Pages Pub et autre dans ie7 Résolu/Fermé

Question

Bonjour,
Depuis quelques jours des pages de pub s'ouvrent dans ie7 malgrés le blocage prévu.
Je colle un log hijackthis en espérant votre aide.
Merci.
Logfile of HijackThis v1.99.1
Scan saved at 17:09:40, on 12/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\kvfysaoy.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {F2839E21-3952-4CAB-B25D-5070CF4FC994} - C:\WINDOWS\system32\gebya.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

philae83 · Answer

bonsoir,

* Télécharge VundoFix.exe (par Atribune) sur ton Bureau

http://www.atribune.org/ccount/click.php?id=4

 * Double-clique VundoFix.exe afin de le lancer

* Clique sur le bouton Scan for Vundo

* Lorsque le scan est complété, clique sur le bouton Remove Vundo

* Une invite te demandera si tu veux supprimer les fichiers, clique YES

* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers

* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK

* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse

 
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

croux04 · Answer

Merci pour ta rapidité:

VundoFix V6.5.8

Checking Java version...

Scan started at 22:51:25 04/09/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.5.8

Checking Java version...

Scan started at 13:18:43 06/09/2007

Listing files found while scanning....


VundoFix V6.5.9

Checking Java version...

Scan started at 17:56:49 12/10/2007

Listing files found while scanning....

C:\windows\system32\aybeg.bak1
C:\windows\system32\aybeg.bak2
C:\windows\system32\aybeg.ini
C:\windows\system32\gebya.dll
C:\WINDOWS\system32\kvfysaoy.dll

Beginning removal...

 Attempting to delete C:\windows\system32\aybeg.bak1
C:\windows\system32\aybeg.bak1 Has been deleted!

 Attempting to delete C:\windows\system32\aybeg.bak2
C:\windows\system32\aybeg.bak2 Has been deleted!

 Attempting to delete C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini Has been deleted!

 Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\kvfysaoy.dll
C:\WINDOWS\system32\kvfysaoy.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini Has been deleted!

 Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\kvfysaoy.dll
C:\WINDOWS\system32\kvfysaoy.dll Has been deleted!

Performing Repairs to the registry.
Done!

Logfile of HijackThis v1.99.1
Scan saved at 18:07:50, on 12/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8510EE9B-179A-4699-B23F-BC982154A2C4} - C:\WINDOWS\system32\gebya.dll
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\pgqtxssc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - HP - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

philae83 · Answer

re

* Télécharge combofix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

* Double clique combofix.exe.

* Tape sur la touche Y (Yes) pour démarrer le scan.

* Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

ainsi qu'un nouveau rapport hijackthis

croux04 · Answer

Et Hop: ComboFix 07-10-12.4 - NOUS 2007-10-12 18:18:10.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.209 [GMT 2:00] Running from: C:\Documents and Settings\NOUS\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\check_LSA7.txt C:\Documents and Settings\NOUS\Application Data\setup_fr[1].exe C:\WINDOWS\cookies.ini C:\WINDOWS\system32\aybeg.ini C:\WINDOWS\system32\bkaidrat.ini C:\WINDOWS\system32\djjektro.ini C:\WINDOWS\system32\gebya.dll C:\WINDOWS\system32\ortkejjd.dll C:\WINDOWS\system32\pgqtxssc.dll C:\WINDOWS\system32 ardiakb.dll . ((((((((((((((((((((((((((((( Fichiers créés 2007-09-12 to 2007-10-12 )))))))))))))))))))))))))))))))))))) . 2007-10-12 18:16 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-12 17:56 d-------- C:\VundoFix Backups 2007-10-11 13:10 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2007-10-11 12:18 d-------- C:\Documents and Settings\NOUS\Application Data\sysdepannage 2007-10-11 12:13 dr------- C:\Documents and Settings\All Users.WINDOWS\Application Data\sysdepannage 2007-10-10 10:37 584,192 --------- C:\WINDOWS\system32\dllcache pcrt4.dll 2007-10-09 21:31 d-------- C:\Program Files\Hijackthis Version Fran‡aise 2007-10-09 08:56 36,352 --a------ C:\WINDOWS\system32\urqnool.dll 2007-10-08 19:22 d-------- C:\Documents and Settings\NOUS\Application Data\Ahead 2007-10-08 19:17 d-------- C:\Program Files\Nero 2007-10-08 19:17 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero 2007-10-08 18:16 d-------- C:\Documents and Settings\NOUS\Application Data\Lavasoft 2007-10-08 18:16 d-------- C:\Documents and Settings\NOUS\Application Data\Jasc Software Inc 2007-09-28 20:01 d-------- C:\WINDOWS\system32\LogFiles 2007-09-25 19:12 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Messenger Plus! 2007-09-20 19:14 d-------- C:\Documents and Settings\NOUS\Contacts 2007-09-20 19:13 d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-20 17:24 d-------- C:\Documents and Settings\NOUS\Application Data\MSN6 2007-09-20 17:24 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6 2007-09-17 19:29 d-------- C:\WINDOWS\SxsCaPendDel 2007-09-16 16:52 d--hs---- C:\FOUND.031 2007-09-16 10:18 d-------- C:\WINDOWS\Sun 2007-09-16 10:04 d-------- C:\WINDOWS\system32\fr-fr 2007-09-16 10:04 d--h----- C:\WINDOWS\msdownld.tmp 2007-09-16 09:59 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2007-09-15 10:31 d--hs---- C:\FOUND.030 2007-09-12 16:17 77,312 --a------ C:\WINDOWS\system32\TWAIN_32.DLL 2007-09-12 16:16 d-------- C:\Program Files\ArcSoft 2007-09-12 16:13 96,768 --a------ C:\WINDOWS\SlantAdj.dll 2007-09-12 16:13 73,216 --a------ C:\WINDOWS\ADE.DLL 2007-09-12 16:13 3,136 --a------ C:\WINDOWS\Ade001.bin 2007-09-12 16:12 33,280 --a------ C:\WINDOWS\system32\esccm.dll 2007-09-12 16:12 32,256 --a------ C:\WINDOWS\system32\escwiab.dll 2007-09-12 16:12 27,648 --a------ C:\WINDOWS\system32\escimg.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-09 19:31 --------- d-----w C:\Program Files\Hijackthis Version Française 2007-09-08 16:42 --------- d-----w C:\Documents and Settings\NOUS\Application Data\Hewlett-Packard 2007-09-07 19:14 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-09-07 19:14 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-09-07 19:14 15,424 ----a-w C:\WINDOWS\system32\drivers od32drv.sys 2007-09-07 18:09 --------- d-----w C:\Program Files\Sunbelt Software 2007-09-06 17:29 --------- d-----w C:\Documents and Settings\NOUS\Application Data\vlc 2007-09-06 13:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater 2007-09-04 19:13 --------- d-----w C:\Program Files\Fichiers communs\xing shared 2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:17 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-08-20 09:59 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-20 09:59 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-20 09:59 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-08-20 09:59 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-08-20 09:59 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-08-20 09:59 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-20 09:59 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-08-20 09:59 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-08-20 09:59 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-08-20 09:59 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-08-20 09:59 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-20 09:59 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-20 09:59 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-08-20 09:59 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-08-20 09:59 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-08-20 09:59 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-20 09:59 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-20 09:59 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-08-20 09:59 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-20 09:59 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-08-20 09:59 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-08-20 09:59 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-08-20 09:59 1,152,000 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-17 10:22 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-08-17 10:22 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-08-17 10:22 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-08-17 07:34 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-25 20:18 52,552 ----a-w C:\Documents and Settings\moi\Application Data\GDIPFONTCACHEV1.DAT 2007-07-12 23:30 765,952 ----a-w C:\WINDOWS\system32\dllcache\vgx.dll 2003-06-10 10:04 435 ----a-w C:\Documents and Settings\ls300_mydsc_0610\layout.bin 2000-05-15 08:08 134,656 ----a-w C:\Documents and Settings\ls300_mydsc_0610\Setup.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E78714D-2D26-4965-AECE-501024825423}] 2007-10-09 08:57 36352 --a------ C:\WINDOWS\system32\urqnool.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57] "nod32kui"="C:\Program Files\Eset od32kui.exe" [2007-09-07 21:14] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-04 19:20] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{4E78714D-2D26-4965-AECE-501024825423}"= C:\WINDOWS\system32\urqnool.dll [2007-10-09 08:57 36352] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-12 18:25:16 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-12 18:27:21 - machine was rebooted . --- E O F ---

philae83 · Answer

re bonsoir,

* Télécharge VirtumundoBeGone  sur ton bureau .
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe
* double-clic sur VirtumundoBeGone.exe

* Suis les instructions à l'écran

* Quand le scan est terminé, enregistre le rapport.

