A l'aide !! j'ai des virus

Voila :

VundoFix V6.5.6

Checking Java version...

Java version is 1.5.0.3
Old versions of java are exploitable and should be removed.

Scan started at 17:49:21 29/07/2007

Listing files found while scanning....

C:\WINXP\system32\ssttu.dll
C:\WINXP\system32\uttss.bak2
C:\WINXP\system32\uttss.ini

Beginning removal...

Attempting to delete C:\WINXP\system32\ssttu.dll
C:\WINXP\system32\ssttu.dll Could not be deleted.

Attempting to delete C:\WINXP\system32\uttss.bak2
C:\WINXP\system32\uttss.bak2 Has been deleted!

Attempting to delete C:\WINXP\system32\uttss.ini
C:\WINXP\system32\uttss.ini Has been deleted!

Performing Repairs to the registry.
Done!


Rapport hijack :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:04:16, on 29/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\SYSTEM32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINXP\system32\pctspk.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINXP\SYSTEM32\Ati2evxx.exe
C:\WINXP\Explorer.EXE
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINXP\system32\rundll32.exe
C:\WINXP\system32\NOTEPAD.EXE
C:\Scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/ymsgr6/fr/*https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - C:\PROGRA~1\COPERN~1\CopernicAgentExt.dll (file missing)
N3 - Netscape 7: user_pref("browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl"); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\ycomp5_3_18_0.dll
O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {36755225-B11A-44E0-B8D6-8C0C0E9308FB} - C:\WINXP\system32\ssttu.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5A4A2D56-931A-4733-9121-033A2D95A274} - C:\WINXP\system32\tuvsrol.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINXP\system32\qctnnooi.dll
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\PROGRA~1\COPERN~1\CopernicAgentExt.dll (file missing)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program Files\MyWay\myBar\2.bin\MYBAR.DLL (file missing)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\ycomp5_3_18_0.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BitDefender8\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\bdswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avp] C:\WINXP\TEMP\win37A.tmp.exe
O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINXP\system32\drvguv.dll,startup
O4 - HKLM\..\Run: [WindowsHive] C:\WINXP\system32\rpcc.exe
O4 - HKLM\..\Run: [runner1] C:\WINXP\retadpu2000352.exe 61A847B5BBF72810329B385577FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [MemoryManager] rundll32.exe "C:\WINXP\system32\nrkifsln.dll",sitypnow
O4 - HKLM\..\RunOnce: [RemoveWGA] C:\Documents and Settings\Administrateur\Mes documents\RemoveWGA.exe -startup
O4 - HKLM\..\RunOnce: [VundoFix] "C:\\vundofix.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [Mozilla Quick Launch] "C:\PROGRA~1\NETSCAPE\NETSCAPE\NETSCP.EXE" -turbo
O4 - HKCU\..\Run: [dlmMgr] "C:\Program Files\Fichiers communs\Adobe\ESD\AdobeDownloadManager.exe" restart=1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINXP\system32\Macromed\Flash\GetFlash.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [dlmMgr] "C:\Program Files\Fichiers communs\Adobe\ESD\AdobeDownloadManager.exe" restart=1 (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-21-861567501-220523388-725345543-500 Startup: Registration Brothers In Arms.LNK = E:\Support\Register\RegistrationReminder.exe (User '?')
O4 - Startup: Registration Brothers In Arms.LNK = E:\Support\Register\RegistrationReminder.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.imgfarm.com/images/nocache/funwebproducts/ei-2/FunBuddyIconsFWBInitialSetup1.0.0.8-2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O20 - AppInit_DLLs: x
?sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: ssttu - C:\WINXP\system32\ssttu.dll
O20 - Winlogon Notify: tuvsrol - C:\WINXP\SYSTEM32\tuvsrol.dll
O20 - Winlogon Notify: winrzf32 - C:\WINXP\SYSTEM32\winrzf32.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINXP\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Voila les rapports --------------------

