PC infecte par cheval de troie

Question

Bonjour,
 
Je viens de recevoir une alerte Avast concernant la présence sur mon Pc d'un Cheval de Troie. Depuis mon Pc est complétement instable! Pouvez m'aider s'il vous plaît?
Merci d'avance.
Voici le rapport Hijack This:


Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 13:06:03, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32undll32.exe
C:\Program Files\SecCenter\scprot4.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32undll32.exe
C:\Documents and Settings\TOM\Bureau\NETTOYAGE\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {343B8228-617E-4342-840B-0057E20D3003} - C:\WINDOWS\system32	uvurqo.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {8CE1F2D7-C980-47E8-B22B-BDBDF0DF44BB} - C:\WINDOWS\system32\pmnll.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zsfizsji] rundll32.exe "C:\Program Files\zsfizsji\huhqlmds.dll",Init
O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: crehcjid - C:\WINDOWS\SYSTEM32\crehcjid.dll
O20 - Winlogon Notify: tuvurqo - C:\WINDOWS\SYSTEM32	uvurqo.dll
O20 - Winlogon Notify: winkve32 - C:\WINDOWS\SYSTEM32\winkve32.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Droppix Service - Unknown owner - C:\Program Files\Fichiers communs\Droppix\DxService.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

g!rly · Answer

salut tomsnow,

belle infection...

- Télécharge sur ton bureau DiagHelp.zip sur ton bureau - Tuto : http://www.malekal.com/DiagHelp/DiagHelp.php
- !!! Ne double-clic pas dessus !!! Fais un clic droit sur le fichier et extraire tout
- Un nouveau dossier chercher va être créé DiagHelp
- Ouvre le dossier DiagHelp.
- Double-clic sur catchme.exe (le .exe peut ne pas apparaître).

Une fenêtre va s'ouvrir, vas dans l'onglet Script.
Copie/colle ceci :

files to kill:
C:\Program Files\SecCenter\scprot4.exe

Clic sur Run.

Relance HijackThis, coche ces lignes :
O2 - BHO: (no name) - {343B8228-617E-4342-840B-0057E20D3003} - C:\WINDOWS\system32	uvurqo.dll
O2 - BHO: (no name) - {8CE1F2D7-C980-47E8-B22B-BDBDF0DF44BB} - C:\WINDOWS\system32\pmnll.dll
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe
O20 - Winlogon Notify: crehcjid - C:\WINDOWS\SYSTEM32\crehcjid.dll
O20 - Winlogon Notify: tuvurqo - C:\WINDOWS\SYSTEM32	uvurqo.dll
O20 - Winlogon Notify: winkve32 - C:\WINDOWS\SYSTEM32\winkve32.dll

Télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-click sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

    Citation :
    
C:\Program Files\SecCenter\scprot4.exe

Click sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
click sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.
Ps : il te sera peut-être demander de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.
http://img137.imageshack.us/img137/3558/refaitjk8.th.jpg

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

alors dans ta prochaine reponse post le rapport de ot-move it celui de vundofix et un nouveau rapport hijack this 

_______________________________________________________

instale un par feu :

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

________________________________________________________

@+

TOMSNOW · Answer

Salut G!rly et merci beacoup pour ton aide! Je fais tout ça de suite et te poste les résultats.

g!rly · Answer

ok

TOMSNOW · Answer

G!rly j'ai un soucis! Quand je fais la manip demandé sur Catchme.exe - script + copier coller puis run, il y'a un message du genre " script completed with errors"! Que faire?
Merci

g!rly · Answer

tu as bien copié et collé ceci :


files to kill:
C:\Program Files\SecCenter\scprot4.exe


si c´est le cas fais la suite

TOMSNOW · Answer

J'ai bien copié collé le texte que tu m'as indiqué mais rien a faire il ne le prends pas en charge!

g!rly · Answer

bon ok fais la suite on s´occupera de lui plus tards

TOMSNOW · Answer

Allright

g!rly · Answer

yes

TOMSNOW · Answer

Alors voici donc les rapports:

OT MOVEIT
C:\Program Files\SecCenter\scprot4.exe moved successfully.
 
Created on 11/30/2007 16:18:32


VundoFix V6.6.2

Checking Java version...

Scan started at 16:20:24 30/11/2007

Listing files found while scanning....

No infected files were found.

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:30:45, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Calendrier\Cld2000.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\TOM\Bureau\NETTOYAGE\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1A47A9A0-83FA-43F7-B924-3BC766640967} - C:\WINDOWS\system32\pmnll.dll
O2 - BHO: (no name) - {343B8228-617E-4342-840B-0057E20D3003} - C:\WINDOWS\system32	uvurqo.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zsfizsji] rundll32.exe "C:\Program Files\zsfizsji\huhqlmds.dll",Init
O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: crehcjid - C:\WINDOWS\SYSTEM32\crehcjid.dll
O20 - Winlogon Notify: tuvurqo - C:\WINDOWS\SYSTEM32	uvurqo.dll
O20 - Winlogon Notify: winkve32 - C:\WINDOWS\SYSTEM32\winkve32.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Droppix Service - Unknown owner - C:\Program Files\Fichiers communs\Droppix\DxService.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

g!rly · Answer

re,

c´est etrange que vundofix n´ai rien trouvé

oui jetico te demande ca car tu est infecté par des trojant du type vundoo logé dans le winlogon...

Télécharge VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double clique ensuite sur VirtumundoBeGone.exe et suis les instructions.
Une fois terminé, redémarre et poste le rapport VBG.TXT créé sur le bureau dans ta prochaine réponse avec un nouveau rapport HijackThis.
Ne t'inquiète pas si tu vois un message Ecran bleu "Erreur fatale", c'est normal et attendu

TOMSNOW · Answer

OK d'accord Allright

TOMSNOW · Answer

Voici le rapport:


[11/30/2007, 16:49:20] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\TOM\Bureau\VirtumundoBeGone.exe" )
[11/30/2007, 16:49:37] - Detected System Information:
[11/30/2007, 16:49:37] -  Windows Version: 5.1.2600, Service Pack 2
[11/30/2007, 16:49:37] -  Current Username: TOM (Admin)
[11/30/2007, 16:49:37] -  Windows is in NORMAL mode.
[11/30/2007, 16:49:37] - Searching for Browser Helper Objects:
[11/30/2007, 16:49:37] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/30/2007, 16:49:37] -  BHO 2: {1A47A9A0-83FA-43F7-B924-3BC766640967} ()
[11/30/2007, 16:49:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/30/2007, 16:49:37] -  Checking for HKLM\...\Winlogon\Notify\pmnll
[11/30/2007, 16:49:37] -  Key not found: HKLM\...\Winlogon\Notify\pmnll, continuing.
[11/30/2007, 16:49:37] -  BHO 3: {343B8228-617E-4342-840B-0057E20D3003} ()
[11/30/2007, 16:49:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/30/2007, 16:49:37] -  Checking for HKLM\...\Winlogon\Notify	uvurqo
[11/30/2007, 16:49:37] -  Found: HKLM\...\Winlogon\Notify	uvurqo - This is probably Virtumundo.
[11/30/2007, 16:49:37] -  Assigning {343B8228-617E-4342-840B-0057E20D3003} MSEvents Object
[11/30/2007, 16:49:37] - BHO list has been changed! Starting over...
[11/30/2007, 16:49:37] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/30/2007, 16:49:37] -  BHO 2: {1A47A9A0-83FA-43F7-B924-3BC766640967} ()
[11/30/2007, 16:49:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/30/2007, 16:49:37] -  Checking for HKLM\...\Winlogon\Notify\pmnll
[11/30/2007, 16:49:37] -  Key not found: HKLM\...\Winlogon\Notify\pmnll, continuing.
[11/30/2007, 16:49:37] -  BHO 3: {343B8228-617E-4342-840B-0057E20D3003} (MSEvents Object)
[11/30/2007, 16:49:37] - ALERT: Found MSEvents Object!
[11/30/2007, 16:49:37] -  BHO 4: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/30/2007, 16:49:37] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/30/2007, 16:49:37] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[11/30/2007, 16:49:37] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[11/30/2007, 16:49:37] -  BHO 5: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/30/2007, 16:49:37] -  BHO 6: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/30/2007, 16:49:37] - Finished Searching Browser Helper Objects
[11/30/2007, 16:49:37] - *** Detected MSEvents Object
[11/30/2007, 16:49:37] - Trying to remove MSEvents Object...
[11/30/2007, 16:49:38] -    Terminating Process: IEXPLORE.EXE
[11/30/2007, 16:49:39] -    Terminating Process: RUNDLL32.EXE
[11/30/2007, 16:49:39] -    Disabling Automatic Shell Restart
[11/30/2007, 16:49:39] -    Terminating Process: EXPLORER.EXE
[11/30/2007, 16:49:39] -    Suspending the NT Session Manager System Service
[11/30/2007, 16:49:39] -    Terminating Windows NT Logon/Logoff Manager
[11/30/2007, 16:49:39] -    Re-enabling Automatic Shell Restart
[11/30/2007, 16:49:39] -   File to disable: C:\WINDOWS\system32	uvurqo.dll
[11/30/2007, 16:49:39] -  Renaming C:\WINDOWS\system32	uvurqo.dll -> C:\WINDOWS\system32	uvurqo.dll.vir
[11/30/2007, 16:49:39] -  File successfully renamed!
[11/30/2007, 16:49:39] -   Removing HKLM\...\Browser Helper Objects\{343B8228-617E-4342-840B-0057E20D3003}
[11/30/2007, 16:49:39] -   Removing HKCR\CLSID\{343B8228-617E-4342-840B-0057E20D3003}
[11/30/2007, 16:49:39] -   Adding Kill Bit for ActiveX for GUID: {343B8228-617E-4342-840B-0057E20D3003}
[11/30/2007, 16:49:39] -   Deleting ATLEvents/MSEvents Registry entries
[11/30/2007, 16:49:39] -   Removing HKLM\...\Winlogon\Notify	uvurqo
[11/30/2007, 16:49:39] - Searching for Browser Helper Objects:
[11/30/2007, 16:49:39] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[11/30/2007, 16:49:39] -  BHO 2: {1A47A9A0-83FA-43F7-B924-3BC766640967} ()
[11/30/2007, 16:49:39] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/30/2007, 16:49:39] -  Checking for HKLM\...\Winlogon\Notify\pmnll
[11/30/2007, 16:49:40] -  Key not found: HKLM\...\Winlogon\Notify\pmnll, continuing.
[11/30/2007, 16:49:40] -  BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[11/30/2007, 16:49:40] - WARNING: BHO has no default name. Checking for Winlogon reference.
[11/30/2007, 16:49:40] -  Checking for HKLM\...\Winlogon\Notify\SDHelper
[11/30/2007, 16:49:40] -  Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[11/30/2007, 16:49:40] -  BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[11/30/2007, 16:49:40] -  BHO 5: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[11/30/2007, 16:49:40] - Finished Searching Browser Helper Objects
[11/30/2007, 16:49:40] - Finishing up...
[11/30/2007, 16:49:40] - A restart is needed.
[11/30/2007, 16:49:40] - Automatic Reboot on STOP Error is not set. User will have to manually restart.
[11/30/2007, 16:49:46] - Attempting to Restart via STOP error (Blue Screen!)

