virus TR/Trash.Gen trouvé par antivir Résolu

Question

Bonjour,
j'ai antivir comme antivirus qui m'alerte a chaque page que j'ouvre que je suis atteint d'un virus.
Je mets un log de hijackthis pour celui qui veut bien m'aider. Merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:54:11, on 07/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

jfkpresident · Answer

salut,
fais un scan avec bitdefender:http://www.bitdefender.fr/scan_fr/scan8/ie.html

g!rly · Answer

ca va pas suffir...

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

pancho13 · Answer

ok merci de me repondre c'est gentil.
je te post le rapport dans une 15aine de minute.

jfkpresident · Answer

ca va pas suffir=====>AH bON????

pancho13 · Answer

re, ecoute sur bitdefender n'a rien trouvé.
ensuite combofix voila le rapport

ComboFix 07-12-07.3 - maison 2007-12-07 21:18:42.8 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.211 [GMT 1:00]
Running from: C:\Documents and Settings\maison\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 11:58 . 2007-12-07 11:58 <REP> d-------- C:\WINDOWS\AU_Temp
2007-12-07 11:57 . 2007-12-07 11:57 <REP> d-------- C:\WINDOWS\report
2007-12-07 11:57 . 2007-12-07 11:56 39,917,509 --a------ C:\WINDOWS\LPT$VPN.869
2007-12-07 11:11 . 2007-12-07 11:33 <REP> d-------- C:\Program Files\a-squared Free
2007-12-07 01:22 . 2007-12-07 01:22 <REP> d--h----- C:\WINDOWS\PIF
2007-12-07 00:48 . 2007-12-07 00:48 <REP> d-------- C:\WINDOWS\ERUNT
2007-12-06 23:17 . 2007-12-06 23:17 1,678 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-06 22:15 . 2007-12-06 22:18 325 --a------ C:\WINDOWS\KillProcess.INI
2007-12-06 18:30 . 2007-12-02 18:48 1,500 --a------ C:\WINDOWS\system32\Copie de tmp.reg
2007-12-06 17:39 . 2007-12-06 18:06 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-12-06 16:50 . 2007-12-07 20:59 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-12-06 16:14 . 2007-12-06 16:14 <REP> d-------- C:\Program Files\CCleaner
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Lavasoft
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-02 23:07 . 2007-12-02 23:07 <REP> d-------- C:\VundoFix Backups
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Program Files\Avira
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-02 20:04 . 2007-12-02 20:04 <REP> d-------- C:\Documents and Settings\maison\Application Data\Grisoft
2007-12-02 20:04 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-02 20:01 . 2007-12-02 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-02 19:22 . 2007-12-02 19:25 <REP> d-------- C:\Program Files\RogueRemover FREE
2007-12-01 11:17 . 2007-12-01 11:17 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-11-30 14:40 . 2007-11-30 14:40 144 --ahs---- C:\WINDOWS\system32\1549314879.dat

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 19:24 --------- d-----w C:\Program Files\Wanadoo
2007-12-07 13:44 --------- d-----w C:\Program Files\Shareaza
2007-12-07 10:58 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-12-07 10:58 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-12-07 10:56 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-12-07 10:56 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-12-07 10:56 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-12-07 10:56 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-12-07 10:56 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-12-06 20:59 3,310 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat
2007-12-06 17:05 --------- d-----w C:\Program Files\Navilog1
2007-12-02 18:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-10-17 04:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-10-16 20:55 81,408 ----a-w C:\WINDOWS\system32\aadcaad.dll
2007-10-14 18:16 --------- d-----w C:\Program Files\Trend Micro
2007-10-14 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-14 06:41 17,792 ----a-w C:\WINDOWS\system32\drivers\miqvzwcl.dat
2007-10-12 17:07 --------- d-----w C:\Program Files\Fichiers communs\G DATA
2007-10-12 16:50 --------- d-----w C:\Documents and Settings\maison\Application Data\Lavasoft
2007-10-05 23:24 52,602 ----a-w C:\WINDOWS\system32\interceptor.sys
2007-10-03 22:36 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
.