Pour win37A.temp.exe


Scan taken on 29 Jul 2007 16:39:40 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Last file scanned at least one scanner reported something about: BB3D_Intro.exe (MD5: 786bdffc329e29386e0dc94dab74e206, size: 297216 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir X
ArcaVir Heur.Win32
Avast X
AVG Antivirus X
BitDefender X
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control W32/Suspicious_U.gen
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus Mal/Packer
VirusBuster Packed/Upack
VBA32 X
-------------------------------------------------------------------------------------------------------------------


Pour ssttu.dll :
Scan taken on 29 Jul 2007 16:54:58 (GMT)
A-Squared Found nothing
AntiVir Found TR/Dldr.ConHook.Gen
ArcaVir Found nothing
Avast Found Win32:Vundo-gen49
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found Trojan.Virtumod
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Last file scanned at least one scanner reported something about: ss.exe (MD5: 3cfb3901b3865b5b4c4e69235692e436, size: 136378 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir HEUR/Malware
ArcaVir X
Avast X
AVG Antivirus PSW.Agent.JYO
BitDefender Trojan.Dropper.RHR
ClamAV X
CPsecure X
Dr.Web Trojan.MulDrop.7169
F-Prot Antivirus X
F-Secure Anti-Virus Backdoor.Win32.Bifrose.agn
Fortinet X
Kaspersky Anti-Virus Backdoor.Win32.Bifrose.agn
NOD32 X
Norman Virus Control X
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus X
VirusBuster X
VBA32 Embedded.Backdoor.Win32.Bifrose.d

----------------------------------------------------------------------------------------------------------------------

Pour tuvsrol.dll :

Scan taken on 29 Jul 2007 16:59:34 (GMT)
A-Squared Found nothing
AntiVir Found TR/Vundo.Gen
ArcaVir Found nothing
Avast Found Win32:Vundo-gen46
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found Trojan.Virtumod
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found not-a-virus:AdWare.Win32.Virtumonde.jp (4, 1, 400)
Fortinet Found nothing
Kaspersky Anti-Virus Found not-a-virus:AdWare.Win32.Virtumonde.jp
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Last file scanned at least one scanner reported something about: firehole.exe (MD5: fb76a4bd5fcf5a06739fbc4ca51d1778, size: 12800 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir X
ArcaVir Trojan.Notifier.Small.A.Er
Avast X
AVG Antivirus X
BitDefender Trojan.FireHole.1.0.1
ClamAV Trojan.Notifier.Small-1
CPsecure X
Dr.Web Trojan.Firehole.10
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet HackerTool/Demo.LeakTest
Kaspersky Anti-Virus X
NOD32 Win32/DemoLeakTest application
Norman Virus Control X
Panda Antivirus Application/Leaktest.B
Rising Antivirus X
Sophos Antivirus X
VirusBuster X
VBA32 TrojanDropper.Win32.DemoLeakTest

------------------------------------------------------------------------------------------------------------------------

Pour qctnnooi.dll :

Scan taken on 29 Jul 2007 17:02:30 (GMT)
A-Squared Found nothing
AntiVir Found TR/Dldr.ConHook.Gen
ArcaVir Found nothing
Avast Found Win32:Vundo-gen48
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found Trojan.Virtumod
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Last file scanned at least one scanner reported something about: patch-keygen.exe (MD5: 938377289d9901c7790f4d09af556fbb, size: 98885 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir X
ArcaVir X
Avast X
AVG Antivirus X
BitDefender X
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet PossibleThreat
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control X
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus Mal/Packer
VirusBuster Packed/FSG
VBA32 X

------------------------------------------------------------------------------------------------------------------------

Pour drvguv.dll :

le fichier n'est pas présent dans le dossier spécifié !!?

