. 


++

Djodjo74 · Answer

Voila les résultats du Scan Vundofix :

VundoFix V6.5.4

Checking Java version...

Java version is 1.5.0.10

Scan started at 12:51:41 13/07/2007

Listing files found while scanning....

C:\WINDOWS\system32\jjkmp.ini
C:\WINDOWS\system32\pmkjj.dll

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\jjkmp.ini
C:\WINDOWS\system32\jjkmp.ini Has been deleted!

 Attempting to delete C:\WINDOWS\system32\pmkjj.dll
C:\WINDOWS\system32\pmkjj.dll Has been deleted!

Performing Repairs to the registry.
Done!


Et voilà ceux avec HijackThis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:57:32, on 13/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\F-Secure\fswsclds.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\ServicePackFiles\free.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Isabelle\Mes documents\Mes images\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7F83AAB4-FA81-4C0A-809D-C923BFE8B72F} - C:\WINDOWS\system32\pmkjj.dll (file missing)
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O2 - BHO: (no name) - {941508F8-CCD9-44E0-AC29-4F1E141373F7} - C:\WINDOWS\system32\ddcbaxw.dll (file missing)
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [xem] C:\WINDOWS\ServicePackFiles\winlogon.exe
O4 - HKLM\..\Run: [Microsoft WWW] C:\WINDOWS\ServicePackFiles\free.exe 
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Windows update loader] C:\Windows\xpupdate.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [svchost.exe] C:\WINDOWS\svchost.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [DCOM Server 20509] rundll32.exe "C:\WINDOWS\system32\pebi.dll",run (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WinMedia] services (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.01net.com/telecharger/
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - AppInit_DLLs:   c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: ddcbaxw - ddcbaxw.dll (file missing)
O20 - Winlogon Notify: instcat - C:\WINDOWS\SYSTEM32\instcat.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32pcc.dll (file missing)
O20 - Winlogon Notify: PH - PH (file missing)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~2\174112\Program\SERVIC~1.EXE (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

green day · Answer

Salut

 ok, on avance !

Télécharge VirtumundoBegone sur le bureau: 
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions. 
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis. 
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu 


++

Djodjo74 · Answer

Voici le rapport VGB :