* Copie/Colle le ici

et reposte un nouveau rapport hijackthis

croux04 · Answer

Salut à tous , on continue..

--[10/13/2007, 15:03:29] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\NOUS\Bureau\VirtumundoBeGone.exe" )
[10/13/2007, 15:03:36] - Detected System Information:
[10/13/2007, 15:03:36] -  Windows Version: 5.1.2600, Service Pack 2
[10/13/2007, 15:03:36] -  Current Username: NOUS (Admin)
[10/13/2007, 15:03:36] -  Windows is in NORMAL mode.
[10/13/2007, 15:03:36] - Searching for Browser Helper Objects:
[10/13/2007, 15:03:36] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[10/13/2007, 15:03:36] -  BHO 2: {4E78714D-2D26-4965-AECE-501024825423} ()
[10/13/2007, 15:03:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/13/2007, 15:03:36] -  Checking for HKLM\...\Winlogon\Notify\urqnool
[10/13/2007, 15:03:36] -  Key not found: HKLM\...\Winlogon\Notify\urqnool, continuing.
[10/13/2007, 15:03:36] -  BHO 3: {50B81FC8-9B4C-452A-996A-8DE0E86EE910} ()
[10/13/2007, 15:03:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/13/2007, 15:03:36] -  Checking for HKLM\...\Winlogon\Notify\awvtr
[10/13/2007, 15:03:36] -  Key not found: HKLM\...\Winlogon\Notify\awvtr, continuing.
[10/13/2007, 15:03:36] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[10/13/2007, 15:03:36] -  BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[10/13/2007, 15:03:36] - WARNING: BHO has no default name. Checking for Winlogon reference.
[10/13/2007, 15:03:36] -  No filename found. Continuing.
[10/13/2007, 15:03:36] -  BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[10/13/2007, 15:03:36] -  BHO 7: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[10/13/2007, 15:03:36] - Finished Searching Browser Helper Objects
[10/13/2007, 15:03:36] - Finishing up...
[10/13/2007, 15:03:36] - Nothing found! Exiting...

Logfile of HijackThis v1.99.1
Scan saved at 15:05:16, on 13/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SynCor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: (no name) - {50B81FC8-9B4C-452A-996A-8DE0E86EE910} - C:\WINDOWS\system32\awvtr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

et voilà...ça va déja beaucoup mieu....
celeron 2.6ghz    2 dd      1graveur+1lecteur cd
mem ddr 2700  512 m   xp pro sp2

philae83 · Answer

bonjour,

ca va peut être beaucoup mieux, mais tjs infecté

on continue

* Relance Vundofix
 * Ne clique pas sur "Scan for a vundo"
 * Clique droit au milieu de la fenêtre
 * Clique sur Add more files ?
 * Copie/colle les fichiers ci-dessous ( un par case) :

C:\WINDOWS\system32\urqnool.dll 
C:\WINDOWS\system32\awvtr.dll 

* Clique sur Add files
 * Ensuite clique sur Close Windows
 * Enfin, clique sur Remove Vundo ( les fichiers précédents doivent apparaitre dans la fenêtre principale)
 * Si l'outils demande un redémarrage, accepte
 * Poste le rapport Vundofix

puis

* télécharge ERUNT pour protéger toutes mauvaises manip dan sla base de registre
https://www.zebulon.fr/telechargements/utilitaires/systeme-utilitaires/erunt.html

tuto 
http://pageperso.aol.fr/loraline60/tuto_erunt.htm

puis

démarrer--------------exécuter---------------tu tapes regedit----ok

ensuite tu navigues jusqu'à ces clés et tu supprimes ce qui est en gras :


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{4E78714D-2D26-4965-AECE-501024825423}"= C:\WINDOWS\system32\urqnool.dll 

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E78714D-2D26-4965-AECE-501024825423}
 C:\WINDOWS\system32\urqnool.dll 


relance hijackthis puis coche ces lignes (si elles y sont encore) 