------------------------------------------------------------------------------------------------------------------------

Pour rpcc.exe :

Scan taken on 29 Jul 2007 17:18:49 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.ULPM.Gen
ArcaVir Found Trojan.Proxy.Dlena.Ad
Avast Found nothing
AVG Antivirus Found Proxy.QMK
BitDefender Found Trojan.PWS.LDPinch.TAW
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan-Proxy.Win32.Dlena.ad
Fortinet Found W32/Dlena.AD!tr
Kaspersky Anti-Virus Found Trojan-Proxy.Win32.Dlena.ad
NOD32 Found Win32/TrojanProxy.Dlena.NAP
Norman Virus Control Found W32/Dlena.GZ
Panda Antivirus Found Trj/WinOpts.Q
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found Trojan.DR.Cimuz.Gen.1
VBA32 Found Trojan-Proxy.Win32.Dlena.ad

Last file scanned at least one scanner reported something about: crypt.exe (MD5: f185ed5af3eb9566c71b5503c39c224e, size: 38147 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir HEUR/Crypted
ArcaVir X
Avast X
AVG Antivirus X
BitDefender X
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control X
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus Mal/Basine-C
VirusBuster X
VBA32 X

------------------------------------------------------------------------------------------------------------------------

Pour retadpu2000352.exe :

il est pas dans le dossier spécifié !!!

------------------------------------------------------------------------------------------------------------------------

Pour winrzf32.dll :

Scan taken on 29 Jul 2007 17:24:59 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.PEC2X.Gen
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found Dialer.IOV
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found Trojan.Win32.Dialer.qn
Fortinet Found nothing
Kaspersky Anti-Virus Found Trojan.Win32.Dialer.qn
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found Troj/Nebule-Gen
VirusBuster Found nothing
VBA32 Found nothing

Last file scanned at least one scanner reported something about: fc_Bak.vmp.exe (MD5: 8ad8206e14317ace5853953910708f1b, size: 565760 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir BDS/Hupigon.Gen
ArcaVir X
Avast X
AVG Antivirus X
BitDefender X
ClamAV Trojan.Crypted-2
CPsecure X
Dr.Web BackDoor.Beizhu
F-Prot Antivirus Possibly a new variant of W32/NewMalware-BLP-based!Maximus
F-Secure Anti-Virus X
Fortinet X
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control Hupigon.gen130
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus Mal/GrayBird
VirusBuster X
VBA32 MalwareScope.Backdoor.Hupigon.4

------------------------------------------------------------------------------------------------------------------------

Voila c'est tout. Tu penses qu'il y en a d'autres des comme ça ? que faire maintenant ?
Merci de ton aide !! Big up à toi

Rudy dis moi que t'es la !! snif... j'ai peur

Voila le rapport ! Merci encore de m'aider ;-)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:31:57, on 05/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINXP\system32\pctspk.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\Explorer.EXE
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/ymsgr6/fr/*https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl"); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINXP\system32\tnboslow.dll
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BitDefender8\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\bdswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\RunOnce: [VundoFix] "C:\\vundofix.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2266] command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9579] cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [combofix] C:\WINXP\system32\cmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\RunOnce: [navilog1] C:\Program Files\Navilog1\navilog1.bat
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINXP\system32\Macromed\Flash\GetFlash.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB8325] command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6463] cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF8CD391-D887-43D6-869C-589622ABB6BA}: NameServer = 84.103.237.142 86.64.145.142
O20 - AppInit_DLLs: x
?sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: winrzf32 - winrzf32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINXP\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Télécharge « clean.zip »
http://www.malekal.com/download/clean.zip
•- Décompresse-le sur ton bureau (clic droit / extraire tout), tu dois obtenir un dossier dénommé "clean ".

•- Redémarre en mode sans échec. ( note bien ce que tu as à faire ).
•- Ouvre le dossier « clean » qui se trouve sur ton bureau.
•- Double-clic sur « clean.cmd ».
Une fenêtre noire va apparaître, choisis l’option 2.

Clean va travailler.
•- Redémarre normalement
•- Poste qui se trouve ici C:\rapport_clean.txt.