[07/13/2007, 16:27:07] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Isabelle\Bureau\VirtumundoBeGone.exe" )
[07/13/2007, 16:27:16] - Detected System Information:
[07/13/2007, 16:27:16] -  Windows Version: 5.1.2600, Service Pack 2
[07/13/2007, 16:27:16] -  Current Username: Isabelle (Admin)
[07/13/2007, 16:27:16] -  Windows is in NORMAL mode.
[07/13/2007, 16:27:16] - Searching for Browser Helper Objects:
[07/13/2007, 16:27:16] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[07/13/2007, 16:27:16] -  BHO 2: {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
[07/13/2007, 16:27:16] -  BHO 3: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
[07/13/2007, 16:27:16] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/13/2007, 16:27:16] -  BHO 5: {7F83AAB4-FA81-4C0A-809D-C923BFE8B72F} ()
[07/13/2007, 16:27:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/13/2007, 16:27:16] -  Checking for HKLM\...\Winlogon\Notify\pmkjj
[07/13/2007, 16:27:16] -  Key not found: HKLM\...\Winlogon\Notify\pmkjj, continuing.
[07/13/2007, 16:27:16] -  BHO 6: {85589B5D-D53D-4237-A677-46B82EA275F3} (XML Helper)
[07/13/2007, 16:27:16] -  BHO 7: {941508F8-CCD9-44E0-AC29-4F1E141373F7} ()
[07/13/2007, 16:27:16] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/13/2007, 16:27:16] -  Checking for HKLM\...\Winlogon\Notify\ddcbaxw
[07/13/2007, 16:27:16] -  Found: HKLM\...\Winlogon\Notify\ddcbaxw - This is probably Virtumundo.
[07/13/2007, 16:27:16] -  Assigning {941508F8-CCD9-44E0-AC29-4F1E141373F7} MSEvents Object
[07/13/2007, 16:27:16] - BHO list has been changed! Starting over...
[07/13/2007, 16:27:16] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[07/13/2007, 16:27:17] -  BHO 2: {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
[07/13/2007, 16:27:17] -  BHO 3: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
[07/13/2007, 16:27:17] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/13/2007, 16:27:17] -  BHO 5: {7F83AAB4-FA81-4C0A-809D-C923BFE8B72F} ()
[07/13/2007, 16:27:17] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/13/2007, 16:27:17] -  Checking for HKLM\...\Winlogon\Notify\pmkjj
[07/13/2007, 16:27:17] -  Key not found: HKLM\...\Winlogon\Notify\pmkjj, continuing.
[07/13/2007, 16:27:17] -  BHO 6: {85589B5D-D53D-4237-A677-46B82EA275F3} (XML Helper)
[07/13/2007, 16:27:17] -  BHO 7: {941508F8-CCD9-44E0-AC29-4F1E141373F7} (MSEvents Object)
[07/13/2007, 16:27:17] - ALERT: Found MSEvents Object!
[07/13/2007, 16:27:17] -  BHO 8: {955BE0B8-BC85-4CAF-856E-8E0D8B610560} (BHO pour Compagnon Web Encarta)
[07/13/2007, 16:27:17] -  BHO 9: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class)
[07/13/2007, 16:27:17] - Finished Searching Browser Helper Objects
[07/13/2007, 16:27:17] - *** Detected MSEvents Object
[07/13/2007, 16:27:17] - Trying to remove MSEvents Object...
[07/13/2007, 16:27:18] -    Terminating Process: IEXPLORE.EXE
[07/13/2007, 16:27:18] -    Terminating Process: RUNDLL32.EXE
[07/13/2007, 16:27:18] -    Disabling Automatic Shell Restart
[07/13/2007, 16:27:18] -    Terminating Process: EXPLORER.EXE
[07/13/2007, 16:27:18] -    Suspending the NT Session Manager System Service
[07/13/2007, 16:27:18] -    Terminating Windows NT Logon/Logoff Manager
[07/13/2007, 16:27:19] -    Re-enabling Automatic Shell Restart
[07/13/2007, 16:27:19] -   File to disable: C:\WINDOWS\system32\ddcbaxw.dll
[07/13/2007, 16:27:19] -   Removing HKLM\...\Browser Helper Objects\{941508F8-CCD9-44E0-AC29-4F1E141373F7}
[07/13/2007, 16:27:19] -   Removing HKCR\CLSID\{941508F8-CCD9-44E0-AC29-4F1E141373F7}
[07/13/2007, 16:27:19] -   Adding Kill Bit for ActiveX for GUID: {941508F8-CCD9-44E0-AC29-4F1E141373F7}
[07/13/2007, 16:27:19] -   Deleting ATLEvents/MSEvents Registry entries
[07/13/2007, 16:27:19] -   Removing HKLM\...\Winlogon\Notify\ddcbaxw
[07/13/2007, 16:27:19] - Searching for Browser Helper Objects:
[07/13/2007, 16:27:19] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[07/13/2007, 16:27:19] -  BHO 2: {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} (Download Manager Browser Helper Object)
[07/13/2007, 16:27:19] -  BHO 3: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
[07/13/2007, 16:27:19] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[07/13/2007, 16:27:19] -  BHO 5: {7F83AAB4-FA81-4C0A-809D-C923BFE8B72F} ()
[07/13/2007, 16:27:19] - WARNING: BHO has no default name. Checking for Winlogon reference.
[07/13/2007, 16:27:19] -  Checking for HKLM\...\Winlogon\Notify\pmkjj
[07/13/2007, 16:27:19] -  Key not found: HKLM\...\Winlogon\Notify\pmkjj, continuing.
[07/13/2007, 16:27:19] -  BHO 6: {85589B5D-D53D-4237-A677-46B82EA275F3} (XML Helper)
[07/13/2007, 16:27:19] -  BHO 7: {955BE0B8-BC85-4CAF-856E-8E0D8B610560} (BHO pour Compagnon Web Encarta)
[07/13/2007, 16:27:19] -  BHO 8: {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} (EpsonToolBandKicker Class)
[07/13/2007, 16:27:19] - Finished Searching Browser Helper Objects
[07/13/2007, 16:27:19] - Finishing up...
[07/13/2007, 16:27:19] - A restart is needed.
[07/13/2007, 16:27:22] - Attempting to Restart via STOP error (Blue Screen!)