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:59:38, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Documents and Settings\TOM\Bureau\NETTOYAGE\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {C9C390AE-77BC-439D-A063-BD22A55DC251} - C:\WINDOWS\system32\pmnll.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [zsfizsji] rundll32.exe "C:\Program Files\zsfizsji\huhqlmds.dll",Init
O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: crehcjid - C:\WINDOWS\SYSTEM32\crehcjid.dll
O20 - Winlogon Notify: winkve32 - C:\WINDOWS\SYSTEM32\winkve32.dll
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Droppix Service - Unknown owner - C:\Program Files\Fichiers communs\Droppix\DxService.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

g!rly · Answer

re,

il y a des clef cachés virtumundobegonne n´arrive pas a les supprimer, il en a supprimé/renommé qu´une seul...

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

TOMSNOW · Answer

G!rly voici le rapport: ComboFix 07-11-19.4C - TOM 2007-11-30 17:10:04.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.574 [GMT 1:00] Running from: C:\Documents and Settings\TOM\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00001.dll C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00002.dll C:\Program Files\SecCenter C:\WINDOWS\system32\llnmp.ini C:\WINDOWS\system32\llnmp.ini2 C:\WINDOWS\system32\pmnll.dll C:\WINDOWS\system32\winkve32.dll . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_NTMLSVC -------\LEGACY_SYMAVC32 -------\NtmlSvc -------\poof -------\symavc32 ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-30 )))))))))))))))))))))))))))))))))))) . 2007-11-30 16:20 d-------- C:\VundoFix Backups 2007-11-30 14:07 d-------- C:\Program Files\Sonic Foundry 2007-11-30 13:47 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-30 13:47 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-11-30 12:37 d-------- C:\WINDOWS\system32\skjlrsjp 2007-11-30 12:36 d-------- C:\Program Files\zsfizsji 2007-11-30 12:36 d-------- C:\Program Files\Igefrkdb 2007-11-20 23:08 dr------- C:\Documents and Settings\Mes documents\Mes vid‚os 2007-11-17 18:00 d-------- C:\Documents and Settings\TOM\Application Data\Media Player Classic 2007-11-17 17:34 d-------- C:\Program Files\K-Lite Codec Pack 2007-11-17 17:12 d-------- C:\Program Files\Okoker All Video Splitter 2007-11-09 21:36 d-------- C:\Documents and Settings\Mes documents\essai21 2007-11-09 13:02 14,165 --------- C:\WINDOWS\system32\drivers\Pclepci.sys 2007-11-07 17:38 d-------- C:\Program Files\Transcribe 2007-10-30 18:22 d-------- C:\Documents and Settings\Mes documents\Ang‚lique 2007-10-26 13:11 d-------- C:\Program Files\Everest Poker 2007-10-23 12:23 d-------- C:\Documents and Settings\Mes documents t 2007-10-23 12:15 d-------- C:\Documents and Settings\Mes documents est 2007-10-23 12:11 d-------- C:\Program Files\Tracktion 3 2007-10-23 12:11 d-------- C:\Documents and Settings\TOM\Application Data\Tracktion 3 2007-10-23 11:58 d-------- C:\Documents and Settings\Mes documents oto 2007-10-23 11:40 d-------- C:\Documents and Settings\Mes documents\essai 2 2007-10-23 11:28 d-------- C:\Documents and Settings\Mes documents\essai1 2007-10-23 11:19 d-------- C:\Documents and Settings\Mes documents\essai 2007-10-23 11:16 d-------- C:\Documents and Settings\All Users\Application Data\Tracktion 3 2007-10-22 09:34 d-------- C:\Program Files\Skype 2007-10-22 09:34 d-------- C:\Program Files\Fichiers communs\Skype 2007-10-22 09:34 d-------- C:\Documents and Settings\TOM\Application Data\Skype 2007-10-22 09:34 d-------- C:\Documents and Settings\All Users\Application Data\Skype 2007-10-22 09:23 23,876,904 --a------ C:\SkypeSetup.exe 2007-10-16 18:50 d-------- C:\Documents and Settings\Mes documents\AdobeStockPhotos 2007-10-15 21:00 584,192 -----c--- C:\WINDOWS\system32\dllcache pcrt4.dll 2007-10-13 09:58 d-------- C:\Documents and Settings\TOM\Application Data\NetMedia Providers 2007-10-13 09:58 d-------- C:\Documents and Settings\Mes documents\Sony ACID Pro 6.0 Projects 2007-10-13 09:56 d-------- C:\Program Files\Vstplugins 2007-10-13 09:55 d-------- C:\Program Files\Sony 2007-10-13 09:55 d-------- C:\Documents and Settings\Mes documents\Sony 2007-10-10 10:17 d-------- C:\Documents and Settings\Mes documents\Updater 2007-10-10 10:16 d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems 2007-10-10 10:14 d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared 2007-10-09 22:26 d-------- C:\Program Files\Calendrier 2007-10-09 22:26 d-------- C:\Documents and Settings\TOM\Application Data\Calendrier Xtra 2007-10-08 12:07 d-------- C:\Program Files\Fichiers communs\Vbox 2007-10-07 12:03 2,628,296 --a------ C:\Program Files\ccsetup201.exe 2007-10-07 11:24 304,160 --a------ C:\StiImg.dat 2007-10-07 10:24 20,480 --a------ C:\WINDOWS\system32\drivers\usbuhci.sys 2007-10-07 10:24 20,480 --a--c--- C:\WINDOWS\system32\dllcache\usbuhci.sys 2007-10-03 10:36 d-------- C:\Program Files\Sonic Foundry Setup 2007-10-01 16:37 63,804 --a------ C:\WINDOWS\system32 vapps.xml 2007-10-01 16:36 d-------- C:\WINDOWS view 2007-10-01 15:24 d-------- C:\WINDOWS\system32\Data 2007-10-01 15:22 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-10-01 15:22 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-10-01 15:22 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll 2007-10-01 15:22 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-10-01 15:22 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-30 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-30 12:01 --------- d-----w C:\Program Files\RegClean 2007-11-30 11:39 1,037,879 ----a-w C:\WINDOWS\explorer.exe 2007-11-30 01:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2007-11-23 07:59 --------- d-----w C:\Documents and Settings\TOM\Application Data\OpenOffice.org2 2007-11-06 15:49 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT 2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT 2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT 2007-10-13 09:33 --------- d-----w C:\Documents and Settings\TOM\Application Data\dvdcss 2007-10-12 15:59 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-10-10 09:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-09 21:33 32 ----a-w C:\Program Files\log.txt 2007-10-07 11:10 --------- d-----w C:\Program Files\Google 2007-10-07 11:07 --------- d-----w C:\Program Files\WinISO 2007-09-22 14:11 48,237,752 ----a-w C:\SetupDroppixRecorder2(2).exe 2007-07-01 14:07 12,759,940 ----a-w C:\Program Files\cnx11_fr.exe 2007-06-30 15:26 12,413,440 ------w C:\Program Files\avgas-setup-7.5.1.43.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-30 15:58] "RemoteCenter"="C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2004-06-25 09:21] "Cld2000.exe"="C:\Program Files\Calendrier\Cld2000.exe" [2007-10-03 16:22] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "JeticoPFStartup"="C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe" [2005-07-19 06:22] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2007-09-13 15:55] "RTHDCPL"="RTHDCPL.EXE" [2006-04-04 10:44 C:\WINDOWS\RTHDCPL.exe] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 14:21] "NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32 undll32.exe] "nwiz"="nwiz.exe" [2006-06-01 10:22 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32 undll32.exe] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegedit"= 0 (0x0) "NoFind"= 0 (0x0) "NoRun"= 0 (0x0) "NoDesktop"= 0 (0x0) "NoClose"= 0 (0x0) "StartMenuLogOff"= 0 (0x0) "HideClock"= 0 (0x0) "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crehcjid] crehcjid.dll 2007-11-30 12:39 89088 C:\WINDOWS\system32\crehcjid.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnll.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series] 2003-03-28 14:21 57344 --a------ C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-06-30 15:58 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe -osboot R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S1 bcbus;BestCrypt bus driver;C:\WINDOWS\system32\DRIVERS\bcbus.sys S3 DPFilter;USB Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DPFilter.sys S3 Droppix Service;Droppix Service;"C:\Program Files\Fichiers communs\Droppix\DxService.exe" S3 KBNTXP;Standard PS/2 Multi-Keyboard Filter Driver for WinXp;C:\WINDOWS\system32\DRIVERS\KBNTXP.sys S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe" . ************************************************************************** scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services cpip_patcher] "ImagePath"="\??\C:\WINDOWS\system32 cpip_patcher.sys" . Completion time: 2007-11-30 17:15:48 - machine was rebooted . --- E O F ---

g!rly · Answer

re,

Copie le texte se situant ci-dessous :

File::
C:\WINDOWS\system32\crehcjid.dll

Folder::
C:\VundoFix Backups
C:\Program Files\zsfizsji
C:\Program Files\Igefrkdb

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crehcjid]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00


Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :


http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+

TOMSNOW · Answer

Ok a tout de suite

g!rly · Answer

oui

TOMSNOW · Answer

Voici le rapport que tu m'as demandé ComboFix 07-11-19.4C - TOM 2007-11-30 17:53:49.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.517 [GMT 1:00] Running from: C:\Documents and Settings\TOM\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\TOM\Bureau\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\crehcjid.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\Igefrkdb C:\Program Files\zsfizsji C:\Program Files\zsfizsji\huhqlmds.dll C:\VundoFix Backups C:\WINDOWS\system32\crehcjid.dll . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-30 )))))))))))))))))))))))))))))))))))) . 2007-11-30 14:07 d-------- C:\Program Files\Sonic Foundry 2007-11-30 13:47 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-30 13:47 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-11-30 12:37 d-------- C:\WINDOWS\system32\skjlrsjp 2007-11-20 23:08 dr------- C:\Documents and Settings\Mes documents\Mes vid‚os 2007-11-17 18:00 d-------- C:\Documents and Settings\TOM\Application Data\Media Player Classic 2007-11-17 17:34 d-------- C:\Program Files\K-Lite Codec Pack 2007-11-17 17:34 389,120 --a------ C:\WINDOWS\system32\lameACM.acm 2007-11-17 17:34 414 --a------ C:\WINDOWS\system32\lame_acm.xml 2007-11-17 17:12 d-------- C:\Program Files\Okoker All Video Splitter 2007-11-09 21:36 d-------- C:\Documents and Settings\Mes documents\essai21 2007-11-09 13:02 14,165 --------- C:\WINDOWS\system32\drivers\Pclepci.sys 2007-11-07 17:38 d-------- C:\Program Files\Transcribe 2007-10-30 18:22 d-------- C:\Documents and Settings\Mes documents\Ang‚lique 2007-10-26 13:11 d-------- C:\Program Files\Everest Poker 2007-10-23 12:23 d-------- C:\Documents and Settings\Mes documents t 2007-10-23 12:15 d-------- C:\Documents and Settings\Mes documents est 2007-10-23 12:11 d-------- C:\Program Files\Tracktion 3 2007-10-23 12:11 d-------- C:\Documents and Settings\TOM\Application Data\Tracktion 3 2007-10-23 11:58 d-------- C:\Documents and Settings\Mes documents oto 2007-10-23 11:40 d-------- C:\Documents and Settings\Mes documents\essai 2 2007-10-23 11:28 d-------- C:\Documents and Settings\Mes documents\essai1 2007-10-23 11:19 d-------- C:\Documents and Settings\Mes documents\essai 2007-10-23 11:16 d-------- C:\Documents and Settings\All Users\Application Data\Tracktion 3 2007-10-22 09:34 d-------- C:\Program Files\Skype 2007-10-22 09:34 d-------- C:\Program Files\Fichiers communs\Skype 2007-10-22 09:34 d-------- C:\Documents and Settings\TOM\Application Data\Skype 2007-10-22 09:34 d-------- C:\Documents and Settings\All Users\Application Data\Skype 2007-10-22 09:23 23,876,904 --a------ C:\SkypeSetup.exe 2007-10-16 18:50 d-------- C:\Documents and Settings\Mes documents\AdobeStockPhotos 2007-10-15 21:00 584,192 -----c--- C:\WINDOWS\system32\dllcache pcrt4.dll 2007-10-13 09:58 d-------- C:\Documents and Settings\TOM\Application Data\NetMedia Providers 2007-10-13 09:58 d-------- C:\Documents and Settings\Mes documents\Sony ACID Pro 6.0 Projects 2007-10-13 09:56 d-------- C:\Program Files\Vstplugins 2007-10-13 09:55 d-------- C:\Program Files\Sony 2007-10-13 09:55 d-------- C:\Documents and Settings\Mes documents\Sony 2007-10-10 10:17 d-------- C:\Documents and Settings\Mes documents\Updater 2007-10-10 10:16 d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems 2007-10-10 10:14 d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared 2007-10-09 22:26 d-------- C:\Program Files\Calendrier 2007-10-09 22:26 d-------- C:\Documents and Settings\TOM\Application Data\Calendrier Xtra 2007-10-08 12:07 d-------- C:\Program Files\Fichiers communs\Vbox 2007-10-07 12:03 2,628,296 --a------ C:\Program Files\ccsetup201.exe 2007-10-07 11:24 304,160 --a------ C:\StiImg.dat 2007-10-07 10:24 20,480 --a--c--- C:\WINDOWS\system32\dllcache\usbuhci.sys 2007-10-03 10:36 d-------- C:\Program Files\Sonic Foundry Setup 2007-10-01 16:37 63,804 --a------ C:\WINDOWS\system32 vapps.xml 2007-10-01 16:36 d-------- C:\WINDOWS view 2007-10-01 15:24 d-------- C:\WINDOWS\system32\Data 2007-10-01 15:22 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys 2007-10-01 15:22 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll 2007-10-01 15:22 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys 2007-10-01 15:22 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-30 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-30 12:01 --------- d-----w C:\Program Files\RegClean 2007-11-30 11:39 1,037,879 ----a-w C:\WINDOWS\explorer.exe 2007-11-30 01:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2007-11-23 07:59 --------- d-----w C:\Documents and Settings\TOM\Application Data\OpenOffice.org2 2007-11-06 15:49 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT 2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT 2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT 2007-10-13 09:33 --------- d-----w C:\Documents and Settings\TOM\Application Data\dvdcss 2007-10-12 15:59 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-10-10 09:04 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-10-09 21:33 32 ----a-w C:\Program Files\log.txt 2007-10-07 11:10 --------- d-----w C:\Program Files\Google 2007-10-07 11:07 --------- d-----w C:\Program Files\WinISO 2007-09-22 14:11 48,237,752 ----a-w C:\SetupDroppixRecorder2(2).exe 2007-07-01 14:07 12,759,940 ----a-w C:\Program Files\cnx11_fr.exe 2007-06-30 15:26 12,413,440 ------w C:\Program Files\avgas-setup-7.5.1.43.exe . ((((((((((((((((((((((((((((( snapshot@2007-11-30_17.14.55.46 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-30 17:03:50 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_71c.dat + 2007-11-30 17:04:19 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_ccc.dat - 2007-11-30 16:14:34 40,960 ----a-w C:\WINDOWS\Temp tdrvmon.exe + 2007-11-30 17:04:11 40,960 ----a-w C:\WINDOWS\Temp tdrvmon.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-30 15:58] "RemoteCenter"="C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2004-06-25 09:21] "Cld2000.exe"="C:\Program Files\Calendrier\Cld2000.exe" [2007-10-03 16:22] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "JeticoPFStartup"="C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe" [2005-07-19 06:22] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2007-09-13 15:55] "RTHDCPL"="RTHDCPL.EXE" [2006-04-04 10:44 C:\WINDOWS\RTHDCPL.exe] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 14:21] "NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32 undll32.exe] "nwiz"="nwiz.exe" [2006-06-01 10:22 C:\WINDOWS\system32 wiz.exe] "NvMediaCenter"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32 undll32.exe] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegedit"= 0 (0x0) "NoFind"= 0 (0x0) "NoRun"= 0 (0x0) "NoDesktop"= 0 (0x0) "NoClose"= 0 (0x0) "StartMenuLogOff"= 0 (0x0) "HideClock"= 0 (0x0) "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series] 2003-03-28 14:21 57344 --a------ C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-06-30 15:58 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe -osboot R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S1 bcbus;BestCrypt bus driver;C:\WINDOWS\system32\DRIVERS\bcbus.sys S3 DPFilter;USB Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DPFilter.sys S3 Droppix Service;Droppix Service;"C:\Program Files\Fichiers communs\Droppix\DxService.exe" S3 KBNTXP;Standard PS/2 Multi-Keyboard Filter Driver for WinXp;C:\WINDOWS\system32\DRIVERS\KBNTXP.sys S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-11-30 18:04:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-11-30 18:05:04 - machine was rebooted C:\ComboFix2.txt ... 2007-11-30 17:15 . --- E O F ---

TOMSNOW · Answer

J'avais oublié le rapport Kojak this!!!!
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:07:25, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Calendrier\Cld2000.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\TOM\Bureau\NETTOYAGE\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Droppix Service - Unknown owner - C:\Program Files\Fichiers communs\Droppix\DxService.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

g!rly · Answer

re,

j´ai oublier ceci : C:\WINDOWS\system32\skjlrsjp,oups...

Copie le texte se situant ci-dessous :

Folder::
C:\WINDOWS\system32\skjlrsjp

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.

TOMSNOW · Answer

Ok

g!rly · Answer

désolé...

TOMSNOW · Answer

Le voici le voilou:
ComboFix 07-11-19.4C - TOM 2007-11-30 17:10:04.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.574 [GMT 1:00]
Running from: C:\Documents and Settings\TOM\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00001.dll
C:\Program Files\Fichiers communs\microsoft shared\web folders\ibm00002.dll
C:\Program Files\SecCenter
C:\WINDOWS\system32\llnmp.ini
C:\WINDOWS\system32\llnmp.ini2
C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\winkve32.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NTMLSVC
-------\LEGACY_SYMAVC32
-------\NtmlSvc
-------\poof
-------\symavc32

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))))))))
.