((((((((((((((((((((((((((((( snapshot_2007-12-07_11.36.49,75 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-11-09 19:05:12 86,094 ----a-w C:\WINDOWS\AU_Temp\2\4\BPMNT.dll
+ 2007-06-12 17:49:28 1,163,344 ----a-w C:\WINDOWS\AU_Temp\2\4\vsapi32.dll
+ 1999-07-23 09:53:20 129,536 ----a-w C:\WINDOWS\AuHCcup1.dll
- 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2007-12-07 10:38:49 77,824 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2002-10-15 13:29:40 77,824 ----a-w C:\WINDOWS\loadhttp.dll
+ 2001-12-14 12:34:46 164,864 ----a-w C:\WINDOWS\patchw32.dll
+ 2005-11-02 17:07:12 99,328 ----a-w C:\WINDOWS\runtsckl.exe
+ 2007-10-11 13:12:48 1,468,968 ------w C:\WINDOWS\system32\LegitCheckControl.dll
- 2005-10-12 23:15:25 15,072 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-10-08 13:46:18 14,640 ------w C:\WINDOWS\system32\spmsg.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}]
2007-10-16 21:55 81408 --a------ c:\windows\system32\aadcaad.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 15:33]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-03 21:16]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-02 11:25]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 C:\WINDOWS\RTHDCPL.EXE]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 10:54]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55]
"M1000Mnt"="M1000Rmv.exe" []
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 10:45]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
UpdateWin REG_SZ C:\WINDOWS\System32\1033v.exe

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys
R0 nvrfhgrt;Microsoft RPC API Helper;C:\WINDOWS\System32\drivers\miqvzwcl.dat
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys
R3 MarkFun_NT;MarkFun_NT;\??\C:\Program Files\Gigabyte\ET5\markfun.w32
S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys
S3 M1000Srv;M5603C USB2.0 Camera Driver;C:\WINDOWS\System32\Drivers\M1000KNT.sys

.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 21:19:34
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 21:20:01
C:\ComboFix2.txt ... 2007-12-07 12:27
C:\ComboFix3.txt ... 2007-12-07 11:37
.
--- E O F ---

pancho13 · Answer

alors c'est grave docteur ?

g!rly · Answer

re,

Copie le texte ci-dessous :

File::
C:\WINDOWS\AU_Temp 
C:\WINDOWSeport
C:\WINDOWS\KillProcess.INI
C:\WINDOWS\system32	mp.reg
C:\windows\system32\aadcaad.dll
C:\WINDOWS\System32\1033v.exe
C:\WINDOWS\PIF

Folder::
C:\Program Files\RogueRemover FREE


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
UpdateWin"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+

jfkpresident · Answer

faut demander ca a girly====>c'est elle qui a demandé un combofix

pancho13 · Answer

jfk a toi je te demande aussi si tu peux m'aider je souhaite pas mieux.

g!rly · Answer

re,

j´ai repondu au post 7

en matiere d´infection tout est grave...

@+

pancho13 · Answer

re g!rly,
voila le rapport de combofix apres manip precedente

ComboFix 07-12-07.3 - maison 2007-12-07 21:44:08.9 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.210 [GMT 1:00]
Running from: C:\Documents and Settings\maison\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt..txt
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 11:58 . 2007-12-07 11:58 <REP> d-------- C:\WINDOWS\AU_Temp
2007-12-07 11:57 . 2007-12-07 11:57 <REP> d-------- C:\WINDOWS\report
2007-12-07 11:57 . 2007-12-07 11:56 39,917,509 --a------ C:\WINDOWS\LPT$VPN.869
2007-12-07 11:11 . 2007-12-07 11:33 <REP> d-------- C:\Program Files\a-squared Free
2007-12-07 01:22 . 2007-12-07 01:22 <REP> d--h----- C:\WINDOWS\PIF
2007-12-07 00:48 . 2007-12-07 00:48 <REP> d-------- C:\WINDOWS\ERUNT
2007-12-06 23:17 . 2007-12-06 23:17 1,678 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-06 22:15 . 2007-12-06 22:18 325 --a------ C:\WINDOWS\KillProcess.INI
2007-12-06 18:30 . 2007-12-02 18:48 1,500 --a------ C:\WINDOWS\system32\Copie de tmp.reg
2007-12-06 17:39 . 2007-12-06 18:06 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-12-06 16:50 . 2007-12-07 20:59 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-12-06 16:14 . 2007-12-06 16:14 <REP> d-------- C:\Program Files\CCleaner
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Lavasoft
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-02 23:07 . 2007-12-02 23:07 <REP> d-------- C:\VundoFix Backups
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Program Files\Avira
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-02 20:04 . 2007-12-02 20:04 <REP> d-------- C:\Documents and Settings\maison\Application Data\Grisoft
2007-12-02 20:04 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-02 20:01 . 2007-12-02 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-02 19:22 . 2007-12-02 19:25 <REP> d-------- C:\Program Files\RogueRemover FREE
2007-12-01 11:17 . 2007-12-01 11:17 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-11-30 14:40 . 2007-11-30 14:40 144 --ahs---- C:\WINDOWS\system32\1549314879.dat