O2 - BHO: (no name) - {4E78714D-2D26-4965-AECE-501024825423} - C:\WINDOWS\system32\urqnool.dll
O2 - BHO: (no name) - {50B81FC8-9B4C-452A-996A-8DE0E86EE910} - C:\WINDOWS\system32\awvtr.dll 

et HORS CONNEXION, toutes applications fermées clique sur "fix checked"

reposte les rapports vundo et un nouveau rapport hijackthis

ps : je serais absente en début de soirée; Je pense pouvoir passer tard

croux04 · Answer

Bonjour, sacrée soirée.......et toujours infecté.
impossible de supprimer la valeur de c:\WINDOWS\system32\awvtr.dll ,ni avec Vundofix ni avec  Hijackthis, si je supprime dans la base de registre une nouvelle valeur est recréée à chaque boot.
Merci de bien vouloir encoree m'aider.

VundoFix V6.5.8

Checking Java version...

Scan started at 22:51:25 04/09/2007

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.5.8

Checking Java version...

Scan started at 13:18:43 06/09/2007

Listing files found while scanning....


VundoFix V6.5.9

Checking Java version...

Scan started at 17:56:49 12/10/2007

Listing files found while scanning....

C:\windows\system32\aybeg.bak1
C:\windows\system32\aybeg.bak2
C:\windows\system32\aybeg.ini
C:\windows\system32\gebya.dll
C:\WINDOWS\system32\kvfysaoy.dll

Beginning removal...

 Attempting to delete C:\windows\system32\aybeg.bak1
C:\windows\system32\aybeg.bak1 Has been deleted!

 Attempting to delete C:\windows\system32\aybeg.bak2
C:\windows\system32\aybeg.bak2 Has been deleted!

 Attempting to delete C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini Has been deleted!

 Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\kvfysaoy.dll
C:\WINDOWS\system32\kvfysaoy.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\windows\system32\aybeg.ini
C:\windows\system32\aybeg.ini Has been deleted!

 Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\kvfysaoy.dll
C:\WINDOWS\system32\kvfysaoy.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awvtr.dll 
C:\WINDOWS\system32\awvtr.dll  Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\awvtr.dll 
C:\WINDOWS\system32\awvtr.dll  Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\urqnool.dll 
C:\WINDOWS\system32\urqnool.dll  Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\urqnool.dll 
C:\WINDOWS\system32\urqnool.dll  Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\urqnool.dll
C:\WINDOWS\system32\urqnool.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.

 Attempting to delete C:\WINDOWS\system32\urqnool.dll
C:\WINDOWS\system32\urqnool.dll Has been deleted!

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

 Attempting to delete C:\WINDOWS\system32\awvtr.dll
C:\WINDOWS\system32\awvtr.dll Could not be deleted.

Performing Repairs to the registry.
Logfile of HijackThis v1.99.1
Scan saved at 11:57:15, on 14/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Hijackthis Version Française\VERSION TRADUITE ORIGINALE.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {F1A70968-24B6-452F-8499-60B3584FB09B} - C:\WINDOWS\system32\awvtr.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

croux04 · Answer

Je comprends , c'est dimanche, j'aurais  plus de chance demain!!!
A plus.

philae83 · Answer

bonjour,

désolée, ce n'est pas parce que c'est dimanche, mais j'ai attrapé la grippe, et j'ai passé mon dimanche au lit :)