2007-11-30 16:20 <REP> d-------- C:\VundoFix Backups
2007-11-30 14:07 <REP> d-------- C:\Program Files\Sonic Foundry
2007-11-30 13:47 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-30 13:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-30 12:37 <REP> d-------- C:\WINDOWS\system32\skjlrsjp
2007-11-30 12:36 <REP> d-------- C:\Program Files\zsfizsji
2007-11-30 12:36 <REP> d-------- C:\Program Files\Igefrkdb
2007-11-20 23:08 <REP> dr------- C:\Documents and Settings\Mes documents\Mes vid‚os
2007-11-17 18:00 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Media Player Classic
2007-11-17 17:34 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2007-11-17 17:12 <REP> d-------- C:\Program Files\Okoker All Video Splitter
2007-11-09 21:36 <REP> d-------- C:\Documents and Settings\Mes documents\essai21
2007-11-09 13:02 14,165 --------- C:\WINDOWS\system32\drivers\Pclepci.sys
2007-11-07 17:38 <REP> d-------- C:\Program Files\Transcribe
2007-10-30 18:22 <REP> d-------- C:\Documents and Settings\Mes documents\Ang‚lique
2007-10-26 13:11 <REP> d-------- C:\Program Files\Everest Poker
2007-10-23 12:23 <REP> d-------- C:\Documents and Settings\Mes documents\tt
2007-10-23 12:15 <REP> d-------- C:\Documents and Settings\Mes documents\test
2007-10-23 12:11 <REP> d-------- C:\Program Files\Tracktion 3
2007-10-23 12:11 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Tracktion 3
2007-10-23 11:58 <REP> d-------- C:\Documents and Settings\Mes documents\toto
2007-10-23 11:40 <REP> d-------- C:\Documents and Settings\Mes documents\essai 2
2007-10-23 11:28 <REP> d-------- C:\Documents and Settings\Mes documents\essai1
2007-10-23 11:19 <REP> d-------- C:\Documents and Settings\Mes documents\essai
2007-10-23 11:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Tracktion 3
2007-10-22 09:34 <REP> d-------- C:\Program Files\Skype
2007-10-22 09:34 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2007-10-22 09:34 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Skype
2007-10-22 09:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2007-10-22 09:23 23,876,904 --a------ C:\SkypeSetup.exe
2007-10-16 18:50 <REP> d-------- C:\Documents and Settings\Mes documents\AdobeStockPhotos
2007-10-15 21:00 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-13 09:58 <REP> d-------- C:\Documents and Settings\TOM\Application Data\NetMedia Providers
2007-10-13 09:58 <REP> d-------- C:\Documents and Settings\Mes documents\Sony ACID Pro 6.0 Projects
2007-10-13 09:56 <REP> d-------- C:\Program Files\Vstplugins
2007-10-13 09:55 <REP> d-------- C:\Program Files\Sony
2007-10-13 09:55 <REP> d-------- C:\Documents and Settings\Mes documents\Sony
2007-10-10 10:17 <REP> d-------- C:\Documents and Settings\Mes documents\Updater
2007-10-10 10:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-10-10 10:14 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2007-10-09 22:26 <REP> d-------- C:\Program Files\Calendrier
2007-10-09 22:26 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Calendrier Xtra
2007-10-08 12:07 <REP> d-------- C:\Program Files\Fichiers communs\Vbox
2007-10-07 12:03 2,628,296 --a------ C:\Program Files\ccsetup201.exe
2007-10-07 11:24 304,160 --a------ C:\StiImg.dat
2007-10-07 10:24 20,480 --a------ C:\WINDOWS\system32\drivers\usbuhci.sys
2007-10-07 10:24 20,480 --a--c--- C:\WINDOWS\system32\dllcache\usbuhci.sys
2007-10-03 10:36 <REP> d-------- C:\Program Files\Sonic Foundry Setup
2007-10-01 16:37 63,804 --a------ C:\WINDOWS\system32\nvapps.xml
2007-10-01 16:36 <REP> d-------- C:\WINDOWS\nview
2007-10-01 15:24 <REP> d-------- C:\WINDOWS\system32\Data
2007-10-01 15:22 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-01 15:22 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-01 15:22 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2007-10-01 15:22 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-10-01 15:22 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-30 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-30 12:01 --------- d-----w C:\Program Files\RegClean
2007-11-30 11:39 1,037,879 ----a-w C:\WINDOWS\explorer.exe
2007-11-30 01:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-23 07:59 --------- d-----w C:\Documents and Settings\TOM\Application Data\OpenOffice.org2
2007-11-06 15:49 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT
2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
2007-10-13 09:33 --------- d-----w C:\Documents and Settings\TOM\Application Data\dvdcss
2007-10-12 15:59 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-10-10 09:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-09 21:33 32 ----a-w C:\Program Files\log.txt
2007-10-07 11:10 --------- d-----w C:\Program Files\Google
2007-10-07 11:07 --------- d-----w C:\Program Files\WinISO
2007-09-22 14:11 48,237,752 ----a-w C:\SetupDroppixRecorder2(2).exe
2007-07-01 14:07 12,759,940 ----a-w C:\Program Files\cnx11_fr.exe
2007-06-30 15:26 12,413,440 ------w C:\Program Files\avgas-setup-7.5.1.43.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-30 15:58]
"RemoteCenter"="C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2004-06-25 09:21]
"Cld2000.exe"="C:\Program Files\Calendrier\Cld2000.exe" [2007-10-03 16:22]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"JeticoPFStartup"="C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe" [2005-07-19 06:22]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-13 15:55]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 10:44 C:\WINDOWS\RTHDCPL.exe]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 14:21]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-06-01 10:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
"NoDesktop"= 0 (0x0)
"NoClose"= 0 (0x0)
"StartMenuLogOff"= 0 (0x0)
"HideClock"= 0 (0x0)
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\crehcjid]
crehcjid.dll 2007-11-30 12:39 89088 C:\WINDOWS\system32\crehcjid.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnll.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
2003-03-28 14:21 57344 --a------ C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-06-30 15:58 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe -osboot

R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S1 bcbus;BestCrypt bus driver;C:\WINDOWS\system32\DRIVERS\bcbus.sys
S3 DPFilter;USB Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DPFilter.sys
S3 Droppix Service;Droppix Service;"C:\Program Files\Fichiers communs\Droppix\DxService.exe"
S3 KBNTXP;Standard PS/2 Multi-Keyboard Filter Driver for WinXp;C:\WINDOWS\system32\DRIVERS\KBNTXP.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe"
.
**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\tcpip_patcher]
"ImagePath"="\??\C:\WINDOWS\system32\tcpip_patcher.sys"
.
Completion time: 2007-11-30 17:15:48 - machine was rebooted
.
--- E O F ---

g!rly · Answer

re,

tu t´es trompé de rapport tu dois maintenant avoir 3 rapport combofix

c´est le troisieme que je voudrais voir

TOMSNOW · Answer

Désolé!!!!! Je suis nul!!
Le voici
ComboFix 07-11-19.4C - TOM 2007-11-30 18:18:36.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.603 [GMT 1:00]
Running from: C:\Documents and Settings\TOM\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\TOM\Bureau\CFScript.txt
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\skjlrsjp
C:\WINDOWS\system32\skjlrsjp\bg1.gif
C:\WINDOWS\system32\skjlrsjp\bgtop.gif
C:\WINDOWS\system32\skjlrsjp\bottom1.gif
C:\WINDOWS\system32\skjlrsjp\essentials.gif
C:\WINDOWS\system32\skjlrsjp\icon1.ico
C:\WINDOWS\system32\skjlrsjp\install1.gif
C:\WINDOWS\system32\skjlrsjp\left1.gif
C:\WINDOWS\system32\skjlrsjp\li.gif
C:\WINDOWS\system32\skjlrsjp\logo.gif
C:\WINDOWS\system32\skjlrsjp\main.htm
C:\WINDOWS\system32\skjlrsjp\mainframe.htm
C:\WINDOWS\system32\skjlrsjp\reinstall1.gif
C:\WINDOWS\system32\skjlrsjp\right1.gif
C:\WINDOWS\system32\skjlrsjp\s1.htm
C:\WINDOWS\system32\skjlrsjp\s2.htm
C:\WINDOWS\system32\skjlrsjp\s3.htm
C:\WINDOWS\system32\skjlrsjp\SMTop1.gif
C:\WINDOWS\system32\skjlrsjp\SMTop2.gif
C:\WINDOWS\system32\skjlrsjp\SMTop3.gif
C:\WINDOWS\system32\skjlrsjp\SMTop4.gif
C:\WINDOWS\system32\skjlrsjp\soft1_off.gif
C:\WINDOWS\system32\skjlrsjp\soft1_off_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft1_on.gif
C:\WINDOWS\system32\skjlrsjp\soft1_on_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft2_off.gif
C:\WINDOWS\system32\skjlrsjp\soft2_off_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft2_on.gif
C:\WINDOWS\system32\skjlrsjp\soft2_on_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft3_off.gif
C:\WINDOWS\system32\skjlrsjp\soft3_off_ext.gif
C:\WINDOWS\system32\skjlrsjp\soft3_on.gif
C:\WINDOWS\system32\skjlrsjp\soft3_on_ext.gif
C:\WINDOWS\system32\skjlrsjp\softbottom_off.gif
C:\WINDOWS\system32\skjlrsjp\softbottom_on.gif
C:\WINDOWS\system32\skjlrsjp\softleft_off.gif
C:\WINDOWS\system32\skjlrsjp\softleft_on.gif
C:\WINDOWS\system32\skjlrsjp\top1.gif
C:\WINDOWS\system32\skjlrsjp\top2.gif
C:\WINDOWS\system32\skjlrsjp\turnoff1.gif
C:\WINDOWS\system32\skjlrsjp\turnon1.gif

.
((((((((((((((((((((((((((((( Fichiers créés 2007-10-28 to 2007-11-30 ))))))))))))))))))))))))))))))))))))
.