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 19:24 --------- d-----w C:\Program Files\Wanadoo
2007-12-07 13:44 --------- d-----w C:\Program Files\Shareaza
2007-12-07 10:58 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-12-07 10:58 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-12-07 10:56 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-12-07 10:56 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-12-07 10:56 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-12-07 10:56 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-12-07 10:56 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-12-06 20:59 3,310 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat
2007-12-06 17:05 --------- d-----w C:\Program Files\Navilog1
2007-12-02 18:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-10-17 04:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-10-16 20:55 81,408 ----a-w C:\WINDOWS\system32\aadcaad.dll
2007-10-14 18:16 --------- d-----w C:\Program Files\Trend Micro
2007-10-14 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-14 06:41 17,792 ----a-w C:\WINDOWS\system32\drivers\miqvzwcl.dat
2007-10-12 17:07 --------- d-----w C:\Program Files\Fichiers communs\G DATA
2007-10-12 16:50 --------- d-----w C:\Documents and Settings\maison\Application Data\Lavasoft
2007-10-05 23:24 52,602 ----a-w C:\WINDOWS\system32\interceptor.sys
2007-10-03 22:36 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
.

((((((((((((((((((((((((((((( snapshot_2007-12-07_11.36.49,75 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-11-09 19:05:12 86,094 ----a-w C:\WINDOWS\AU_Temp\2\4\BPMNT.dll
+ 2007-06-12 17:49:28 1,163,344 ----a-w C:\WINDOWS\AU_Temp\2\4\vsapi32.dll
+ 1999-07-23 09:53:20 129,536 ----a-w C:\WINDOWS\AuHCcup1.dll
- 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2007-12-07 10:38:49 77,824 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2002-10-15 13:29:40 77,824 ----a-w C:\WINDOWS\loadhttp.dll
+ 2001-12-14 12:34:46 164,864 ----a-w C:\WINDOWS\patchw32.dll
+ 2005-11-02 17:07:12 99,328 ----a-w C:\WINDOWS\runtsckl.exe
+ 2007-10-11 13:12:48 1,468,968 ------w C:\WINDOWS\system32\LegitCheckControl.dll
- 2005-10-12 23:15:25 15,072 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-10-08 13:46:18 14,640 ------w C:\WINDOWS\system32\spmsg.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}]
2007-10-16 21:55 81408 --a------ c:\windows\system32\aadcaad.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 15:33]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-03 21:16]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-02 11:25]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 C:\WINDOWS\RTHDCPL.EXE]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 10:54]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55]
"M1000Mnt"="M1000Rmv.exe" []
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 10:45]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
UpdateWin REG_SZ C:\WINDOWS\System32\1033v.exe

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys
R0 nvrfhgrt;Microsoft RPC API Helper;C:\WINDOWS\System32\drivers\miqvzwcl.dat
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys
R3 MarkFun_NT;MarkFun_NT;\??\C:\Program Files\Gigabyte\ET5\markfun.w32
S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys
S3 M1000Srv;M5603C USB2.0 Camera Driver;C:\WINDOWS\System32\Drivers\M1000KNT.sys

.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 21:44:41
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 21:45:05
C:\ComboFix2.txt ... 2007-12-07 21:20
C:\ComboFix3.txt ... 2007-12-07 12:27
.
--- E O F ---
et voila le rapport de hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:46:59, on 07/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

jfkpresident · Answer

fais ce que te dit girly elle est mieux placé que moi
je suivrai le post quand meme

pancho13 · Answer

ok merci a vous deux

g!rly · Answer

re,

post le combofix2.txt

pancho13 · Answer

dsl je n'ai pas compris ?