Et enfin voici le rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:32:30, on 13/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\F-Secure\fswsclds.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\ServicePackFiles\free.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Isabelle\Mes documents\Mes images\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7F83AAB4-FA81-4C0A-809D-C923BFE8B72F} - C:\WINDOWS\system32\pmkjj.dll (file missing)
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [xem] C:\WINDOWS\ServicePackFiles\winlogon.exe
O4 - HKLM\..\Run: [Microsoft WWW] C:\WINDOWS\ServicePackFiles\free.exe 
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Windows update loader] C:\Windows\xpupdate.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [svchost.exe] C:\WINDOWS\svchost.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [DCOM Server 20509] rundll32.exe "C:\WINDOWS\system32\pebi.dll",run (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WinMedia] services (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.01net.com/telecharger/
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - AppInit_DLLs:   c:\windows\system32\ldcore.dll
O20 - Winlogon Notify: instcat - C:\WINDOWS\SYSTEM32\instcat.dll
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32pcc.dll (file missing)
O20 - Winlogon Notify: PH - PH (file missing)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~2\174112\Program\SERVIC~1.EXE (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

green day · Answer

ok,

Télécharge ComboFix (par sUBs) d'un de ces liens sur ton bureau: 

http://www.techsupportforum.com/sectools/combofix.exe 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 


Double clique combofix.exe et suis les invites 

Poste le rapport et un nouveau hijack stp

++

Djodjo74 · Answer

Je pense qu'il ne reste plus grand chose nan (comme virus je parle) ??
Sinon voici le rapport combofix :

"DJODJO" - 2007-07-13 19:00:37 - ComboFix 07-07-13.8 - Service Pack 2 NTFS

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\d.exe
C:\DOCUME~1\LOCALS~1\APPLIC~1\Install.dat
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\favicon.ico
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\google_files
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\google_files\hp0.gif
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\google_files\hp1.gif
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\google_files\hp2.gif
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\google_files\hp3.gif
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\index.html
C:\Documents and Settings\DJODJO~1.NOM\www.google.com\thank.html
C:\i
C:\Program Files\curity~1
C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00003.dll
C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00004.dll
C:\Program Files\myglobalsearch
C:\Program Files\myglobalsearch\bar\History\search
C:\temp\tn3
C:\WINDOWS\b122.exe
C:\WINDOWS\b136.exe
C:\WINDOWS\servicepackfiles\free.exe
C:\WINDOWS\system32\2121107841.dll
C:\WINDOWS\system32\dnsersnd.dll
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\drivers\etc\hosts.tim
C:\WINDOWS\system32\dwdsregt.exe
C:\WINDOWS\system32\gmc.exe.exe
C:\WINDOWS\system32\instcat.dll
C:\WINDOWS\system32\ldcore.dll
C:\WINDOWS\system32\ldinfo.ldr
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\pebi.dll
C:\WINDOWS\system32\sks~1
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\vx.tll
C:\WINDOWS\system32\windev-peers.ini
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\system32\wnsapisv32.exe
C:\WINDOWS\system32\xpdx.sys
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\winvip.exe
C:\WINDOWS\xmlhelper.dll
C:\WINDOWS\xmlhelper2.dll

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_CORE
-------\LEGACY_NTMLSVC
-------\asc3550u
-------\core
-------\NtmlSvc

((((((((((((((((((((((((( Files Created from 2007-06-13 to 2007-07-13 )))))))))))))))))))))))))))))))