(- Où est le rapport clean ? : « Poste de travail » / double clic sur disque « C / » double-clic sur « rapport_clean.txt » et « copier/coller le contenu » sur le forum. )

Le rapport cleannavi :


Clean Navipromo version 2.0.5 commencé le 30/07/2007 à 19:32:53,89

Fix lancé depuis C:\Program Files\navilog1
Mise a jour le 01.07.2007 a 12h00 by IL-MAFIOSO

*** Recherche, Creation backups et suppression ***



*** Suppression dossiers dans C:\WINXP ***


*** Suppression dossiers dans C:\Program Files ***


*** Suppression dossiers dans C:\Documents and Settings\All Users.WINXP\Application Data ***


*** Suppression dossiers dans C:\Documents and Settings\Administrateur\Application Data ***



*** Suppression fichiers ***


*** Suppression fichiers temporaires ***

Nettoyage contenu C:\WINXP\Temp effectué !
Nettoyage contenu C:\Documents and Settings\Administrateur\Local Settings\Temp effectué !


*** Sauvegarde du registre vers dossier Backupnavi***


sauvegarde du registre réalise avec succes !


*** Nettoyage registre ***


Nettoyage registre Ok

*** Traitement Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche fichiers connus:

C:\WINXP\system32\uttss.bak1 trouvé ! infection Vundo possible non traité par cet outil !

2)Recherche et Suppression Heuristique :

*
**
***
****
*****
******
*******
********

3)Contrôle présence clés Rootkit dans le registre :

Aucune autre clés présente dans le registre !

4)Certificats :


*** Nettoyage termine le 05/08/2007 à 14:53:13,29 ***




Merci pour tout !

salut. j'ai posté un rapport hijack. si tu peux jeter un coup d'oeil et me dire ce que t'en penses ça serait cool. Merci !

Alors le rapport SDfix :


SDFix: Version 1.96

Run by Administrateur on 06/08/2007 at 19:01

Microsoft Windows XP [version 5.1.2600]

Running From: C:\DOCUME~1\ADMINI~1\Bureau\SDFix

Safe Mode:
Checking Services:

Name:
ntio256

ImagePath:
\??\C:\WINXP\system32\ntio256.sys

ntio256 - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service


------------------------------------------------------------------------------------------------------------------------

Rapport Smitfraud :

SmitFraudFix v2.208

Rapport fait à 19:12:21,65, 06/08/2007
Executé à partir de C:\Documents and Settings\Administrateur\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINXP


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINXP\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINXP\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINXP\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Administrateur\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMINI~1\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=hex(1):78,00,01,00,3f,00,73,00,6f,00,63,00,6b,00,73,00,70,00,79,\


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

------------------------------------------------------------------------------------------------------------------------

Rapport Hijack :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:22:50, on 06/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\Explorer.EXE
C:\WINXP\system32\pctspk.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINXP\notepad.exe
C:\Scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://fr.rd.yahoo.com/customize/ie/defaults/sb/ymsgr6/fr/*http://www.yahoo.com/ext/search/search.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/ymsgr6/fr/*https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl"); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINXP\system32\tnboslow.dll
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BitDefender8\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\bdswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMINI~1\Bureau\SDFix\RunThis.bat /second
O4 - HKLM\..\RunOnce: [VundoFix] "C:\\vundofix.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2266] command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9579] cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [combofix] C:\WINXP\system32\cmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\RunOnce: [navilog1] C:\Program Files\Navilog1\navilog1.bat
O4 - HKLM\..\RunOnce: [SDFix] C:\DOCUME~1\ADMINI~1\Bureau\SDFix\RunThis.bat /second
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINXP\system32\Macromed\Flash\GetFlash.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB8325] command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6463] cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF8CD391-D887-43D6-869C-589622ABB6BA}: NameServer = 84.103.237.142 86.64.145.142
O20 - AppInit_DLLs: x
?sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: winrzf32 - winrzf32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINXP\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Démarre en mode sans échec :
Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter.
Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
(Si F8 ne marche pas utilise la touche F5).
----------------------------------------------------------------------------
Relance le programme Smitfraud,
Cette fois choisit l’option 2, répond oui a tous ;
Sauvegarde le rapport, Redémarre en mode normal, copie/colle le rapport sauvegardé sur le forum