j'essaye de me concentrer sur ton problème....lol

récalcitrant celui ci

* renomme hijackthis en scanner.exe et

relance combofix
et poste le nouveau rapport

puis poste un nouveau rapport hiajckthis renommé

croux04 · Answer

Salut philae, désolé pour ta grippe (mettre des chaussettes la nuit), je suis déja bien content de trouver autant d'aide sur le forum, voila mes derniers rapports: --ComboFix 07-10-12.4 - NOUS 2007-10-15 12:50:57.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.240 [GMT 2:00] Running from: C:\Documents and Settings\NOUS\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\check_LSA7.txt C:\WINDOWS\cookies.ini C:\WINDOWS\system32\awvtr.dll C:\WINDOWS\system32\bbslopsr.dll C:\WINDOWS\system32\ckacbvso.dll C:\WINDOWS\system32\oauqrtyx.dll C:\WINDOWS\system32\osvbcakc.ini C:\WINDOWS\system32\rnywlsta.dll C:\WINDOWS\system32\rspolsbb.ini C:\WINDOWS\system32\rtvwa.bak1 C:\WINDOWS\system32\rtvwa.bak1 C:\WINDOWS\system32\rtvwa.bak2 C:\WINDOWS\system32\rtvwa.bak2 C:\WINDOWS\system32\rtvwa.ini C:\WINDOWS\system32\rtvwa.ini . ((((((((((((((((((((((((((((( Fichiers créés 2007-09-15 to 2007-10-15 )))))))))))))))))))))))))))))))))))) . 2007-10-14 11:46 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe 2007-10-14 11:21 d-------- C:\ADSerunt 2007-10-12 18:16 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-10-12 17:56 d-------- C:\VundoFix Backups 2007-10-11 13:10 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2007-10-11 12:18 d-------- C:\Documents and Settings\NOUS\Application Data\sysdepannage 2007-10-11 12:13 dr------- C:\Documents and Settings\All Users.WINDOWS\Application Data\sysdepannage 2007-10-10 10:37 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2007-10-09 21:31 d-------- C:\Program Files\Hijackthis Version Fran‡aise 2007-10-08 19:22 d-------- C:\Documents and Settings\NOUS\Application Data\Ahead 2007-10-08 19:17 d-------- C:\Program Files\Nero 2007-10-08 19:17 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Nero 2007-10-08 18:16 d-------- C:\Documents and Settings\NOUS\Application Data\Lavasoft 2007-10-08 18:16 d-------- C:\Documents and Settings\NOUS\Application Data\Jasc Software Inc 2007-09-28 20:01 d-------- C:\WINDOWS\system32\LogFiles 2007-09-25 19:12 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Messenger Plus! 2007-09-20 19:14 d-------- C:\Documents and Settings\NOUS\Contacts 2007-09-20 19:13 d-------- C:\WINDOWS\system32\DRVSTORE 2007-09-20 17:24 d-------- C:\Documents and Settings\NOUS\Application Data\MSN6 2007-09-20 17:24 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\MSN6 2007-09-17 19:29 d-------- C:\WINDOWS\SxsCaPendDel 2007-09-16 16:52 d--hs---- C:\FOUND.031 2007-09-16 10:18 d-------- C:\WINDOWS\Sun 2007-09-16 10:04 d-------- C:\WINDOWS\system32\fr-fr 2007-09-16 10:04 d--h----- C:\WINDOWS\msdownld.tmp 2007-09-16 09:59 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll 2007-09-15 10:31 d--hs---- C:\FOUND.030 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-14 09:53 167 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err 2007-10-09 19:31 --------- d-----w C:\Program Files\Hijackthis Version Française 2007-09-12 14:17 --------- d-----w C:\Program Files\ArcSoft 2007-09-08 16:42 --------- d-----w C:\Documents and Settings\NOUS\Application Data\Hewlett-Packard 2007-09-07 19:14 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys 2007-09-07 19:14 298,104 ----a-w C:\WINDOWS\system32\imon.dll 2007-09-07 19:14 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys 2007-09-07 18:09 --------- d-----w C:\Program Files\Sunbelt Software 2007-09-06 17:29 --------- d-----w C:\Documents and Settings\NOUS\Application Data\vlc 2007-09-06 13:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater 2007-09-04 19:13 --------- d-----w C:\Program Files\Fichiers communs\xing shared 2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:17 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-08-20 09:59 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-20 09:59 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-20 09:59 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll 2007-08-20 09:59 6,058,496 ------w C:\WINDOWS\system32\dllcache\ieframe.dll 2007-08-20 09:59 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2007-08-20 09:59 477,696 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-20 09:59 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll 2007-08-20 09:59 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll 2007-08-20 09:59 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll 2007-08-20 09:59 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll 2007-08-20 09:59 3,584,512 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-20 09:59 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-20 09:59 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll 2007-08-20 09:59 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll 2007-08-20 09:59 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll 2007-08-20 09:59 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-20 09:59 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-20 09:59 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll 2007-08-20 09:59 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-20 09:59 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll 2007-08-20 09:59 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll 2007-08-20 09:59 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll 2007-08-20 09:59 1,152,000 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-17 10:22 63,488 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2007-08-17 10:22 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2007-08-17 10:22 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2007-08-17 07:34 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 17:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 17:18 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-25 20:18 52,552 ----a-w C:\Documents and Settings\moi\Application Data\GDIPFONTCACHEV1.DAT 2003-06-10 10:04 435 ----a-w C:\Documents and Settings\ls300_mydsc_0610\layout.bin 2000-05-15 08:08 134,656 ----a-w C:\Documents and Settings\ls300_mydsc_0610\Setup.exe . ((((((((((((((((((((((((((((( snapshot@2007-10-12_18.26.19.46 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 10:02:28 163,328 ----a-w C:\WINDOWS\erdnt\14-10-2007\ERDNT.EXE + 2007-10-14 09:23:50 3,747,840 ----a-w C:\WINDOWS\erdnt\14-10-2007\Users\[u]0[/u]0000001\NTUSER.DAT + 2007-10-14 09:23:50 143,360 ----a-w C:\WINDOWS\erdnt\14-10-2007\Users\[u]0[/u]0000002\UsrClass.dat + 2007-03-13 08:57:12 163,328 ----a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 17:57] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-07 21:14] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2002-12-17 11:40] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-11 12:08] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 17:36] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] "NeroFilterCheck"="C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-04 19:20] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 01:09] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03] R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-15 12:58:02 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-15 13:00:09 - machine was rebooted C:\ComboFix2.txt ... 2007-10-12 18:27 . --- E O F --- Logfile of HijackThis v1.99.1 Scan saved at 13:05:10, on 15/10/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe C:\Program Files\Eset\nod32krn.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe C:\Program Files\Analog Devices\SoundMAX\Smtray.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Google\Google Updater\GoogleUpdater.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Hijackthis Version Française\Scanner.EXE R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/... O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing) O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe Merci.... celeron 2.6ghz 2 dd 1graveur+1lecteur cd mem ddr 2700 512 m xp pro sp2