g!rly · Answer

tu as posté le meme rapport de combofix qu´au debut
alors regarde dans le dossier il doit avoir un autre rapport combofix2.txt

pancho13 · Answer

j'ai regardé il n'ya que celui la c'est le meme les deux que j'ai.

g!rly · Answer

supprrime tout les rapports qu´il y a dans le fichier combofix et recommence

Copie le texte ci-dessous :

File::
C:\WINDOWS\AU_Temp
C:\WINDOWSeport
C:\WINDOWS\KillProcess.INI
C:\WINDOWS\system32	mp.reg
C:\windows\system32\aadcaad.dll
C:\WINDOWS\System32\1033v.exe
C:\WINDOWS\PIF

Folder::
C:\Program Files\RogueRemover FREE


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
UpdateWin"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"=-
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"=0
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+

Julien06 · Answer

ComboFix 07-12-07.3 - maison 2007-12-07 22:31:51.10 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.137 [GMT 1:00]
Running from: C:\Documents and Settings\maison\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((( Fichiers créés 2007-11-07 to 2007-12-07 ))))))))))))))))))))))))))))))))))))
.

2007-12-07 22:24 . 2007-12-07 22:24 <REP> d-------- C:\WINDOWS\AU_Temp
2007-12-07 22:11 . 2007-12-07 22:11 <REP> d-------- C:\Program Files\Panda Security
2007-12-07 11:57 . 2007-12-07 11:57 <REP> d-------- C:\WINDOWS\report
2007-12-07 11:57 . 2007-12-07 11:56 39,917,509 --a------ C:\WINDOWS\LPT$VPN.869
2007-12-07 11:11 . 2007-12-07 11:33 <REP> d-------- C:\Program Files\a-squared Free
2007-12-07 01:22 . 2007-12-07 01:22 <REP> d--h----- C:\WINDOWS\PIF
2007-12-07 00:48 . 2007-12-07 00:48 <REP> d-------- C:\WINDOWS\ERUNT
2007-12-06 23:17 . 2007-12-06 23:17 1,678 --a------ C:\WINDOWS\system32\tmp.reg
2007-12-06 22:15 . 2007-12-06 22:18 325 --a------ C:\WINDOWS\KillProcess.INI
2007-12-06 18:30 . 2007-12-02 18:48 1,500 --a------ C:\WINDOWS\system32\Copie de tmp.reg
2007-12-06 17:39 . 2007-12-06 18:06 <REP> d-------- C:\Program Files\a-squared Anti-Malware
2007-12-06 16:50 . 2007-12-07 20:59 <REP> d-------- C:\WINDOWS\BDOSCAN8
2007-12-06 16:14 . 2007-12-06 16:14 <REP> d-------- C:\Program Files\CCleaner
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Lavasoft
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
2007-12-06 11:16 . 2007-12-06 11:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-02 23:07 . 2007-12-02 23:07 <REP> d-------- C:\VundoFix Backups
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Program Files\Avira
2007-12-02 21:15 . 2007-12-02 21:15 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2007-12-02 20:04 . 2007-12-02 20:04 <REP> d-------- C:\Documents and Settings\maison\Application Data\Grisoft
2007-12-02 20:04 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-02 20:01 . 2007-12-02 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-02 19:22 . 2007-12-02 19:25 <REP> d-------- C:\Program Files\RogueRemover FREE
2007-12-01 11:17 . 2007-12-01 11:17 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2007-11-30 14:40 . 2007-11-30 14:40 144 --ahs---- C:\WINDOWS\system32\1549314879.dat