2007-11-30 14:07 <REP> d-------- C:\Program Files\Sonic Foundry
2007-11-30 13:47 <REP> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-30 13:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-20 23:08 <REP> dr------- C:\Documents and Settings\Mes documents\Mes vidéos
2007-11-17 18:00 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Media Player Classic
2007-11-17 17:34 <REP> d-------- C:\Program Files\K-Lite Codec Pack
2007-11-17 17:34 389,120 --a------ C:\WINDOWS\system32\lameACM.acm
2007-11-17 17:34 414 --a------ C:\WINDOWS\system32\lame_acm.xml
2007-11-17 17:12 <REP> d-------- C:\Program Files\Okoker All Video Splitter
2007-11-09 21:36 <REP> d-------- C:\Documents and Settings\Mes documents\essai21
2007-11-09 13:02 14,165 --------- C:\WINDOWS\system32\drivers\Pclepci.sys
2007-11-07 17:38 <REP> d-------- C:\Program Files\Transcribe
2007-10-30 18:22 <REP> d-------- C:\Documents and Settings\Mes documents\Angélique
2007-10-26 13:11 <REP> d-------- C:\Program Files\Everest Poker
2007-10-23 12:23 <REP> d-------- C:\Documents and Settings\Mes documents\tt
2007-10-23 12:15 <REP> d-------- C:\Documents and Settings\Mes documents\test
2007-10-23 12:11 <REP> d-------- C:\Program Files\Tracktion 3
2007-10-23 12:11 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Tracktion 3
2007-10-23 11:58 <REP> d-------- C:\Documents and Settings\Mes documents\toto
2007-10-23 11:40 <REP> d-------- C:\Documents and Settings\Mes documents\essai 2
2007-10-23 11:28 <REP> d-------- C:\Documents and Settings\Mes documents\essai1
2007-10-23 11:19 <REP> d-------- C:\Documents and Settings\Mes documents\essai
2007-10-23 11:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Tracktion 3
2007-10-22 09:34 <REP> d-------- C:\Program Files\Skype
2007-10-22 09:34 <REP> d-------- C:\Program Files\Fichiers communs\Skype
2007-10-22 09:34 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Skype
2007-10-22 09:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
2007-10-22 09:23 23,876,904 --a------ C:\SkypeSetup.exe
2007-10-16 18:50 <REP> d-------- C:\Documents and Settings\Mes documents\AdobeStockPhotos
2007-10-15 21:00 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-13 09:58 <REP> d-------- C:\Documents and Settings\TOM\Application Data\NetMedia Providers
2007-10-13 09:58 <REP> d-------- C:\Documents and Settings\Mes documents\Sony ACID Pro 6.0 Projects
2007-10-13 09:56 <REP> d-------- C:\Program Files\Vstplugins
2007-10-13 09:55 <REP> d-------- C:\Program Files\Sony
2007-10-13 09:55 <REP> d-------- C:\Documents and Settings\Mes documents\Sony
2007-10-10 10:17 <REP> d-------- C:\Documents and Settings\Mes documents\Updater
2007-10-10 10:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-10-10 10:14 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2007-10-09 22:26 <REP> d-------- C:\Program Files\Calendrier
2007-10-09 22:26 <REP> d-------- C:\Documents and Settings\TOM\Application Data\Calendrier Xtra
2007-10-08 12:07 <REP> d-------- C:\Program Files\Fichiers communs\Vbox
2007-10-07 12:03 2,628,296 --a------ C:\Program Files\ccsetup201.exe
2007-10-07 11:24 304,160 --a------ C:\StiImg.dat
2007-10-07 10:24 20,480 --a--c--- C:\WINDOWS\system32\dllcache\usbuhci.sys
2007-10-03 10:36 <REP> d-------- C:\Program Files\Sonic Foundry Setup
2007-10-01 16:37 63,804 --a------ C:\WINDOWS\system32\nvapps.xml
2007-10-01 16:36 <REP> d-------- C:\WINDOWS\nview
2007-10-01 15:24 <REP> d-------- C:\WINDOWS\system32\Data
2007-10-01 15:22 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-01 15:22 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2007-10-01 15:22 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-10-01 15:22 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-30 16:14 16,768 ----a-w C:\WINDOWS\system32\tcpip_patcher.sys
2007-11-30 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-30 12:01 --------- d-----w C:\Program Files\RegClean
2007-11-30 11:40 156,768 ----a-w C:\WINDOWS\system32\accece0.sys
2007-11-30 11:39 1,037,879 ----a-w C:\WINDOWS\explorer.exe
2007-11-30 11:38 37,376 ----a-w C:\WINDOWS\system32\tuvurqo.dll.vir
2007-11-30 11:36 34,304 ----a-w C:\WINDOWS\system32\vtussro.dll
2007-11-30 01:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-23 07:59 --------- d-----w C:\Documents and Settings\TOM\Application Data\OpenOffice.org2
2007-11-06 15:49 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT
2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
2007-10-13 09:33 --------- d-----w C:\Documents and Settings\TOM\Application Data\dvdcss
2007-10-12 15:59 --------- d-----w C:\Program Files\Fichiers communs\Adobe
2007-10-10 09:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-09 21:33 32 ----a-w C:\Program Files\log.txt
2007-10-07 11:10 --------- d-----w C:\Program Files\Google
2007-10-07 11:07 --------- d-----w C:\Program Files\WinISO
2007-09-28 17:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-09-28 17:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-09-28 17:05 739,840 ----a-w C:\WINDOWS\system32\divx.dll
2007-09-22 14:11 48,237,752 ----a-w C:\SetupDroppixRecorder2(2).exe
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-09-04 17:56 164,352 ----a-w C:\WINDOWS\system32\unrar.dll
2007-08-21 06:17 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-07-01 14:07 12,759,940 ----a-w C:\Program Files\cnx11_fr.exe
2007-06-30 15:26 12,413,440 ------w C:\Program Files\avgas-setup-7.5.1.43.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-30_17.14.55.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-30 17:03:50 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_71c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-30 15:58]
"RemoteCenter"="C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2004-06-25 09:21]
"Cld2000.exe"="C:\Program Files\Calendrier\Cld2000.exe" [2007-10-03 16:22]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 11:06]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"JeticoPFStartup"="C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe" [2005-07-19 06:22]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-13 15:55]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 10:44 C:\WINDOWS\RTHDCPL.exe]
"Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 14:21]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2006-06-01 10:22 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32\rundll32.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-07-24 11:05:13]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 20:05:56]
Outil de mise … jour Google.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-06-30 15:58:10]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegedit"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
"NoDesktop"= 0 (0x0)
"NoClose"= 0 (0x0)
"StartMenuLogOff"= 0 (0x0)
"HideClock"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
2003-03-28 14:21 57344 --a------ C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-06-30 15:58 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe -osboot

R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys
S1 bcbus;BestCrypt bus driver;C:\WINDOWS\system32\DRIVERS\bcbus.sys
S3 DPFilter;USB Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DPFilter.sys
S3 Droppix Service;Droppix Service;"C:\Program Files\Fichiers communs\Droppix\DxService.exe"
S3 KBNTXP;Standard PS/2 Multi-Keyboard Filter Driver for WinXp;C:\WINDOWS\system32\DRIVERS\KBNTXP.sys
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-30 18:19:46
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-30 18:20:13
C:\ComboFix2.txt ... 2007-11-30 18:05
C:\ComboFix3.txt ... 2007-11-30 17:15
.
--- E O F ---

g!rly · Answer

ok 

non tu n´es pas nul sinon tu n´aurais pas reussi a faire tout ce que l´on vient de faire ;-)

repost un nouveau hijack this stp

TOMSNOW · Answer

Merci  de ta compréhension!

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 18:42:20, on 30/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
C:\Program Files\Calendrier\Cld2000.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Sonic Foundry\Sound Forge 6.0\forge60.exe
C:\WINDOWS\winhlp32.exe
C:\Program Files\Audacity\audacity.exe
C:\Documents and Settings\TOM\Bureau\NETTOYAGE\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [JeticoPFStartup] "C:\Program Files\Jetico\Jetico Personal Firewall\fwsrv.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RemoteCenter] C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE
O4 - HKCU\..\Run: [Cld2000.exe] C:\Program Files\Calendrier\Cld2000.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Droppix Service - Unknown owner - C:\Program Files\Fichiers communs\Droppix\DxService.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

g!rly · Answer

re,

c´est quoi ce programme?

C:\Program Files\Calendrier\Cld2000.exe

ca m´a pas l´air tres catholique...

TOMSNOW · Answer

Ca n'as rien de coquin! C'est un petit plug qui remplace le traditionel calendrier de nos amis les pompiers...tout simplement. Je sais maintenant quel jour nous sommes, a qui je dois souhaiter une bonne fête ou a quel heure je dois faire aller boire un verre par exemple!

g!rly · Answer

oui vu comme ca ca a l´air tres bien, mais au plus profond de moi je crois que c´est un jolie spyware/trojan...

fais ceci :

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

TOMSNOW · Answer

Tu crois que je devrais le virer?

g!rly · Answer

fais sdfix apres on avisera...

TOMSNOW · Answer

J'suis navré, mais je n'ai pas de log qui s'affiche aprés la manip. Je ne trouve pas "report.txt" dans le dossier fdfix non plus! Pourtant j'ai fait comme m'as dit ...mais rien! AYYYYYYEE

g!rly · Answer

tu peux le rechercher grace a l´explorateur windows.

Report.txt

sinon fais anlyser le fichier de ton calendrier, comme ca on sera fixé

C:\Program Files\Calendrier\Cld2000.exe

ici :

http://virusscan.jotti.org/de/

et poste les rapports ici enfin si tu trouve celui de sdfix...

@+

TOMSNOW · Answer

Ok je fais ca de suite

TOMSNOW · Answer

Pour le calendrier tout est ok il est clean d'aprés le scan, par contre, je n'ai toujours pas trouvé le log fdfix! Désolé

g!rly · Answer

bon.

je le saurais desormait pour le calendrier...;-)

ta version de java n´est pas a jour :

appuie simultanement sur la touche windows a droit de la barre d´espace (drapeau windows) et sur "e" ->une fois dans le post de travail click sur le disk c > program files >java ouvre le fichier java et click sur le fichier jre1.6.0_02 pour l´ouvrir puis ouvre le fichier bin et dedans tu recherche ceci : jucheck.exe tu double click dessus et effectue la mise a jour de java> tu veux la version 1.6.0_03
une fois la mise a jour effectuée tu va dans ajoute/suppression de program et tu supprime toutes les autres update de java, il ne doit te rester que celle que tu viens de faire : 1.6.0_03 

et

regarde ceci concernant avast :

Antivir vs Avast :

->http://forum.malekal.com/ftopic3528.php

je te montre ca car j´aimerais que tu remplace avast par antivir pour effectuer un scan complet de ta machine

Telecharge et instal l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner... 

explication configuration scanner :

une fois antivir ouvert click sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite puis dans la nouvelle fenetre a gauche >scanner > scan all files et en dessous >scanner priority = High
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level 

post le rapport de scan 

@+

TOMSNOW · Answer

Ok Merci encore

g!rly · Answer

de rien ;-)

TOMSNOW · Answer

Salut g!rly, désolé de ne reprendre contac avec toi que maintenant, mais comme un probleme ne viens jamais seul, j'ai perdu hier soir ma connexion internet!!! Les joies de NEUF! Je viens tout juste de la récupérer alors j'en profites pour te tenir au courant: j'ai bien désinstalleré avast puis installé Antivir, suf que depuis, je ne peux plus rien faire sans que l'antivirus pète les plomps, il me signale constamment la présence de virus! Je deviens fou. Que faire? Crois tu que je vais m'en sortir?
Merci encore pour ta patience et toute ton aide

g!rly · Answer

salut tomsnow, 

peux tu faire un scan complet si possible en mode sans echec avec antivir et poster le rapport ici stp

configuration :

une fois antivir ouvert click sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite puis dans la nouvelle fenetre a gauche >scanner > scan all files et en dessous >scanner priority = High
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level 

@+

TOMSNOW · Answer

Salut G!rly,

Décidémment je commence àdevenir fou!!!! Je viens seulement de récupérer un semblant de connexion donc j'en profites pour te faire part de l'évolution: je ne peux plus rien faire sans que antivir péte les plombs! J'ai dû le désactiver pour pouvoir accéder au net. J'ai fait le scan antivir dont tu trouveras le rapport. Sinon maintenant j'ai des tas de pubs du style "security center " qui s'affichent. J'en ai marre!!!!!!! Merci encore pour ton coup de main. 