2007-07-13 19:00 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-13 17:03 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\Contacts
2007-07-13 16:58 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\APPLIC~1\AdobeUM
2007-07-13 16:36 786,432 --ah----- C:\DOCUME~1\DJODJO~1.NOM\NTUSER.DAT
2007-07-13 16:36 <REP> dr------- C:\DOCUME~1\DJODJO~1.NOM\Mes documents
2007-07-13 16:36 <REP> dr------- C:\DOCUME~1\DJODJO~1.NOM\Favoris
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\www.google.com
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\WINDOWS
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\Voisinage r‚seau
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\Voisinage d'impression
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\ModŠles
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\Menu D‚marrer
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\Bureau
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\APPLIC~1\Symantec
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\APPLIC~1\SampleView
2007-07-13 16:36 <REP> d-------- C:\DOCUME~1\DJODJO~1.NOM\APPLIC~1\Apple Computer
2007-07-13 12:51 <REP> d-------- C:\VundoFix Backups
2007-07-13 12:41 0 --a------ C:\DOCUME~1\Isabelle\APPLIC~1\wklnhst.dat
2007-07-13 12:41 <REP> d-------- C:\DOCUME~1\Isabelle\APPLIC~1\Template
2007-07-13 12:29 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-07-13 12:29 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-07-13 12:29 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-07-12 23:33 3,072 --a------ C:\WINDOWS\system32\drivers\kcp.sys
2007-07-12 23:33 21,504 --a------ C:\WINDOWS\system32\vedxg3am1et3.exe
2007-07-12 23:33 13,364 --a------ C:\WINDOWS\system32\max1d1164v.exe
2007-07-12 23:33 10,316 --a------ C:\WINDOWS\system32\vedxga5me3.exe
2007-07-12 23:33 1,632 --a------ C:\WINDOWS\system32\vedxga1me4t1.exe
2007-07-12 23:22 53,248 --a------ C:\WINDOWS\system32\oleauth32.dll
2007-07-12 23:22 53,248 --a------ C:\WINDOWS\system32\mstscex.dll
2007-07-12 23:20 192,599 --a------ C:\WINDOWS\system32\twinrndt.exe
2007-07-12 23:18 <REP> d-------- C:\WINDOWS\system32\b06FdUe
2007-07-12 23:18 <REP> d-------- C:\Temp\brr
2007-07-12 23:18 <REP> d-------- C:\Temp
2007-07-12 21:54 95,872 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-07-12 21:54 94,552 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-07-12 21:54 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-07-12 21:54 745,600 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-07-12 21:54 43,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-07-12 21:54 26,888 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-07-12 21:54 23,416 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-07-12 21:54 <REP> d-------- C:\Program Files\Alwil Software
2007-07-12 21:18 698 --a------ C:\WINDOWS\system32\tmp.reg
2007-07-12 20:53 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-07-12 20:52 <REP> d---s---- C:\DOCUME~1\Isabelle\UserData
2007-07-12 19:01 <REP> d-------- C:\DOCUME~1\Isabelle\www.google.com
2007-07-12 18:54 9,356 --a------ C:\WINDOWS\system32\dllh8jkd1q6.exe
2007-07-12 18:54 9,308 --a------ C:\WINDOWS\system32\dllh8jkd1q7.exe
2007-07-12 18:54 9,086 --a------ C:\WINDOWS\system32\dllh8jkd1q5.exe
2007-07-12 18:54 8,340 --a------ C:\WINDOWS\system32\vedxg4am1et2.exe
2007-07-12 18:54 6,269 --a------ C:\WINDOWS\system32\vedxg6ame4.exe
2007-07-12 18:54 4,096 --a------ C:\WINDOWS\system32\vedxga3me2.exe
2007-07-12 18:54 27,311 --a------ C:\WINDOWS\system32\vedxga4m1et4.exe
2007-07-12 18:54 23,524 --a------ C:\WINDOWS\system32\dllh8jkd1q2.exe
2007-07-12 18:54 16,896 --a------ C:\WINDOWS\system32\vedxga4me1.exe
2007-07-12 18:54 10,569 --a------ C:\WINDOWS\system32\vedxga8me6.exe
2007-07-12 18:53 6,689 --a------ C:\WINDOWS\system32\ldcore.dll
2007-07-12 18:53 16 --a------ C:\WINDOWS\system32\dllh8jkd1q8.exe
2007-07-12 18:53 11,571 --a------ C:\WINDOWS\system32\kernelwind32.exe
2007-07-12 18:53 <REP> d-------- C:\WINDOWS\ServicePackFiles
2007-07-11 20:10 44,032 --a------ C:\WINDOWS\b144.exe
2007-07-11 19:48 1,536 --a------ C:\vbhq.exe
2007-07-10 21:15 <REP> d-------- C:\Program Files\Words
2007-07-10 20:21 73,728 --a------ C:\WINDOWS\b143.exe
2007-07-07 16:10 <REP> d-------- C:\DOCUME~1\ALEXIA~1.NOM\APPLIC~1\WinTouch
2007-07-07 16:05 <REP> d-------- C:\Program Files\Messenger Plus! Live
2007-07-07 15:19 <REP> d-------- C:\DOCUME~1\Isabelle\APPLIC~1\AdobeUM
2007-07-07 14:54 <REP> d--h----- C:\WINDOWS\msdownld.tmp
2007-07-07 14:51 <REP> d-------- C:\WINDOWS\network diagnostic
2007-07-06 12:53 35,840 --a------ C:\WINDOWS\system32\52592502ld.exe
2007-07-05 23:55 35,840 --a------ C:\WINDOWS\system32\msvcrtd.exe
2007-07-05 15:21 10,830 --a------ C:\DOCUME~1\MARION~1.000\qnwxcj.exe
2007-07-05 10:49 <REP> d-------- C:\DOCUME~1\MARION~1.000\APPLIC~1\AdobeUM
2007-07-04 22:05 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
2007-07-04 13:32 <REP> d-------- C:\Program Files\Windows Live
2007-07-04 13:32 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
2007-07-04 13:32 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
2007-07-04 11:37 126,976 --a------ C:\WINDOWS\xhelper.dll
2007-07-03 16:42 22,016 --a------ C:\WINDOWS\b138.exe
2007-07-03 16:38 10,830 --a------ C:\DOCUME~1\DJODJO\blyvof.exe
2007-07-03 16:38 10,318 --a------ C:\DOCUME~1\DJODJO\okqzdi.exe
2007-06-30 12:15 122,880 --a------ C:\WINDOWS\xmlhelper4.dll
2007-06-28 16:59 <REP> d-------- C:\DOCUME~1\ALEXIA~1.NOM\APPLIC~1\Sonic
2007-06-28 16:59 <REP> d-------- C:\DOCUME~1\ALEXIA~1.NOM\APPLIC~1\Leadertech
2007-06-25 14:50 8,464 --a------ C:\WINDOWS\system32\sporder.dll
2007-06-25 14:50 <REP> d-------- C:\Program Files\themexp
2007-06-13 20:35 <REP> d-------- C:\Program Files\Fichiers communs\mpDRM
2007-06-13 20:35 <REP> d-------- C:\Program Files\Fichiers communs\fluxDVD
2007-06-13 20:35 <REP> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\mpDRM