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-07 21:24 86,094 ----a-w C:\WINDOWS\BPMNT.dll
2007-12-07 21:24 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll
2007-12-07 19:24 --------- d-----w C:\Program Files\Wanadoo
2007-12-07 13:44 --------- d-----w C:\Program Files\Shareaza
2007-12-07 10:56 71,749 ----a-w C:\WINDOWS\hcextoutput.dll
2007-12-07 10:56 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-12-07 10:56 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-12-07 10:56 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-12-07 10:56 267,845 ----a-w C:\WINDOWS\tsc.exe
2007-12-06 20:59 3,310 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat
2007-12-06 17:05 --------- d-----w C:\Program Files\Navilog1
2007-12-02 18:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-10-17 04:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2007-10-16 20:55 81,408 ----a-w C:\WINDOWS\system32\aadcaad.dll
2007-10-14 18:16 --------- d-----w C:\Program Files\Trend Micro
2007-10-14 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-10-14 06:41 17,792 ----a-w C:\WINDOWS\system32\drivers\miqvzwcl.dat
2007-10-12 17:07 --------- d-----w C:\Program Files\Fichiers communs\G DATA
2007-10-12 16:50 --------- d-----w C:\Documents and Settings\maison\Application Data\Lavasoft
2007-10-05 23:24 52,602 ----a-w C:\WINDOWS\system32\interceptor.sys
2007-10-03 22:36 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
.

((((((((((((((((((((((((((((( snapshot_2007-12-07_11.36.49,75 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-11-09 19:05:12 86,094 ----a-w C:\WINDOWS\AU_Temp\2\4\BPMNT.dll
+ 2007-06-12 17:49:28 1,163,344 ----a-w C:\WINDOWS\AU_Temp\2\4\vsapi32.dll
+ 1999-07-23 09:53:20 129,536 ----a-w C:\WINDOWS\AuHCcup1.dll
- 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2007-12-07 10:38:49 77,824 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2007-09-11 12:49:24 12,592 ----a-w C:\WINDOWS\Downloaded Program Files\LibComm.dll
+ 2007-09-11 12:49:28 38,280 ----a-w C:\WINDOWS\Downloaded Program Files\NanoInst.dll
+ 2007-09-11 12:49:30 43,824 ----a-w C:\WINDOWS\Downloaded Program Files\PSComm.dll
+ 2007-09-11 12:49:34 100,656 ----a-w C:\WINDOWS\Downloaded Program Files\PSNAdbrk.dll
+ 2002-10-15 13:29:40 77,824 ----a-w C:\WINDOWS\loadhttp.dll
+ 2001-12-14 12:34:46 164,864 ----a-w C:\WINDOWS\patchw32.dll
+ 2005-11-02 17:07:12 99,328 ----a-w C:\WINDOWS\runtsckl.exe
+ 2007-10-11 13:12:48 1,468,968 ------w C:\WINDOWS\system32\LegitCheckControl.dll
- 2005-10-12 23:15:25 15,072 ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-10-08 13:46:18 14,640 ------w C:\WINDOWS\system32\spmsg.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}]
2007-10-16 21:55 81408 --a------ c:\windows\system32\aadcaad.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 15:33]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-03 21:16]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-09-02 11:25]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe]
"RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 C:\WINDOWS\RTHDCPL.EXE]
"EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 10:54]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55]
"M1000Mnt"="M1000Rmv.exe" []
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"UpdateWin"="C:\WINDOWS\System32\1033v.exe" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 10:45]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoWindowsUpdate"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
UpdateWin REG_SZ C:\WINDOWS\System32\1033v.exe

R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys
R0 nvrfhgrt;Microsoft RPC API Helper;C:\WINDOWS\System32\drivers\miqvzwcl.dat
R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys
R3 MarkFun_NT;MarkFun_NT;\??\C:\Program Files\Gigabyte\ET5\markfun.w32
S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys
S3 M1000Srv;M5603C USB2.0 Camera Driver;C:\WINDOWS\System32\Drivers\M1000KNT.sys

.
**************************************************************************

catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-07 22:33:15
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-07 22:34:10
.
--- E O F ---

et hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:36:08, on 07/12/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\a-squared Free\a2service.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Gigabyte\ET5\GUI.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {91AD9DC2-523A-47E2-A598-6C277F16CC50} - c:\windows\system32\aadcaad.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [M1000Mnt] M1000Rmv.exe /StartStillMnt
O4 - HKLM\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKLM\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKCU\..\RunServices: [UpdateWin] C:\WINDOWS\System32\1033v.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.real.com/02084dfa22d225efae05/netzip/RdxIE601_fr.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe

g!rly · Answer

re,

une question tu es julien 06 qui est sur l´autre topik avec jlpjlp?