philae83 · Answer

re

ok merci

il semblerait que combo ait eu sa peau cette fois ci

* Fait un scan antivirus en ligne avec Internet Explorer
 https://www.bitdefender.fr/
et copie colle le résultat ici
* En bas, à gauche de la fenêtre, clique sur BitDefender SCAN ONLINE
* Dans la nouvelle fenêtre, clique sur I agree
* La fenêtre change encore, clique sur Click here to scan
* Les signatures se chargent, etc.

tuto en image

http://pageperso.aol.fr/rginformatique/mapage/defender.htm

croux04 · Answer

He bé, durant le scan par bitdefender, nod 32 m'a prévenu plusieurs fois que Win32/HOAX.Renos.HZ application était placé en quarantaine: Fichier C:docume~1\Nous\Loabs~1	emp	mp11   puis 12 puis 13 etc jusqu'a 16 ou 17.
Puis l'ordi c'est bloqué 2 fois pendant le scan de bitdefender et enfin en voila un résultat :
BitDefender Online Scanner - Rapport virus en temps réel
  
  
 
Généré à: Mon, Oct 15, 2007 - 21:26:09
 

--------------------------------------------------------------------------------

 
  
  
 
Info d'analyse
  
  
 
Fichiers scannés
 161928
 
Infectés Fichiers
 4
 
  
  
 
 
  
  
 
Virus Détectés
  
  
 
Trojan.Downloader.TR
 1
 
Trojan.Virtumonde.IK
 1
 
Trojan.Mezzia.XA
 1
 
Trojan.Downloader.LoadAdv.XXA
 1
 
  
  
 
 
  
  
 
 

--------------------------------------------------------------------------------
  
  
 
Ce sommaire du processus d'analyse sera utilisé par les laboratoires Antivirus BitDefender pour créer des statistiques agréguées sur l'activité des virus dans le monde. 
  
  
 C'était long et c'est pas gagné!!!!
Garder le moral, encore un peu , je peu....

philae83 · Answer

c'est bien joli tout ça, mais je n'ai pas le rapport entier .....

je ne sais pas les actions entreprises ni l'endroit de l'infection....

croux04 · Answer

Et un log hijackthis en plus :
Logfile of HijackThis v1.99.1
Scan saved at 21:36:56, on 15/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\Program Files\Eset
od32kui.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis Version Française\Scanner.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - Startup: Moniteur Fax-Voix.lnk = C:\OLIFAXVX\MONITEUR.EXE
O4 - Startup: Barre d'Outils Olitec.lnk = C:\OLIFAXVX\TOOLBAR.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing)
O23 - Service: Sunbelt Kerio Personal Firewall 4 (KPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

croux04 · Answer

Je recommence?