Voila :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:16:00, on 08/08/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINXP\System32\smss.exe
C:\WINXP\system32\winlogon.exe
C:\WINXP\system32\services.exe
C:\WINXP\system32\lsass.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\system32\svchost.exe
C:\WINXP\System32\svchost.exe
C:\WINXP\system32\spoolsv.exe
C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
C:\WINXP\system32\pctspk.exe
C:\WINXP\System32\svchost.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINXP\system32\Ati2evxx.exe
C:\WINXP\Explorer.EXE
C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Scan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Startpagina = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
N3 - Netscape 7: user_pref("browser.startup.homepage", "https://www.google.fr/?gws_rd=ssl"); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", ""); (C:\Documents and Settings\ADMINISTRATEUR\Application Data\Mozilla\Profiles\default\wlzuudup.slt\prefs.js)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\fr\msntb.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINXP\system32\tnboslow.dll
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BitDefender8\bdmcon.exe
O4 - HKLM\..\Run: [BDNewsAgent] "C:\Program Files\Softwin\BitDefender8\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] C:\Program Files\Softwin\BitDefender8\bdswitch.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKLM\..\Run: [SDFix] C:\DOCUME~1\ADMINI~1\Bureau\SDFix\RunThis.bat /second
O4 - HKLM\..\RunOnce: [VundoFix] "C:\\vundofix.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2266] command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9579] cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [combofix] C:\WINXP\system32\cmd.exe /c C:\ComboFix\Combobatch.bat
O4 - HKLM\..\RunOnce: [navilog1] C:\Program Files\Navilog1\navilog1.bat
O4 - HKLM\..\RunOnce: [SDFix] C:\DOCUME~1\ADMINI~1\Bureau\SDFix\RunThis.bat /second
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN
O4 - HKCU\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe"
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINXP\system32\Macromed\Flash\GetFlash.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB8325] command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD6463] cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\Run: [PCTAVApp] "C:\Program Files\PC Tools AntiVirus\PCTAV.exe" /MONITORSCAN (User '?')
O4 - HKUS\S-1-5-21-861567501-220523388-725345543-500\..\RunOnce: [DAEMON Tools 4.03 Setup] "C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User '?')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINXP\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: DSLMON.lnk = C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Chercher avec Copernic Agent - res://C:\Program Files\Copernic Agent\CopernicAgentExt.rdl/INTEGRATION_MENU_SEARCHEXT
O8 - Extra context menu item: Download Link Using Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Ajouter à la Liste à Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra 'Tools' menuitem: Démarrer Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINXP\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINXP\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{BF8CD391-D887-43D6-869C-589622ABB6BA}: NameServer = 86.64.145.142 84.103.237.142
O20 - AppInit_DLLs: x
?sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll
O20 - Winlogon Notify: winrzf32 - winrzf32.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINXP\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINXP\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe (file missing)
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINXP\System32\DRIVERS\CDANTSRV.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PC Tools AntiVirus Engine (PCTAVSvc) - PC Tools Research Pty Ltd - C:\Program Files\PC Tools AntiVirus\PCTAVSvc.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINXP\system32\pctspk.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Fichiers communs\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender8\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

Voila chef :




"Administrateur" - 2007-08-08 19:09:09 - ComboFix 07-07-23.6 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_ASC3550U
-------\LEGACY_NTIO256
-------\asc3550u


((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 )))))))))))))))))))))))))))))))