Julien06 · Answer

oui j'ai creer daux post et je repond sur les deux en fait plus un vieux post avec lyonnais 92... rapport combofix en esperant que c'est ça. ComboFix 07-12-07.3 - maison 2007-12-07 22:46:57.11 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.1.1252.1.1036.18.159 [GMT 1:00] Running from: C:\Documents and Settings\maison\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\maison\Bureau\CFScript.txt..txt * Created a new restore point FILE C:\WINDOWS\AU_Temp C:\WINDOWS\KillProcess.INI C:\WINDOWS\PIF C:\WINDOWS eport C:\WINDOWS\System32\1033v.exe C:\windows\system32\aadcaad.dll C:\WINDOWS\system32 mp.reg . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\RogueRemover FREE C:\Program Files\RogueRemover FREE\COMCTL32.OCX C:\Program Files\RogueRemover FREE\Excludes.dat C:\Program Files\RogueRemover FREE\License.txt C:\Program Files\RogueRemover FREE\manual.chm C:\Program Files\RogueRemover FREE\RogueRemover.dll C:\Program Files\RogueRemover FREE\RogueRemover.exe C:\Program Files\RogueRemover FREE ules.dat C:\Program Files\RogueRemover FREE\unins000.dat C:\Program Files\RogueRemover FREE\unins000.exe C:\Program Files\RogueRemover FREE\zlib.dll C:\WINDOWS\KillProcess.INI C:\WINDOWS\system32 mp.reg C:\windows\system32\aadcaad.dll . . . . Echec de suppression . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-11-07 to 2007-12-07 )))))))))))))))))))))))))))))))))))) . 2007-12-07 22:24 . 2007-12-07 22:24 d-------- C:\WINDOWS\AU_Temp 2007-12-07 22:11 . 2007-12-07 22:11 d-------- C:\Program Files\Panda Security 2007-12-07 11:57 . 2007-12-07 11:57 d-------- C:\WINDOWS eport 2007-12-07 11:57 . 2007-12-07 11:56 39,917,509 --a------ C:\WINDOWS\LPT$VPN.869 2007-12-07 11:11 . 2007-12-07 11:33 d-------- C:\Program Files\a-squared Free 2007-12-07 01:22 . 2007-12-07 01:22 d--h----- C:\WINDOWS\PIF 2007-12-07 00:48 . 2007-12-07 00:48 d-------- C:\WINDOWS\ERUNT 2007-12-06 18:30 . 2007-12-02 18:48 1,500 --a------ C:\WINDOWS\system32\Copie de tmp.reg 2007-12-06 17:39 . 2007-12-06 18:06 d-------- C:\Program Files\a-squared Anti-Malware 2007-12-06 16:50 . 2007-12-07 20:59 d-------- C:\WINDOWS\BDOSCAN8 2007-12-06 16:14 . 2007-12-06 16:14 d-------- C:\Program Files\CCleaner 2007-12-06 11:16 . 2007-12-06 11:16 d-------- C:\Program Files\Lavasoft 2007-12-06 11:16 . 2007-12-06 11:16 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2007-12-06 11:16 . 2007-12-06 11:16 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-12-02 23:07 . 2007-12-02 23:07 d-------- C:\VundoFix Backups 2007-12-02 21:15 . 2007-12-02 21:15 d-------- C:\Program Files\Avira 2007-12-02 21:15 . 2007-12-02 21:15 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2007-12-02 20:04 . 2007-12-02 20:04 d-------- C:\Documents and Settings\maison\Application Data\Grisoft 2007-12-02 20:04 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-12-02 20:01 . 2007-12-02 20:24 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2007-12-01 11:17 . 2007-12-01 11:17 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe 2007-11-30 14:40 . 2007-11-30 14:40 144 --ahs---- C:\WINDOWS\system32\1549314879.dat . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-07 21:50 --------- d-----w C:\Program Files\Wanadoo 2007-12-07 21:24 86,094 ----a-w C:\WINDOWS\BPMNT.dll 2007-12-07 21:24 1,163,344 ----a-w C:\WINDOWS\vsapi32.dll 2007-12-07 13:44 --------- d-----w C:\Program Files\Shareaza 2007-12-07 10:56 71,749 ----a-w C:\WINDOWS\hcextoutput.dll 2007-12-07 10:56 69,689 ----a-w C:\WINDOWS\UNZIP.DLL 2007-12-07 10:56 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL 2007-12-07 10:56 286,720 ----a-w C:\WINDOWS\PATCH.EXE 2007-12-07 10:56 267,845 ----a-w C:\WINDOWS sc.exe 