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-13 18:54:58 -------- d-----w C:\Program Files\Wanadoo
2007-07-13 14:36:37 -------- d-----w C:\Program Files\Web Publish
2007-07-12 21:52:15 -------- d-----w C:\Program Files\F-Secure
2007-07-12 21:48:17 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2007-07-12 20:34:29 -------- d-----w C:\Program Files\iTunes
2007-07-11 11:46:07 527,582 ----a-w C:\WINDOWS\system32\perfh00C.dat
2007-07-11 11:46:07 104,200 ----a-w C:\WINDOWS\system32\perfc00C.dat
2007-07-04 21:28:33 -------- d-----w C:\Program Files\Windows Live Safety Center
2007-07-04 11:33:22 -------- d-----w C:\Program Files\MSN Messenger
2007-06-28 14:42:10 -------- d-----w C:\Program Files\Easy Internet signup
2007-06-14 17:51:39 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-01 06:20:30 51,568 ----a-w C:\WINDOWS\system32\sirenacm.dll
2007-05-26 13:34:23 -------- d-----w C:\Program Files\Samsung
2007-05-19 16:18:11 -------- d-----w C:\Program Files\MSXML 4.0
2007-05-19 14:15:21 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-16 15:13:53 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-13 12:40:19 -------- d-----w C:\Program Files\Sony
2007-05-13 12:39:41 -------- d-----w C:\Program Files\QuickTime
2007-05-13 12:28:32 -------- d-----w C:\Program Files\Sony Setup
2007-04-25 14:22:35 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-23 16:51:36 24,576 ----a-w C:\WINDOWS\TEMPIadHide3.dll
2007-04-18 16:14:18 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 20:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 20:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 20:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 20:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 20:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 20:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 20:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 20:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-16 20:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-04-16 20:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll
2007-04-13 01:21:14 271,360 ----a-w C:\WINDOWS\system32\mscoree.dll
2006-11-15 04:34:46 22 -csha-w C:\WINDOWS\SMINST\HPCD.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-12-18 05:16 59032 --a------ C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19C8E43B-07B3-49CB-BFFC-6777B593E6F8}]
2006-08-17 12:28 520704 --a------ C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A}]
2006-11-05 17:44 548992 -ra------ C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2006-11-09 16:21 440056 --a------ C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F83AAB4-FA81-4C0A-809D-C923BFE8B72F}]
C:\WINDOWS\system32\pmkjj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
2007-07-04 12:20 126976 --a------ C:\WINDOWS\xhelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{955BE0B8-BC85-4CAF-856E-8E0D8B610560}]
2005-06-04 18:04 228048 --a------ C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
2005-02-21 22:50 368640 --a------ C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 17:42]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-08-02 17:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOKIT"="C:\Program Files\Wanadoo\Shell.exe" [2004-08-23 14:50]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-06-01 08:21]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\8øð]
8øð

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PH]
PH

Contents of the 'Scheduled Tasks' folder
2007-06-28 14:42:14 C:\WINDOWS\tasks\Connexion facile à Internet.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-13 20:54:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-13 20:55:40 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-13 20:55