philae83 · Answer

pas trop le choix, oui recommence stp

et sauvegarde le rapport en entier
voir ici
http://pageperso.aol.fr/loraline60/bitdefender_scan.htm

croux04 · Answer

Merci de ta patience philae,
BitDefender Online Scanner
  
  
 
Rapport d'analyse généré à: Mon, Oct 15, 2007 - 22:32:00
 
 
  
  
 
Voie d'analyse: C:\;
  
  
 
 
  
  
 
Statistiques
 
Temps
 00:47:48
 
Fichiers
 144010
 
Directoires
 4424
 
Secteurs de boot
 4
 
Archives
 2138
 
Paquets programmes
 5851
 
  
  
 
Résultats
 
Virus identifiés
 4
 
Fichiers infectés
 4
 
Fichiers suspects
 0
 
Avertissements
 0
 
Désinfectés
 0
 
Fichiers effacés
 4
 
  
  
 
Info sur les moteurs
 
Définition virus
 826753
 
Version des moteurs
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Analyse des plugins
 14
 
Archive des plugins
 38
 
Unpack des plugins
 7
 
E-mail plugins
 6
 
Système plugins
 1
 
  
  
 
Paramètres d'analyse
 
Première action
 Désinfecté
 
Seconde Action
 Supprimé
 
Heuristique
 Oui
 
Acceptez les avertissements
 Oui
 
Extensions analysées
 *;
 
Excludez les extensions
  
 
Analyse d'emails
 Oui
 
Analyse des Archives
 Oui
 
Analyser paquets programmes
 Oui
 
Analyse des fichiers
 Oui
 
Analyse de boot
 Oui
 
  
  
 
  Fichier analysé
  Statut
 
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)=>zlib_nsis0001
 Infecté par: Trojan.Downloader.TR
 
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)=>zlib_nsis0001
 Echec de la désinfection
 
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)=>zlib_nsis0001
 Supprimé
 
C:\Program Files\ESET\infected\XVHVE1DA.NQF=>(Quarantine-PE)=>(NSIS o)
 Echec de la mise à jour
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb08e.msp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb064.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb064.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb064.msp=>(Embedded CAB)=>msgren32.A337.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb064.msp=>(Embedded CAB)=>msgrenle.D320.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb065.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb065.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb065.msp=>(Embedded CAB)=>msth3aml.34AE.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb065.msp=>(Embedded CAB)=>msthes3d.E64B.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb066.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>mso.acl_3082.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>mso.acl_1043.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>mssp3enl.34AE.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb066.msp=>(Embedded CAB)=>msspell3.A337.D0DF3458_A845_11D3_8D0A_0050046416B9
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>CDOOFF.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>DLGSETP.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>DUMPSTER.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>ENVELOPE.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>EXSEC32.DLL_0001
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>IMPMAIL.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>MIMEDIR.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>MSOUTL.OLB
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLADD.FAE
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLAPPT.FAE
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLJRNL.FAE
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLMAIL.FAE
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLMAIL.FAE=>(zlib o)
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OLTASK.FAE
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLCM.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLLIB.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLMIME.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLOOK.EXE
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLPH.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0a2.msp=>(Embedded CAB)=>OUTLVBS.DLL_0001
 Nettoyé
 
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>MSPUB.EXE_1033
 Nettoyé
 
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>PRTF9.DLL_1033
 Nettoyé
 
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>PTXT9.DLL_1033
 Nettoyé
 
C:\WINDOWS\Installer\fb0b6.msp=>(Embedded CAB)=>MSPUB.EXE_1049
 Nettoyé
 
C:\WINDOWS\Installer\fb0cb.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb0cb.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb0cb.msp=>(Embedded CAB)=>MSCONV97.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0cb.msp=>(Embedded CAB)=>WPFT532.CNV
 Nettoyé
 
C:\WINDOWS\Installer\67df2.msi
 Nettoyé
 
C:\WINDOWS\Installer\67df2.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\67df2.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\fb0df.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb0df.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb0df.msp=>(Embedded CAB)=>MSROUTE.DLL
 Nettoyé
 
C:\WINDOWS\Installer\fb0f4.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)=>EXCEL.EXE
 Nettoyé
 