2007-12-06 20:59 3,310 ----a-w C:\Documents and Settings\maison\Application Data\wklnhst.dat 2007-12-06 17:05 --------- d-----w C:\Program Files\Navilog1 2007-12-02 18:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip 2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe 2007-10-17 04:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier 2007-10-14 18:16 --------- d-----w C:\Program Files\Trend Micro 2007-10-14 17:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-10-14 06:41 17,792 ----a-w C:\WINDOWS\system32\drivers\miqvzwcl.dat 2007-10-12 17:07 --------- d-----w C:\Program Files\Fichiers communs\G DATA 2007-10-12 16:50 --------- d-----w C:\Documents and Settings\maison\Application Data\Lavasoft . ((((((((((((((((((((((((((((( snapshot_2007-12-07_11.36.49,75 ))))))))))))))))))))))))))))))))))))))))) . + 2005-11-09 19:05:12 86,094 ----a-w C:\WINDOWS\AU_Temp\2\4\BPMNT.dll + 2007-06-12 17:49:28 1,163,344 ----a-w C:\WINDOWS\AU_Temp\2\4\vsapi32.dll + 1999-07-23 09:53:20 129,536 ----a-w C:\WINDOWS\AuHCcup1.dll - 2007-10-25 09:26:48 118,784 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll + 2007-12-07 10:38:49 77,824 ----a-w C:\WINDOWS\BDOSCAN8\bdupd.dll + 2007-09-11 12:49:24 12,592 ----a-w C:\WINDOWS\Downloaded Program Files\LibComm.dll + 2007-09-11 12:49:28 38,280 ----a-w C:\WINDOWS\Downloaded Program Files\NanoInst.dll + 2007-09-11 12:49:30 43,824 ----a-w C:\WINDOWS\Downloaded Program Files\PSComm.dll + 2007-09-11 12:49:34 100,656 ----a-w C:\WINDOWS\Downloaded Program Files\PSNAdbrk.dll + 2002-10-15 13:29:40 77,824 ----a-w C:\WINDOWS\loadhttp.dll + 2001-12-14 12:34:46 164,864 ----a-w C:\WINDOWS\patchw32.dll + 2005-11-02 17:07:12 99,328 ----a-w C:\WINDOWS untsckl.exe + 2007-10-11 13:12:48 1,468,968 ------w C:\WINDOWS\system32\LegitCheckControl.dll - 2005-10-12 23:15:25 15,072 ------w C:\WINDOWS\system32\spmsg.dll + 2007-10-08 13:46:18 14,640 ------w C:\WINDOWS\system32\spmsg.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91AD9DC2-523A-47E2-A598-6C277F16CC50}] 2007-10-16 21:55 81408 --a------ c:\windows\system32\aadcaad.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-11 15:33] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55] "UpdateWin"="C:\WINDOWS\System32\1033v.exe" [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-12-03 21:16] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2007-09-02 11:25] "High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-07 16:07 C:\WINDOWS\system32\HdAShCut.exe] "RTHDCPL"="RTHDCPL.EXE" [2005-07-13 03:37 C:\WINDOWS\RTHDCPL.EXE] "EasyTuneV"="C:\Program Files\Gigabyte\ET5\GUI.exe" [2004-06-14 10:54] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55] "M1000Mnt"="M1000Rmv.exe" [] "UpdateWin"="C:\WINDOWS\System32\1033v.exe" [] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2002-08-29 10:45] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoWindowsUpdate"= 1 (0x1) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] UpdateWin REG_SZ C:\WINDOWS\System32\1033v.exe R0 avgntmgr;avgntmgr;C:\WINDOWS\System32\DRIVERS\avgntmgr.sys R0 nvrfhgrt;Microsoft RPC API Helper;C:\WINDOWS\System32\drivers\miqvzwcl.dat R1 avgntdd;avgntdd;C:\WINDOWS\System32\DRIVERS\avgntdd.sys S3 gdrv;gdrv;\??\C:\WINDOWS\gdrv.sys S3 M1000Srv;M5603C USB2.0 Camera Driver;C:\WINDOWS\System32\Drivers\M1000KNT.sys . ************************************************************************** catchme 0.3.1318 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-07 22:50:17 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\C:\Program Files\Gigabyte\ET5\markfun.w32" . Completion time: 2007-12-07 22:50:59 - machine was rebooted C:\ComboFix2.txt ... 2007-12-07 22:34 . --- E O F ---