AntiVir PersonalEdition Classic
Report file date: dimanche 2 décembre 2007  12:25

Scanning for 955520 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    BLUETONE-22E633

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0     1640448 Bytes  13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.1.30    1575424 Bytes  30/11/2007 11:13:44
ANTIVIR3.VDF : 7.0.1.31       2048 Bytes  30/11/2007 11:13:44
AVEWIN32.DLL : 7.6.0.34    3125760 Bytes  02/12/2007 11:13:44
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15     360488 Bytes  03/08/2007 08:46:00
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: D:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: dimanche 2 décembre 2007  12:25

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
  Module is infected -> 'C:\WINDOWS\explorer.exe'
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'ashWebSv.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'ashMaiSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'PAStiSvc.exe' - '1' Module(s) have been scanned
Scan process 'skypePM.exe' - '1' Module(s) have been scanned
Scan process 'StarWindServiceAE.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'CTSVCCDA.EXE' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'LEXPPS.EXE' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'LEXBCES.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'Skype.exe' - '1' Module(s) have been scanned
Scan process 'Cld2000.exe' - '1' Module(s) have been scanned
Scan process 'RcMan.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'ashDisp.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'lxbkbmgr.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'realsched.exe' - '1' Module(s) have been scanned
Scan process 'winampa.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'ashServ.exe' - '1' Module(s) have been scanned
Scan process 'aswUpdSv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
Process 'explorer.exe' has been terminated
C:\WINDOWS\explorer.exe
      [DETECTION] Is the Trojan horse TR/Patched.Explor.B
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!

50 processes with 49 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [NOTE]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!
Boot sector 'D:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
C:\WINDOWS\system32\crehcjid.dll
      [DETECTION] Is the Trojan horse TR/SpamBot.AD
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\crehcjid.dll
      [DETECTION] Is the Trojan horse TR/SpamBot.AD
C:\WINDOWS\system32\winkve32.dll
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\winkve32.dll
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen

The registry was scanned ( '34' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.dll
      [DETECTION] Is the Trojan horse TR/PWS.Sinowal.Gen
      [INFO]      The file was moved to '47bf9a9b.qua'!
C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00002.dll
      [DETECTION] Is the Trojan horse TR/PWS.Sinowal.Gen
      [INFO]      The file was moved to '47bf9a9d.qua'!
C:\Program Files\zsfizsji\huhqlmds.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP166\A0026603.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '47829de1.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP166\A0026604.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '47829de3.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP170\A0027764.dll
      [DETECTION] Is the Trojan horse TR/PWS.Sinowal.Gen
      [INFO]      The file was moved to '47829df1.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP170\A0027765.dll
      [DETECTION] Is the Trojan horse TR/PWS.Sinowal.Gen
      [INFO]      The file was moved to '47829df2.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP170\A0027766.dll
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [INFO]      The file was moved to '47829df4.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP170\A0027767.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '47829df5.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP172\A0027868.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [INFO]      The file was moved to '47829dfb.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP172\A0027869.dll
      [DETECTION] Is the Trojan horse TR/SpamBot.AD
      [INFO]      The file was moved to '47829dfd.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP186\A0039708.exe
      [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
      [INFO]      The file was moved to '47829e6f.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP186\A0039709.dll
      [DETECTION] Is the Trojan horse TR/PWS.Sinowal.Gen
      [INFO]      The file was moved to '47829e70.qua'!
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP186\A0039710.dll
      [DETECTION] Is the Trojan horse TR/PWS.Sinowal.Gen
      [INFO]      The file was moved to '47829e72.qua'!
C:\WINDOWS\avp.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Alphabet.LH1
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\explorer.exe
      [DETECTION] Is the Trojan horse TR/Patched.Explor.B
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\mgrs.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\xpupdate.exe
      [WARNING]   'Is the Trojan horse TR/Zlob.CA.78'. This detection is probably an error. Please send us this file immediately for further analysis.
C:\WINDOWS\system32\crehcjid.dll
      [DETECTION] Is the Trojan horse TR/SpamBot.AD
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\cyzrdghf.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\dcuneykg.exe
      [DETECTION] Is the Trojan horse TR/Fotomoto.F.1
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\drvtod.dll
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [INFO]      The file was moved to '47c8a0b9.qua'!
C:\WINDOWS\system32\mhcwtuqc.exe
      [DETECTION] Is the Trojan horse TR/Click.MNB
      [INFO]      The file was moved to '47b5a0bf.qua'!
C:\WINDOWS\system32\oxdvjawy.dll
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [INFO]      The file was moved to '47b6a0df.qua'!
C:\WINDOWS\system32\pmnll.dll
      [DETECTION] Is the Trojan horse TR/Vundo.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\printer.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      The file was moved to '47bba0e4.qua'!
C:\WINDOWS\system32\spoolvs.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      The file was moved to '47c1a0f3.qua'!
C:\WINDOWS\system32	pyfjvuq.dll
      [DETECTION] Is the Trojan horse TR/Vundo.CA
      [INFO]      The file was moved to '47cba0f7.qua'!
C:\WINDOWS\system32\winkve32.dll
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\xqnddnoo.dll
      [DETECTION] Is the Trojan horse TR/Vundo.AU
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\__c00D2AAA.dat
      [DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\etc\hosts
      [DETECTION] Is the Trojan horse TR/Qhost.NL
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\system32\&#1109;&#1091;stem\wucrtupd.exe
      [DETECTION] Is the Trojan horse TR/Dldr.PurityScan.EJ
      [INFO]      The file was moved to '47b5a14f.qua'!
C:\WINDOWS\Temp\64server.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\Temp\gos2E.tmp
      [DETECTION] Is the Trojan horse TR/Crypt.PEC2X.Gen
      [INFO]      The file was moved to '47c5a14b.qua'!
C:\WINDOWS\Temp\hostpower.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\Temp\monpower.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\Temp\powermon.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\Temp\syssv.exe
      [DETECTION] Is the Trojan horse TR/Downloader.Gen
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
C:\WINDOWS\Temp\win20.exe
      [WARNING]   'Is the Trojan horse TR/Zlob.CA.78'. This detection is probably an error. Please send us this file immediately for further analysis.
C:\WINDOWS\Temp\win26.exe
      [DETECTION] Contains detection pattern of the dropper DR/Dldr.PurityScan.EG.7
      [INFO]      The file was moved to '47c0a14c.qua'!
C:\WINDOWS\Temp\win34.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Alphabet.LH1
      [WARNING]   An error has occurred and the file was not deleted. ErrorID: 16003
      [WARNING]   The file could not be deleted!
Begin scan in 'D:\' <Données>
D:\Documents and Settings\Programmes\Démarrage\findfast.exe
      [DETECTION] Is the Trojan horse TR/Dldr.Agent.eus.19
      [INFO]      The file was moved to '47c0a151.qua'!


End of the scan: dimanche 2 décembre 2007  13:23
Used time: 57:59 min

The scan has been done completely.

   5894 Scanning directories
 379621 Files were scanned
     45 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
     23 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
 379576 Files not concerned
   4109 Archives were scanned
     25 Warnings
      0 Notes

g!rly · Answer

salut tomsnow,

fais ceci :

Désactive ta restauration système:
pour cela :
Click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration système;
coche la case désactiver la restauration systèm et applique.
puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration systèm
décoche la case désactiver la restauration systèm et applique. 

stinger :

https://www.numerama.com/

telecharge le et click sur scan et le laisse travailler si tu as un rapport post le

puis refais un combofix et post le rapport

TOMSNOW · Answer

Girly au secours! Je ne peux pas accéder à la restauration systéme! Quand je clic droit sur le poste de travail une alerte du type "restriction sur cet ordinateur" apparaît! Que faire?

Sinon en attendantj'ai fais un scan avg antispyware dont voici les résultats et un autre avec AvG antivirus (qui a trouvé plein de trucs, mais dont je ne trouve pas le rapport d'analyse; je ne sais pas comment faire pour pouvoir te montrer les résultats)

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	16:00:40 02/12/2007

 + Résultat de l'analyse:	



C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP186\A0045733.dll -> Adware.BraveSentry : Nettoyé.
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP186\A0045734.dll -> Adware.BraveSentry : Nettoyé.
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP186\A0046744.dll -> Adware.BraveSentry : Nettoyé.
C:\Program Files\MalwareAlarm\MalwareAlarm0.ma -> Adware.DrAntispy : Nettoyé.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smgr -> Adware.Generic : Nettoyé.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo -> Adware.Generic : Nettoyé.
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP187\A0046754.exe -> Downloader.PurityScan.eg : Nettoyé.
C:\System Volume Information\_restore{129A78A4-40FF-494C-A631-0B99C3E7FC61}\RP186\A0045719.exe -> Not-A-Virus.Hoax.Win32.Renos.hx : Nettoyé.
:mozilla.109:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.167:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.429:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.115:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.116:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.125:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.14:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.15:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.16:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.17:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.145:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.41:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.663:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.664:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.665:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.24:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.219:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Esomniture : Nettoyé.
:mozilla.220:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Esomniture : Nettoyé.
:mozilla.221:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Esomniture : Nettoyé.
:mozilla.222:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Esomniture : Nettoyé.
:mozilla.223:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Esomniture : Nettoyé.
:mozilla.267:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.119:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.120:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.121:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.65:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.786:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.787:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.788:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.789:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.790:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.791:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.792:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.314:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.315:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.58:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.437:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.474:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Qksrv : Nettoyé.
:mozilla.475:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Qksrv : Nettoyé.
:mozilla.477:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.
:mozilla.478:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Questionmarket : Nettoyé.
:mozilla.488:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.489:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.490:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Realmedia : Nettoyé.
:mozilla.168:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.520:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.521:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.522:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.523:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.524:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.525:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.43:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.44:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.46:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.45:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.48:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.49:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.629:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.630:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.631:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.632:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.633:C:\Documents and Settings\TOM\Application Data\Mozilla\Firefox\Profiles\iu4m8zwz.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.


Fin du rapport

TOMSNOW · Answer

Sinon Antivir ne cesse de m'alerter sur un truc bizzare : "TR/Patched.Explor.B" .....si ça peux te donner des infos!

g!rly · Answer

re,

pour le moment passe stinger 

stinger :

https://www.numerama.com/

telecharge le et click sur scan et le laisse travailler si tu as un rapport post le

puis refais un combofix et post le rapport 

@+

TOMSNOW · Answer

Ok je suis en train de le faire.