--- E O F ---

Et voici le repport HijackThis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 21:04:01, on 13/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\F-Secure\fswsclds.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Documents and Settings\Isabelle\Mes documents\Mes images\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7F83AAB4-FA81-4C0A-809D-C923BFE8B72F} - C:\WINDOWS\system32\pmkjj.dll (file missing)
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Windows update loader] C:\Windows\xpupdate.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [svchost.exe] C:\WINDOWS\svchost.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [DCOM Server 20509] rundll32.exe "C:\WINDOWS\system32\pebi.dll",run (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WinMedia] services (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\npjpi150_10.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.01net.com/telecharger/
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - http://www.adobe.com/products/acrobat/nos/gp.cab
O20 - Winlogon Notify: 8øð - 8øð (file missing)
O20 - Winlogon Notify: PH - PH (file missing)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~2\174112\Program\SERVIC~1.EXE (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

green day · Answer

oula, le dernier n'a pas était fait pour rien ! :)

il y a encore un fichier.dll qui fait de la résistance !

 fais ce qui est indiqué ici stp :

virus methode preliminaire de desinfection version fr

++

Djodjo74 · Answer

Je n'ai pas pu avoir le rapport AVG mais je pense que c'est pas trop grâve, voici le rapport du scan Bitdefender :

BitDefender Online Scanner - Real Time Virus Report
  
 
Generated at: Sun, Jul 15, 2007 - 19:24:59
 

--------------------------------------------------------------------------------

 
Scan Info

 
Scanned Files
 458205
 
Infected Files
 150
  
 
Virus Detected
  
  
 
Trojan.Downloader.Winfixer.O
 2
 
Generic.Malware.SYd!dld.4D5C6E9F
 1
 
Trojan.Downloader.Purityscan.EH
 1
 
Trojan.Purityad.O
 2
 
Rootkit.Agent.EV
 4
 
Trojan.Spambot.BXB
 2
 
Trojan.Popwin.BK
 8
 
Worm.P2P.AB
 3
 
Generic.Malware.Mdld.34115F59
 2
 
Trojan.Clicker.Small.CF
 1
 
Trojan.Pws.Agent.LF
 1
 
Trojan.Grum.F
 2
 
Trojan.BHO.BT
 3
 
GenPack:Trojan.Downloader.Tibs.GXC
 1
 
DeepScan:Generic.Malware.Fdld!!.24CEC8CE
 4
 
Trojan.Mezzia.AL
 1
 
Trojan.Downloader.Agent.BHU
 1
 
Trojan.Downloader.Small.AACD
 5
 
Trojan.Downloader.JISG
 5
 
Adware.Newdotnet.U
 1
 
Trojan.Pakes.AG
 2
 
Trojan.BHO.AV
 2
 
Trojan.Downloader.Agent.YHP
 3
 
Backdoor.Agent.ALM
 1
 
Trojan.Peed.HUJ
 2
 
DeepScan:Generic.Malware.SFYd!.4E0EA331
 2
 
GenPack:Generic.Malware.SMYddldoe.81453D2A
 1
 
Trojan.WLPatch.A
 2
 
Trojan.Downloader.BUA
 1
 
DeepScan:Generic.Malware.dld!!.65A38C68
 2
 
Trojan.Tibs.BW
 6
 
Trojan.Dropper.Delf.HS
 1
 
Trojan.Peed.OQ
 7
 
Trojan.Tibs.BX
 1
 
Trojan.Downloader.Small.CXX
 4
 
Trojan.Peed.Gen
 4
 
Trojan.Tibs.BY
 1
 
Trojan.Clicker.Agent.JH
 2
 
Worm.Locksky.AW
 2
 
Trojan.Downloader.VB.VEZ
 2
 
Win32.Worm.Potos.A
 2
 
Trojan.Peed.HYR
 5
 
Generic.Malware.dld!!.B25712B6
 3
 
Trojan.Dropper.Zeno.A
 3
 
Generic.Malware.SYd!dld.219D6D15
 1
 
Trojan.Matcash.DLM
 1
 
Trojan.Agent.AANB
 2
 
Trojan.Proxy.Dlena.CL
 26
 
Trojan.Obfuscated.2.Gen
 3
 
Trojan.Horse.AZT
 6
 
--------------------------------------------------------------------------------
 
Et voici le rapport Hijackthis :