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)=>EXCEL.EXE_1033
 Nettoyé
 
C:\WINDOWS\Installer\fb0f4.msp=>(Embedded CAB)=>EXCEL.EXE_1049
 Nettoyé
 
C:\WINDOWS\Installer\fb108.msp
 Nettoyé
 
C:\WINDOWS\Installer\fb108.msp=>(Embedded CAB)
 Nettoyé
 
C:\WINDOWS\Installer\fb108.msp=>(Embedded CAB)=>GIFIMP32.FLT
 Nettoyé
 
C:\WINDOWS\Installer\fb108.msp=>(Embedded CAB)=>PNG32.FLT
 Nettoyé
 
C:\WINDOWS\Installer\MSI8E.tmp
 Nettoyé
 
C:\WINDOWS\Installer\MSI90.tmp
 Nettoyé
 
C:\WINDOWS\Installer\MSI90.tmp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\d317f3.msi
 Nettoyé
 
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\d317f3.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\3b1488.msi
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\17043eb.msi=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\MSI99.tmp
 Nettoyé
 
C:\WINDOWS\Installer\MSI9B.tmp
 Nettoyé
 
C:\WINDOWS\Installer\MSI9B.tmp=>(Embedded EXE)
 Nettoyé
 
C:\WINDOWS\Installer\MSN Messenger 8.1.0178\
 Nettoyé
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>keygen.exe
 Infecté par: Trojan.Virtumonde.IK
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>keygen.exe
 Echec de la désinfection
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>keygen.exe
 Supprimé
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar
 Echec de la mise à jour
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>crack.exe
 Infecté par: Trojan.Mezzia.XA
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>crack.exe
 Echec de la désinfection
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>crack.exe
 Supprimé
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar
 Echec de la mise à jour
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>patch.exe
 Infecté par: Trojan.Downloader.LoadAdv.XXA
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>patch.exe
 Echec de la désinfection
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar=>patch.exe
 Supprimé
 
C:\ADSL\Nero_Burning_Rom_6.0.0.15_.rar
 Echec de la mise à jour

philae83 · Answer

re

avec des "cracks" normal qu'il y ai infection .....

* lance hijackthis puis coche ces lignes :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" 
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE 
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) 
O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.mypix.com/importer/ImageUploader4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab 
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\NOUS\LOCALS~1\Temp\hpdj.exe (file missing) 

* toutes applications fermées et HORS CONNEXION, clique sur "fixer objet"



* fait la mise à jour de JAVA

as tu encore des problèmes particuliers ?

croux04 · Answer

Merci encore pour ta patience, je viens de comprendre (un peu tard) que les nombreuses heures à réparer et reconfigurer mon pc sont dues en grande partie aux nombreux "cracks" installés sur ce poste, n'en étant pas le seul utilisateur mais le seul responsable envers tous, il me semble nécessaire de réagir au plus vite ...! Merci encore .

philae83 · Answer

je crois que tu as raison :)

plus de problème donc ?
on peut terminer

* Tu peux supprimer tous les logiciels que nous avons utilisés (Type: SmitFraufix, Blacklight, SDFix, ect.....)

* démarrer-----------panneau de configuration------------système----------
onglet Restauration système-----------coche la case (Désactiver la restauration système)--------------
redémarre l'ordinateur
réactive la ensuite

* Pour améliorer la sécurité de ton PC prend quelques instants pour lire

CECI

* Dénonce ton infection pour faire condamner les auteurs.
Crée un message pour faire avancer les choses sur Malware-Complaints, nous devons être les plus nombreux possibles, alors rends compte de ton infection :

- Voir les règles du forum : https://malwarecomplaints.info/
- Après t'être enregistré à l'aide du bouton en haut se nommant "Register"
Si tu as plus de 13 ans, choisir : "I Agree to these terms and am over or exactly 13 years of age"
Si tu as moins, clique sur : "I Agree to these terms and am under 13 years of age"

Tu as alors sous forme de liste un sujet par type d'infection (Look2Me, Smitfraud, SpywareQuake etc..).
La tienne = ******

---> https://malwarecomplaints.info/

Si le malware que tu as eu n'apparaît pas dans la liste, ou si tu ne sais pas par quoi tu étais infecté(e), crée un message dans le sujet Autres infections
conforme au règle du forum (age, ville, département etc..)

Indique aussi le nom du Forum qui t'a aidé, CommentCaMarche

bonne continuation

croux04 · Answer

by,
a plus

Pages Pub et autre dans ie7

22 réponses

Discussions similaires