TOMSNOW · Answer

Voici les rapports: ComboFix 07-12-02.5 - TOM 2007-12-02 17:21:19.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.444 [GMT 1:00] Running from: C:\Documents and Settings\TOM\Bureau\ComboFix.exe * Created a new restore point . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk C:\Documents and Settings\TOM\Bureau\Live Safety Center.lnk C:\Documents and Settings\TOM\Favoris\Online Security Guide.lnk C:\Program Files\Fichiers communs\Yazzle1162OinUninstaller.exe C:\Program Files\SecCenter C:\Program Files\ucleaner_setup.exe C:\Program Files\Ultimate Cleaner C:\WINDOWS\Casino.ico C:\WINDOWS\Free Online Dating.ico C:\WINDOWS\Spyware Remover.ico C:\WINDOWS\system32\cyzrdghf.dllbox C:\WINDOWS\system32\drvtodr.dll C:\WINDOWS\system32\llnmp.ini C:\WINDOWS\system32\skjlrsjp C:\WINDOWS\system32\skjlrsjp\bg1.gif C:\WINDOWS\system32\skjlrsjp\bgtop.gif C:\WINDOWS\system32\skjlrsjp\bottom1.gif C:\WINDOWS\system32\skjlrsjp\essentials.gif C:\WINDOWS\system32\skjlrsjp\icon1.ico C:\WINDOWS\system32\skjlrsjp\install1.gif C:\WINDOWS\system32\skjlrsjp\left1.gif C:\WINDOWS\system32\skjlrsjp\li.gif C:\WINDOWS\system32\skjlrsjp\logo.gif C:\WINDOWS\system32\skjlrsjp\main.htm C:\WINDOWS\system32\skjlrsjp\mainframe.htm C:\WINDOWS\system32\skjlrsjp einstall1.gif C:\WINDOWS\system32\skjlrsjp ight1.gif C:\WINDOWS\system32\skjlrsjp\s1.htm C:\WINDOWS\system32\skjlrsjp\s2.htm C:\WINDOWS\system32\skjlrsjp\s3.htm C:\WINDOWS\system32\skjlrsjp\skjlrsjp1.exe C:\WINDOWS\system32\skjlrsjp\skjlrsjp2.exe C:\WINDOWS\system32\skjlrsjp\skjlrsjp3.exe C:\WINDOWS\system32\skjlrsjp\SMTop1.gif C:\WINDOWS\system32\skjlrsjp\SMTop2.gif C:\WINDOWS\system32\skjlrsjp\SMTop3.gif C:\WINDOWS\system32\skjlrsjp\SMTop4.gif C:\WINDOWS\system32\skjlrsjp\soft1_off.gif C:\WINDOWS\system32\skjlrsjp\soft1_off_ext.gif C:\WINDOWS\system32\skjlrsjp\soft1_on.gif C:\WINDOWS\system32\skjlrsjp\soft1_on_ext.gif C:\WINDOWS\system32\skjlrsjp\soft2_off.gif C:\WINDOWS\system32\skjlrsjp\soft2_off_ext.gif C:\WINDOWS\system32\skjlrsjp\soft2_on.gif C:\WINDOWS\system32\skjlrsjp\soft2_on_ext.gif C:\WINDOWS\system32\skjlrsjp\soft3_off.gif C:\WINDOWS\system32\skjlrsjp\soft3_off_ext.gif C:\WINDOWS\system32\skjlrsjp\soft3_on.gif C:\WINDOWS\system32\skjlrsjp\soft3_on_ext.gif C:\WINDOWS\system32\skjlrsjp\softbottom_off.gif C:\WINDOWS\system32\skjlrsjp\softbottom_on.gif C:\WINDOWS\system32\skjlrsjp\softleft_off.gif C:\WINDOWS\system32\skjlrsjp\softleft_on.gif C:\WINDOWS\system32\skjlrsjp op1.gif C:\WINDOWS\system32\skjlrsjp op2.gif C:\WINDOWS\system32\skjlrsjp urnoff1.gif C:\WINDOWS\system32\skjlrsjp urnon1.gif C:\WINDOWS\system32\stem~1 C:\WINDOWS\system32\stem~1\??stem\ D:\Documents and Settings\Programmes\MalwareAlarm D:\Documents and Settings\Programmes\MalwareAlarm\MalwareAlarm.lnk . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_DOMAINSERVICE -------\LEGACY_NTMLSVC -------\LEGACY_SYMAVC32 -------\DomainService -------\NtmlSvc -------\symavc32 ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-02 to 2007-12-02 )))))))))))))))))))))))))))))))))))) . 2007-12-02 15:04 . 2007-12-02 17:25 0 --a------ C:\$bootcln.sch 2007-12-02 14:21 . 2007-12-02 15:04 d-------- C:\Documents and Settings\TOM\Application Data\AVG7 2007-12-02 14:20 . 2007-12-02 14:20 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2007-12-02 14:20 . 2007-12-02 14:22 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2007-12-02 12:56 . 2007-12-02 12:56 793,664 ---hs---- C:\WINDOWS\system32\oonddnqx.ini 2007-12-02 12:55 . 2007-12-02 12:55 d-------- C:\Program Files\E404 Helper 2007-12-02 12:54 . 2007-12-02 14:18 d-------- C:\Program Files\MalwareAlarm 2007-12-02 12:54 . 2007-12-02 12:54 1,148,902 --a------ C:\Install 2007-12-02 12:17 . 2007-12-02 12:17 d-------- C:\Program Files\Oqpmgmjc 2007-12-02 11:59 . 2007-12-02 11:59 d-------- C:\Program Files\Avira 2007-12-02 11:59 . 2007-12-02 11:59 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-12-02 11:06 . 2007-10-25 17:24 815,480 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-12-02 11:06 . 2004-01-09 11:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx 2007-12-02 11:06 . 2007-10-25 17:14 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr 2007-12-02 11:06 . 2007-10-25 18:05 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-02 11:06 . 2007-10-25 18:05 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-02 11:06 . 2007-10-25 18:01 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-02 11:06 . 2007-10-25 17:58 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-02 11:06 . 2007-10-25 18:03 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-02 00:50 . 2007-12-02 00:50 d-------- C:\Program Files\Neuf 2007-12-01 13:48 . 2007-12-02 14:05 246,976 --ahs---- C:\WINDOWS\system32\llnmp.ini2 2007-12-01 13:46 . 2007-12-01 13:46 d-------- C:\Program Files\Sonic Foundry 2007-12-01 13:45 . 2007-12-01 13:45 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-12-01 13:45 . 2007-12-02 15:04 d-------- C:\Program Files\zsfizsji 2007-12-01 13:45 . 2007-12-01 13:45 d-------- C:\Program Files\Igefrkdb 2007-12-01 13:45 . 2007-12-02 11:06 d-------- C:\Program Files\Alwil Software 2007-12-01 13:45 . 2007-12-01 13:45 d-------- C:\Documents and Settings\TOM\Application Data\Jetico Personal Firewall 2007-12-01 13:44 . 2007-12-01 13:44 d-------- C:\WINDOWS view 2007-12-01 13:32 . 2007-12-01 13:44 d-------- C:\WINDOWS\NV33281784.TMP 2007-12-01 13:22 . 2007-12-01 13:36 d-------- C:\WINDOWS view(2) 2007-12-01 13:22 . 2007-12-02 16:40 63,804 --a------ C:\WINDOWS\system32 vapps.xml 2007-12-01 13:22 . 2006-06-01 10:22 16,960 --a------ C:\WINDOWS\system32 vdisp.nvu 2007-12-01 13:15 . 2007-12-01 13:45 d-------- C:\WINDOWS\NV38363840.TMP 2007-12-01 13:02 . 2007-12-01 13:45 d-------- C:\Program Files\Neuf(2) 2007-11-30 21:47 . 2007-11-30 21:47 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2007-11-30 21:47 . 2007-11-30 21:47 1,409 --a------ C:\WINDOWS\QTFont.for 2007-11-30 18:59 . 2007-11-30 18:59 d-------- C:\WINDOWS\ERUNT 2007-11-30 14:07 . 2007-12-01 13:46 d-------- C:\Program Files\Sonic Foundry(2) 2007-11-30 13:47 . 2007-11-30 13:47 d-------- C:\WINDOWS\system32\Kaspersky Lab(2) 2007-11-30 13:47 . 2007-11-30 13:47 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-11-30 13:02 . 2007-11-30 13:02 324,192 --a------ C:\WINDOWS\system32\pmnll.VIR 2007-11-30 12:40 . 2007-11-30 12:40 156,768 --a------ C:\WINDOWS\system32\accece0.sys 2007-11-30 12:40 . 2007-12-02 17:24 16,768 --a------ C:\WINDOWS\system32 cpip_patcher.sys 2007-11-30 12:39 . 2007-11-30 12:39 89,088 --a------ C:\WINDOWS\system32\crehcjid.dll 2007-11-20 23:08 . 2007-11-20 23:08 dr------- C:\Documents and Settings\Mes documents\Mes vid‚os 2007-11-17 18:00 . 2007-11-17 18:00 d-------- C:\Documents and Settings\TOM\Application Data\Media Player Classic 2007-11-17 17:34 . 2007-11-17 17:34 d-------- C:\Program Files\K-Lite Codec Pack 2007-11-17 17:12 . 2007-11-17 17:12 d-------- C:\Program Files\Okoker All Video Splitter 2007-11-17 17:12 . 2005-01-19 18:23 32,256 --a------ C:\WINDOWS\system32\AVSredirect.dll 2007-11-09 21:36 . 2007-11-09 21:36 d-------- C:\Documents and Settings\Mes documents\essai21 2007-11-09 13:02 . 2002-03-19 10:29 14,165 --------- C:\WINDOWS\system32\drivers\Pclepci.sys 2007-11-07 17:38 . 2007-11-07 17:38 d-------- C:\Program Files\Transcribe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-02 15:51 --------- d-----w C:\Documents and Settings\TOM\Application Data\Skype 2007-12-02 13:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2007-12-02 13:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-01 14:35 --------- d-----w C:\Program Files\RegClean 2007-12-01 12:44 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-11-30 22:34 --------- d-----w C:\Program Files\Creative 2007-11-30 18:58 --------- d-----w C:\Program Files\Java 2007-11-30 12:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-11-30 11:39 1,037,879 ----a-w C:\WINDOWS\explorer.exe 2007-11-28 20:23 304,160 ----a-w C:\StiImg.dat 2007-11-23 07:59 --------- d-----w C:\Documents and Settings\TOM\Application Data\OpenOffice.org2 2007-11-09 20:37 --------- d-----w C:\Documents and Settings\TOM\Application Data\Tracktion 3 2007-11-09 20:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Tracktion 3 2007-11-09 20:35 --------- d-----w C:\Program Files\Tracktion 3 2007-11-06 15:49 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLbz.DAT 2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT 2007-11-05 19:12 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT 2007-10-22 08:34 --------- d-----w C:\Program Files\Skype 2007-10-22 08:34 --------- d-----w C:\Program Files\Fichiers communs\Skype 2007-10-22 08:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-10-22 08:27 23,876,904 ----a-w C:\SkypeSetup.exe 2007-10-13 09:33 --------- d-----w C:\Documents and Settings\TOM\Application Data\dvdcss 2007-10-13 08:58 --------- d-----w C:\Documents and Settings\TOM\Application Data\NetMedia Providers 2007-10-13 08:56 --------- d-----w C:\Program Files\Vstplugins 2007-10-13 08:55 --------- d-----w C:\Program Files\Sony 2007-10-12 15:59 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2007-10-10 09:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe Systems 2007-10-10 09:14 --------- d-----w C:\Program Files\Fichiers communs\Adobe Systems Shared 2007-10-09 21:33 32 ----a-w C:\Program Files\log.txt 2007-10-09 21:26 --------- d-----w C:\Program Files\Calendrier 2007-10-09 21:26 --------- d-----w C:\Documents and Settings\TOM\Application Data\Calendrier Xtra 2007-10-08 11:07 --------- d-----w C:\Program Files\Fichiers communs\Vbox 2007-10-07 11:10 --------- d-----w C:\Program Files\Google 2007-10-07 11:07 --------- d-----w C:\Program Files\WinISO 2007-10-07 11:03 2,628,296 ----a-w C:\Program Files\ccsetup201.exe 2007-10-03 09:36 --------- d-----w C:\Program Files\Sonic Foundry Setup 2007-09-22 14:11 48,237,752 ----a-w C:\SetupDroppixRecorder2(2).exe 2007-07-01 14:07 12,759,940 ----a-w C:\Program Files\cnx11_fr.exe 2007-06-30 15:26 12,413,440 ------w C:\Program Files\avgas-setup-7.5.1.43.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ac44e0f5-5561-4b1e-9dfc-4a9fd5c3bcfb}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F94F1E83-A670-488A-AB17-D14B12C684A2}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-30 15:58] "RemoteCenter"="C:\Program Files\Creative\MediaSource\RemoteControl\RCMan.EXE" [2004-06-25 09:21] "Cld2000.exe"="C:\Program Files\Calendrier\Cld2000.exe" [2007-10-03 16:22] "Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 12:31] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 23:22] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2007-09-13 15:55] "RTHDCPL"="RTHDCPL.EXE" [2006-04-04 10:44 C:\WINDOWS\RTHDCPL.exe] "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-03-28 14:21] "NvCplDaemon"="RUNDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32 undll32.exe] "nwiz"="nwiz.exe" [] "NvMediaCenter"="RunDLL32.exe" [2004-08-19 15:10 C:\WINDOWS\system32 undll32.exe] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 17:20] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-02 12:13] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-02 14:20] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-02 14:20] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegedit"= 0 (0x0) "NoFind"= 0 (0x0) "NoRun"= 0 (0x0) "NoDesktop"= 0 (0x0) "NoClose"= 0 (0x0) "StartMenuLogOff"= 0 (0x0) "HideClock"= 0 (0x0) "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\crehcjid] crehcjid.dll 2007-11-30 12:39 89088 C:\WINDOWS\system32\crehcjid.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\cyzrdghf] cyzrdghf.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon otify\yaywwxv] yaywwxv.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] 2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series] 2003-03-28 14:21 57344 --a------ C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] 2007-06-30 15:58 68856 --a------ C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe -osboot R3 PAC207;Trust WB-1400T Webcam;C:\WINDOWS\system32\DRIVERS\pfc027.sys R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys S1 bcbus;BestCrypt bus driver;C:\WINDOWS\system32\DRIVERS\bcbus.sys S3 DPFilter;USB Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DPFilter.sys S3 Droppix Service;Droppix Service;"C:\Program Files\Fichiers communs\Droppix\DxService.exe" S3 KBNTXP;Standard PS/2 Multi-Keyboard Filter Driver for WinXp;C:\WINDOWS\system32\DRIVERS\KBNTXP.sys S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Fichiers communs\LightScribe\LSRunOnce.exe" . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-02 17:25:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services cpip_patcher] "ImagePath"="\??\C:\WINDOWS\system32 cpip_patcher.sys" . Completion time: 2007-12-02 17:27:00 - machine was rebooted C:\ComboFix2.txt ... 2007-11-30 18:20 C:\ComboFix3.txt ... 2007-11-30 18:05 . --- E O F --- McAfee® Stinger Version 3.8.0 built on Sep 10 2007 Copyright © 2007 McAfee, Inc. All Rights Reserved. Virus data file v1000 created on Sep 10 2007. Ready to scan for 191 viruses, trojans and variants. Scan initiated on Sun Dec 02 16:50:29 2007 Number of clean files: 411135 McAfee® Stinger Version 3.8.0 built on Sep 10 2007 Copyright © 2007 McAfee, Inc. All Rights Reserved. Virus data file v1000 created on Sep 10 2007. Ready to scan for 191 viruses, trojans and variants. Scan initiated on Sun Dec 02 16:50:29 2007 Number of clean files: 411135