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 19:28:37, on 15/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\F-Secure\fswsclds.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\PROGRA~1\Wanadoo\GestionnaireInternet.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Documents and Settings\Isabelle\Mes documents\Mes images\HiJackThis_v2.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Download Manager Browser Helper Object - {19C8E43B-07B3-49CB-BFFC-6777B593E6F8} - C:\PROGRA~1\FICHIE~1\fluxDVD\DOWNLO~1\XEBDLH~1.DLL
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1	oolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {7F83AAB4-FA81-4C0A-809D-C923BFE8B72F} - (no file)
O2 - BHO: BHOAd - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\xhelper.dll
O2 - BHO: BHO pour Compagnon Web Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Compagnon Web Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE	oolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [WOOKIT] C:\Program Files\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Windows update loader] C:\Windows\xpupdate.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [svchost.exe] C:\WINDOWS\svchost.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [Service Pack 1] C:\WINDOWS\system32\vedxg6ame4.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [DCOM Server 20509] rundll32.exe "C:\WINDOWS\system32\pebi.dll",run (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WinMedia] services (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Pages liées - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Pages similaires - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.01net.com/telecharger/
O15 - Trusted Zone: *.canalplay.com (HKLM)
O15 - Trusted Zone: *.canalplusactive.com (HKLM)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O20 - Winlogon Notify: 8øð - 8øð (file missing)
O20 - Winlogon Notify: PH - PH (file missing)
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Securitoo AntiVirus (BackWeb Client - 174112) - Unknown owner - C:\PROGRA~1\SECURI~2\174112\Program\SERVIC~1.EXE (file missing)
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Fax - Unknown owner - C:\WINDOWS\system32\fxssvc.exe
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\F-Secure\fswsclds.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\msvcrtd.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

green day · Answer

Salut

 avu le rapport du scan en ligne, essaye à nouveau de faire un scan avec avg et de poster le rapport stp !

++

Djodjo74 · Answer

Désolé en ce moment je n'ai pas le temps de le faire mais dès le millieu de la semaine prochaine ce sera bon.

Djodjo74 · Answer

Voila le résultat de l'analyse (désolé d'avoir été aussi long) :

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	13:57:25 03/08/2007

 + Résultat de l'analyse:	