2007-08-08 00:27 <REP> d-------- C:\WINXP\BDOSCAN8
2007-08-06 19:14 1,088 --a------ C:\WINXP\system32\tmp.reg
2007-08-06 19:12 51,200 --a------ C:\WINXP\system32\dumphive.exe
2007-08-06 19:12 288,417 --a------ C:\WINXP\system32\SrchSTS.exe
2007-08-06 19:00 <REP> d-------- C:\WINXP\ERUNT
2007-08-05 18:55 53,248 --a------ C:\WINXP\system32\Process.exe
2007-07-30 00:41 <REP> d-------- C:\Program Files\Navilog1
2007-07-30 00:06 51,200 --a------ C:\WINXP\nircmd.exe
2007-07-29 23:22 69,184 --a------ C:\WINXP\system32\tnboslow.dll
2007-07-29 23:21 126,016 --a------ C:\WINXP\system32\xhveoqcj.dll
2007-07-29 22:54 <REP> d----c--- C:\backups
2007-07-29 17:59 126,016 --a------ C:\WINXP\system32\ehraucqy.dll
2007-07-29 17:49 109,056 --a--c--- C:\VundoFix.exe
2007-07-29 17:49 <REP> d----c--- C:\VundoFix Backups
2007-07-29 17:02 401,720 --a--c--- C:\Scan.exe
2007-07-29 15:45 126,016 --a------ C:\WINXP\system32\nrkifsln.dll
2007-07-29 02:21 <REP> d-------- C:\WINXP\system32\?ystem32
2007-07-29 02:21 <REP> d-------- C:\WINXP\system32\?asks
2007-07-29 00:07 <REP> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\PC Tools
2007-07-29 00:06 22,528 --a------ C:\WINXP\system32\drivers\AVHook.sys
2007-07-29 00:06 15,872 --a------ C:\WINXP\system32\drivers\AVRec.sys
2007-07-29 00:06 15,872 --a------ C:\WINXP\system32\drivers\AVFilter.sys
2007-07-29 00:06 <REP> d-------- C:\Program Files\PC Tools AntiVirus
2007-07-29 00:06 <REP> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\PC Tools
2007-07-28 15:53 228,960 --a------ C:\WINXP\system32\ssttu.dll.vir
2007-07-28 15:43 <REP> d---s---- C:\WINXP\system32\?icrosoft
2007-07-28 15:43 <REP> d-------- C:\WINXP\A?pPatch
2007-07-28 15:43 <REP> d-------- C:\WINXP\?ecurity
2007-07-28 15:43 <REP> d-------- C:\WINXP\??stem
2007-07-28 15:43 <REP> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\?ecurity
2007-07-28 15:43 <REP> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\??stem
2007-07-28 15:30 <REP> d-------- C:\Program Files\coolpro2


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-29 15:08:51 -------- d-----w C:\Program Files\Tweak-XP Pro 4
2007-07-29 00:21:46 -------- d-----w C:\Program Files\Common Files
2007-07-28 13:43:29 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\??stem
2007-07-28 13:43:28 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\?ecurity
2007-07-25 22:07:36 -------- d-----w C:\Program Files\Wolfenstein - Enemy Territory
2007-07-20 18:32:33 -------- d-----w C:\Program Files\eMule2
2007-07-12 01:22:03 468,490 -c--a-w C:\WINXP\system32\perfh00C.dat
2007-07-12 01:22:02 75,506 -c--a-w C:\WINXP\system32\perfc00C.dat
2007-07-11 13:58:39 -------- d-----w C:\Program Files\DivX
2007-07-02 19:41:04 200,704 -c--a-w C:\WINXP\system32\ssldivx.dll
2007-07-02 19:41:04 1,044,480 -c--a-w C:\WINXP\system32\libdivx.dll
2007-06-23 23:29:25 -------- d-----w C:\Program Files\Propellerhead
2007-06-23 22:22:59 -------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-06-19 20:25:06 -------- d-----w C:\DOCUME~1\ADMINI~1\APPLIC~1\Samsung
2007-06-19 20:00:07 -------- d-----w C:\Program Files\Samsung
2007-06-04 20:56:09 604 ---ha-w C:\Program Files\STLL Notifier
2007-05-27 18:49:18 9 -c-ha-w C:\WINXP\system32\wxmmin.dll
2007-05-16 15:13:53 683,520 -c--a-w C:\WINXP\system32\inetcomm.dll
2007-05-01 15:35:12 146,432 ----a-w C:\Program Files\Fichiers communs\Yazzle1162OinAdmin.exe~
2006-05-06 23:07:30 353,273 -c--a-w C:\Program Files\ColourOptionsSetup_4.1_Setup.nolink Sims 2.exe
2005-05-18 18:48:25 262,144 -c--a-w C:\Program Files\Uninstall My Web Search.dll
2004-03-01 14:11:34 18,810,320 -c--a-w C:\Program Files\AdbeRdr60_fra_full.exe
2004-02-23 11:12:48 7,503,221 -c--a-w C:\Program Files\Instant Photo Scanner.exe
2004-02-23 02:05:45 28,672 -c--a-w C:\Program Files\Scanwise driver.exe
1997-06-24 23:51:46 2,318,848 -c--a-w C:\Program Files\AcroRd32.exe
2004-10-28 12:43:52 56 -csh--r C:\WINXP\system32\9C0477CB55.sys
2004-10-28 12:43:52 1,682 -csha-w C:\WINXP\system32\KGyGaAvL.sys