g!rly · Answer

re,

desinstal completement avast et avg.

Désinstalleur Avast:
https://www.avast.com/fr-fr/uninstall-utility

instal un par feu :

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

Copie le texte ci-dessous :

File::
C:\$bootcln.sch
C:\WINDOWS\system32\oonddnqx.ini
C:\Install
C:\WINDOWS\system32\pmnll.VIR
C:\WINDOWS\system32\crehcjid.dll
C:\WINDOWS\system32	cpip_patcher.sys
C:\WINDOWS\system32\accece0.sys
C:\WINDOWS\system32\cyzrdghf.dll
C:\WINDOWS\system32\yaywwxv.dll
C:\WINDOWS\system32\winkve32.dll
C:\Program Files\zsfizsji\huhqlmds.dll
C:\WINDOWS\avp.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\xpupdate.exe
C:\WINDOWS\system32\cyzrdghf.dll
C:\WINDOWS\system32\dcuneykg.exe
C:\WINDOWS\system32\drvtod.dll
C:\WINDOWS\system32\dcuneykg.exe
C:\WINDOWS\system32\pmnll.dll
C:\WINDOWS\system32\xqnddnoo.dll
C:\WINDOWS\system32\__c00D2AAA.dat
C:\WINDOWS\Temp\64server.exe
C:\WINDOWS\Temp\hostpower.exe
C:\WINDOWS\Temp\monpower.exe
C:\WINDOWS\Temp\powermon.exe
C:\WINDOWS\Temp\syssv.exe
C:\WINDOWS\Temp\win20.exe
C:\WINDOWS\Temp\win34.exe


Folder::
C:\Program Files\E404 Helper
C:\Program Files\MalwareAlarm
C:\Program Files\Oqpmgmjc
C:\Program Files\zsfizsji
C:\Program Files\Igefrkdb

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ac44e0f5-5561-4b1e-9dfc-4a9fd5c3bcfb}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F94F1E83-A670-488A-AB17-D14B12C684A2}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\crehcjid]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\cyzrdghf]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon
otify\yaywwxv]
[-HKEY_LOCAL_MACHINE\system\ControlSet001\Services	cpip_patcher]

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, 

S'il n'y a pas de rédémarrage continue

Télécharge Zeb-Restore http://telechargement.zebulon.fr/zeb-restore.html enregistre ce fichier sur le bureau.

-Clic droit Zeb-Restore.zip ==> Extraire tout choisis comme lieu d'enregistrement le bureau.
-Ouvre le dossier ZR_1.0.0.37 ==> double clic sur Zeb-Restore.exe
- Coche la case devant :

Sites de confiance et sensibles
Réinitialiser Fichier Hosts
Préfixes et Protocoles Internet

- Ne coche aucune autre case
-Clique sur Restaurer
-Redémarre ton PC 

(donc apres redemarrage tu reredemarre en mode sans echec avec prise en service du résau)

1) Redémarre le PC, impérativement en Mode sans échec avec prise en charge du réseau.
Au redémarrage de l'ordinateur, une fois le chargement du BIOS terminé, il y a un écran noir qui apparaît rapidement > Tapote par alternance les touches [F8] et [F5] jusqu'à l'affichage du menu des options avancées de Windows.
Sélectionne "Mode sans échec avec prise en charge du réseau" et appuie sur la touche [Entrée].
Choisis ton compte usuel, et non Administrateur. En image ici (il s'agit du second choix) > http://cybersecurite.xooit.com/t88-Demarre...-sans-echec.htm

2) Télécharge Dr.Web CureIt sur ton Bureau:
Rend toi sur cette page afin de télécharger le fichier CureIt.exe> ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe
# Double clique sur le fichier drweb-cureit.exe et ensuite clique sur commencer le scan.
# Clique Ok à l'invite de l'analyse rapide. Ce scan permet l'analyse des processus chargés en mémoire ; s'il trouve des processus infectés, clique le bouton Oui pour tout à l'invite.
**Note : une fenêtre s'ouvrira avec options pour "Commander" ou "50% de réduction" ; clique sur le "X" pour fermer la fenêtre
# Lorsque le scan rapide est terminé, Clique sur le menu Options >> Changer la configuration;
# Choisis l'onglet "Scanner", et décoche "Analyse heuristique". Clique sur "Ok"
# De retour à la fenêtre principale : clique sur le bouton radio "Analyse complète".
# Clique sur la flèche verte sur la droite, et le scan débutera.
# Clique Oui pour tout à l'invite "Désinfecter ?" lorsqu'un fichier est détecté, et ensuite clique sur "Désinfecter".
# Lorsque le scan sera complété, regarde si tu peux cliquer sur cette icône, adjacente aux fichiers détectés : < inclued picture >
# Si oui, alors clique dessus et ensuite clique sur l'icône "Suivant", au dessous, et choisis Déplacer en quarantaine l'objet indésirable
# Du menu principal de l'outil, au haut à gauche, clique sur le menu Fichier et choisis Enregistrer le rapport
# Sauvegarde le rapport sur ton Bureau. Ce dernier se nommera DrWeb.csv
# Ferme Dr.Web Cureit
# Redémarre ton ordi (*très important*), car certains fichiers peuvent être déplacés/réparés au redémarrage.
# Suite au redémarrage, poste (Copie/Colle) le contenu du rapport de l'outil Dr.Web dans ta prochaine réponse.

poste aussi le contenu du rapport Combofix.txt4

bon courrage

@+

TOMSNOW · Answer

Ok chef a tout de suite merci

PC infecte par cheval de troie

51 réponses

Votre réponse

Newsletters