C:\QooBox\Quarantine\C\WINDOWS\xmlhelper2.dll.vir -> Adware.Agent : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP189\A0036891.dll -> Adware.Agent : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038048.dll -> Adware.Agent : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP186\A0026809.exe -> Adware.PurityScan : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP187\A0027970.exe -> Adware.PurityScan : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP178\A0023711.exe -> Adware.RK : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP181\A0025289.exe -> Adware.Softomate : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP189\A0036886.exe -> Adware.Softomate : Ignoré.
C:\Documents and Settings\LocalService\Local Settings\Temp\i2.tmp -> Adware.SurfSide : Ignoré.
C:\Documents and Settings\LocalService\Local Settings\Temp\stdrun4.exe -> Adware.SurfSide : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP202\A0040668.exe -> Adware.ZenoSearch : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038093.exe -> Backdoor.Agent.alm : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Alexia.NOM-EB85C523610\Application Data\Microsoft\ujffbd.exe~ -> Downloader.Agent.buo : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Alexia.NOM-EB85C523610\Application Data\WinTouch\WTUninstaller.exe -> Downloader.Agent.buo : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Alexia.NOM-EB85C523610\Local Settings\Temporary Internet Files\Content.IE5\UNE1YHST\wtuninstaller.prod.v10006.21jun2007.exe[1].6d0cb2d6a24f18581441fa00c380b2f2 -> Downloader.Agent.buo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP186\A0026856.exe -> Downloader.Agent.buo : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038039.exe -> Downloader.Obfuscated.n : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\LocalService\Local Settings\Temp\DxcUpdater3.exe -> Downloader.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\Words\Words.exe~ -> Downloader.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP188\A0028209.exe -> Downloader.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038038.dll -> Downloader.Small.dxm : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038044.exe -> Downloader.Small.ehu : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Alexia.NOM-EB85C523610\Local Settings\Temporary Internet Files\Content.IE5\8PEZ0PIN\xqwkh[1].txt -> Downloader.Small.ewf : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038031.exe -> Downloader.VB.awj : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\WINDOWS\b136.exe.vir -> Dropper.Agent.bfr : Nettoyé et sauvegardé (mise en quarantaine).
C:\Program Files\InternetGameBox\InternetGameBox.exe -> Dropper.NaviP.u : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP202\A0040678.exe -> Not-A-Virus.Downloader.Win32.WinFixer.o : Ignoré.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Local Settings\Temporary Internet Files\Content.IE5\WRG3Q1KL\SystemDoctor2006FreeInstall_fr[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.q : Ignoré.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038045.exe -> Proxy.Xorpix.be : Nettoyé et sauvegardé (mise en quarantaine).
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@247realmedia[2].txt -> TrackingCookie.247realmedia : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@247realmedia[1].txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.129:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.66:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.96:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@fnac.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@msnaccountservices.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@notrefamille.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@maisondevalerie.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@redcats.122.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@2o7[2].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@msnlivefavorites.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@3.adbrite[1].txt -> TrackingCookie.Adbrite : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@adbrite[2].txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.42:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@adrevolver[1].txt -> TrackingCookie.Adrevolver : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@adrevolver[1].txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.140:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.141:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.49:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.50:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@adtech[2].txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@advertising[1].txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.105:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@adviva[2].txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.43:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.48:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.106:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.68:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@bluestreak[2].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@fl01.ct2.comclick[1].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@fl01.ct2.comclick[2].txt -> TrackingCookie.Comclick : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@data.coremetrics[1].txt -> TrackingCookie.Coremetrics : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Nettoyé.
:mozilla.81:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Dealtime : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@stat.dealtime[2].txt -> TrackingCookie.Dealtime : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@dealtime[1].txt -> TrackingCookie.Dealtime : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@stat.dealtime[1].txt -> TrackingCookie.Dealtime : Nettoyé.
:mozilla.41:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.55:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@doubleclick[2].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.70:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.72:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@estat[1].txt -> TrackingCookie.Estat : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@www.etracker[2].txt -> TrackingCookie.Etracker : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@as-us.falkag[2].txt -> TrackingCookie.Falkag : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@as1.falkag[1].txt -> TrackingCookie.Falkag : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@fastclick[1].txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.36:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.37:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.38:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@ehg-foxmovies.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@ehg-telecomitalia.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@ehg.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@ehg-foxmovies.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@ehg-adidas.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@ehg-cogemag.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@ehg-psychologies.hitbox[2].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@ehg-telecomitalia.hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@hitbox[1].txt -> TrackingCookie.Hitbox : Nettoyé.
:mozilla.45:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.46:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@search.live[1].txt -> TrackingCookie.Live : Nettoyé.
:mozilla.54:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.71:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
:mozilla.51:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.52:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.53:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.73:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@overture[2].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@perf.overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@overture[1].txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@www.paypal[1].txt -> TrackingCookie.Paypal : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@ads.pointroll[1].txt -> TrackingCookie.Pointroll : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@qksrv[1].txt -> TrackingCookie.Qksrv : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@questionmarket[2].txt -> TrackingCookie.Questionmarket : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@revsci[2].txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.62:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.63:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.64:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.65:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.66:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.95:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.11:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.12:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.13:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.17:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.81:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.82:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.83:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@statcounter[1].txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.29:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.30:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.33:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.34:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@tradedoubler[1].txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.21:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.23:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.28:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.92:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@weborama[2].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\DJODJO\Cookies\djodjo@m.webtrends[1].txt -> TrackingCookie.Webtrends : Nettoyé.
:mozilla.32:C:\Documents and Settings\Isabelle\Application Data\Mozilla\Firefox\Profiles\dewj9tm2.default\cookies.txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@statse.webtrendslive[1].txt -> TrackingCookie.Webtrendslive : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Nettoyé.
:mozilla.89:C:\Documents and Settings\DJODJO\Application Data\Mozilla\Firefox\Profiles\o6uugjzu.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Alexia.NOM-EB85C523610\Cookies\alexia@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\DJODJO.NOM-EB85C523610\Cookies\djodjo@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Isabelle\Cookies\isabelle@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\marion.NOM-EB85C523610.000\Cookies\marion@zedo[1].txt -> TrackingCookie.Zedo : Nettoyé.
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038036.sys -> Trojan.Agent.lf : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\WINDOWS\winvip.exe.vir -> Trojan.Conycspa.p : Nettoyé et sauvegardé (mise en quarantaine).
C:\QooBox\Quarantine\C\WINDOWS\system32\wnsapisv32.exe.vir -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP186\A0027880.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP187\A0027961.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP189\A0036876.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038043.exe -> Trojan.Small : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP191\A0038037.exe -> Worm.Zhelatin.fm : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

green day · Answer

Salut

ok,

Télécharge SDFix sur ton bureau 

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. 
Redémarre ton ordinateur en mode sans échec 
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script. 
Appuie sur Y pour commencer le processus de nettoyage. 
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
Appuie sur une touche pour redémarrer le PC. 
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis ! 

++

Je suis attaquer par Brave Sentry

13 réponses

Votre réponse

Discussions similaires

Newsletters