g!rly · Answer

est ce que tu es aussi pancho13?

Lyonnais92 · Answer

Salut,

yes he is.

C'est jlpjlp qui a fait le lien.

http://www.commentcamarche.net/forum/affich 3717520 rapport mauvais#0

Julien06 · Answer

ben en fait avantque je m'inscrive j'avais ce pseudo pancho13 et je savais pas qu'on pouvais pas posté plusieur mess

g!rly · Answer

oui bah c´est malin,

bon je vais m´expliquer avec les autres hepers et reviens te dire ce que l´on va faire

Julien06 · Answer

ce n'etais pasavec une mauvaise intention c'etait juste pour que mon probleme soit regler plus rapidement je suis desolé

jfkpresident · Answer

pancho 13 ca me disait quelquechose aussi!!

Julien06 · Answer

on avait jamais discuté toi et moi jfk? si ??

jfkpresident · Answer

ah si si!!!
me rappelle

Julien06 · Answer

a bon moi je ne me rapelle pas en plus mes interventions sont affiches et tu n'y ai pas...ou alors c'est pas pancho moi...

g!rly · Answer

pancho julien ou que sais-je

il faut que tu reste sur ton topik de depart avec lyonnais92, t´inkiet il va pas te laisser tomber...

et n´en crée pas d´autre !!! 

tu voie le bordel que ca engendre, perte de temps,  incomprehenssion des rapports ect...

donc ce topik est clos

bye`

g!rly · Answer

--

Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

Julien06 · Answer

Desolé je ne pensais pas faire autant de degat je voulais juste reparer mon PC. J'ai compris je met le topik en resolu alors et encore desolé. Merci et bonne soirée.

Lyonnais92 · Answer

Bonsoir,

g!rly, désolé de ce pataquès.

je n'avais pas imaginé qu'il pouvait avoir des doublons.

On est rendu à peu près au même point.

Le fichier C:\windows\system32\aadcaad.dll est un drôle d'objet.

levagurod · Answer

Bonjour,
Je suis infecté par le virus Tr/Trash.Gen, merci de me venir m'aider à le supprimer.
Ci dessous le rapport de HijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:55:48, on 20/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eraser\Eraser.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
c:\progra~1\softwin\bitdef~1\bdmcon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: InlineSearchHandleHotKey - {B6FFE2AE-4D12-451F-B457-FE6125FFB1CF} - C:\Program Files\IEForge\Inline Search\InlineSearch.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: MEDIADICO Familial - {CEDDA62B-5FBE-4AB2-AE2E-5E069F444444} - C:\Program Files\LAventure\MDToolbar\MdToolbar.dll
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1036
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [BDNewsAgent] c:\program files\softwin\bitdefender free edition\bdnagent.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s
O4 - HKLM\..\Run: [BDMCon] c:\PROGRA~1\softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe -hide
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop]  (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop]  (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: DSLMON.lnk.disabled
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk = ?
O4 - Global Startup: Lancement rapide de Microsoft Office OneNote 2003.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.15\AMVConverter\grab.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.15\MediaManager\grab.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{9D1C0BF7-3C28-4F12-A6E9-D2ACD310242D}: NameServer = 81.253.149.1 80.10.246.3
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Fichiers communs\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
O23 - Service: BitDefender Communicator (XCOMM) - Softwin - C:\Program Files\Fichiers communs\Softwin\BitDefender Communicator\xcommsvr.exe

g!rly · Answer

Bonjour,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt ''

Virus TR/Trash.Gen trouvé par antivir

36 réponses

Discussions similaires

Newsletters