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}]
2007-07-29 23:22 69184 --a------ C:\WINXP\system32\tnboslow.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BDMCon"="C:\PROGRA~1\Softwin\BitDefender8\bdmcon.exe" [2005-12-15 10:32]
"BDNewsAgent"="C:\Program Files\Softwin\BitDefender8\bdnagent.exe" [2005-12-15 10:32]
"BDSwitchAgent"="C:\Program Files\Softwin\BitDefender8\bdswitch.exe" [2005-12-15 10:32]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-09-09 14:24]
"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [2007-05-17 11:41]
"SDFix"="C:\DOCUME~1\ADMINI~1\Bureau\SDFix\RunThis.bat /second" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:55]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-08-18 20:49]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-06-27 17:21]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\ypager.exe" []
"PCTAVApp"="C:\Program Files\PC Tools AntiVirus\PCTAV.exe" [2007-05-17 11:41]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"DAEMON Tools 4.03 Setup"="C:\Documents and Settings\Administrateur\Mes documents\Utilitaires\daemon403-x86.exe"
"FlashPlayerUpdate"=C:\WINXP\system32\Macromed\Flash\GetFlash.exe
"SpybotDeletingB8325"=command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
"SpybotDeletingD6463"=cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"VundoFix"="C:\\vundofix.exe"
"SpybotDeletingA2266"=command /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
"SpybotDeletingC9579"=cmd /c del "C:\WINXP\system32\winrzf32.dll_tobedeleted_old"
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
"combofix"=C:\WINXP\system32\cmd.exe /c C:\ComboFix\Combobatch.bat
"navilog1"=C:\Program Files\Navilog1\navilog1.bat
"SDFix"=C:\DOCUME~1\ADMINI~1\Bureau\SDFix\RunThis.bat /second

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"ALUAlert"=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

C:\Documents and Settings\All Users.WINXP\Menu D‚marrer\Programmes\D‚marrage\
BTTray.lnk - C:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe [2002-10-25 15:18:40]
DSLMON.lnk - C:\Program Files\modem ADSL USB\modem ADSL USB\DSLMON.exe [2003-12-04 21:01:24]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-24 08:05:26]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"DisableLocalMachineRun"=1 (0x1)
"DisableLocalMachineRunOnce"=1 (0x1)
"DisableCurrentUserRunOnce"=1 (0x1)
"DisableCurrentUserRun"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winrzf32]
winrzf32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=x
?sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrateur^Menu Démarrer^Programmes^Démarrage^H3 The Shadow of Death(TM).lnk]
path=C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\H3 The Shadow of Death(TM).lnk
backup=C:\WINXP\pss\H3 The Shadow of Death(TM).lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Administrateur^Menu Démarrer^Programmes^Démarrage^MyWebSearch Email Plugin.lnk]
path=C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\MyWebSearch Email Plugin.lnk
backup=C:\WINXP\pss\MyWebSearch Email Plugin.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINXP^Menu Démarrer^Programmes^Démarrage^BTTray.lnk]
path=C:\Documents and Settings\All Users.WINXP\Menu Démarrer\Programmes\Démarrage\BTTray.lnk
backup=C:\WINXP\pss\BTTray.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINXP^Menu Démarrer^Programmes^Démarrage^GStartup.lnk]
path=C:\Documents and Settings\All Users.WINXP\Menu Démarrer\Programmes\Démarrage\GStartup.lnk
backup=C:\WINXP\pss\GStartup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINXP^Menu Démarrer^Programmes^Démarrage^Lancement rapide d'Adobe Reader.lnk]
path=C:\Documents and Settings\All Users.WINXP\Menu Démarrer\Programmes\Démarrage\Lancement rapide d'Adobe Reader.lnk
backup=C:\WINXP\pss\Lancement rapide d'Adobe Reader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINXP^Menu Démarrer^Programmes^Démarrage^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WINXP\Menu Démarrer\Programmes\Démarrage\Microsoft Office.lnk
backup=C:\WINXP\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINXP^Menu Démarrer^Programmes^Démarrage^MyWebSearch Email Plugin.lnk]
path=C:\Documents and Settings\All Users.WINXP\Menu Démarrer\Programmes\Démarrage\MyWebSearch Email Plugin.lnk
backup=C:\WINXP\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\adiras]
adiras.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
"C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINXP\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DrWebScheduler]
C:\Program Files\DrWeb\DRWEBSCD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MyWebSearch Email Plugin]
C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\New.net Startup]
rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~2.DLL,NewDotNetStartup -s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINXP\System32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\P2P Networking]
C:\WINXP\System32\P2P Networking\P2P Networking.exe /AUTOSTART

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PicoZip]
C:\DOCUME~1\ADMINI~1\MESDOC~1\UTILIT~1\PicoZip\PicoZipTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpIDerMail]
"C:\Program Files\DrWeb\spiderml.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpIDerNT]
C:\PROGRA~1\DrWeb\spidernt.exe /agent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TransTask]
"C:\Program Files\Tweak-XP Pro 4\transtask.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updmgr]
C:\Program Files\Common files\updmgr\updmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c6223b5-cf0c-11db-8b4f-4d6564696130}]
Auto\command- E:\AdobeR.exe e
AutoRun\command- C:\WINXP\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2cc7b410-4367-11dc-8bf0-4d6564696130}]
AutoRun\command- C:\WINXP\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6a52e7bf-2f88-11db-8a81-4d6564696130}]
Auto\command- AdobeR.exe e
AutoRun\command- C:\WINXP\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab17a70b-1293-11dc-8b9d-4d6564696130}]
Auto\command- AdobeR.exe e
AutoRun\command- C:\WINXP\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b69157e8-8718-11db-8afa-806dda9da512}]
Auto\command- F:\AdobeR.exe e
AutoRun\command- C:\WINXP\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f3984c1a-ed01-11db-8b70-4d6564696130}]
Auto\command- AdobeR.exe e
AutoRun\command- C:\WINXP\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e


Contents of the 'Scheduled Tasks' folder
2007-08-08 17:15:18 C:\WINXP\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-08 19:15:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-08 19:20:14 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-08 19:19
C:\ComboFix2.txt ... 2007-07-30 00:19

--- E O F ---

merci ;-)

remet un log hijackthis

Ok chef. Mais j'ai encore des trucs chelou qui se passent ...
Y a des fenetres de spam qui s'ouvrent TRES souvent, et la plupart du temps ça fait planter internet explorer...
Bon je supprime tout et je reviens ;-)

oui, je veux reprendre sur de bonnes bases efface tous les logiciels que je t'ai fait telecharger , vide ta corbeille

*Télécharge et installe CCleaner (n'installe pas la barre d'outil Yahoo)
---> http://www.infos-du-net.com/telecharger/CCleaner,0301-1039.html

- Dans la colonne de gauche clic sur "erreurs" coches toutes les cases, puis clic en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs" et tu auras un message pour sauvegarder ta base de registre tu clic "oui" puis tu recommences jusqu'a ce qu'il te trouve plus d'erreurs.
Les sauvegardes que tu aura faites, tu pourras les supprimer si ton ordinateur n'a plus de problémes.

- Relance Ccleaner, vas dans l'onglet "nettoyeur" présent sur la gauche, decoches la derniere case (Avancé si elle est cochée) puis clic sur "lancer le nettoyage"

Si tu as besoin d'aide avec Ccleaner, regarde ce tutoriel :
https://www.malekal.com/tutoriel-ccleaner/

Et suis les instructions donnée dans ce lien :
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

ouais mais ma licence a expiré il y a peu

soit tu reprend une licence soit tu le desinstalle car il faut un seul antivirus

Salut,

il a rien trouvé avg. j'ai fais les deux sortes de test. Rien.

;-)