Probleme virus Win32: Agent-mvi [trij]

slt,

colle un rapport hijackthis

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :

https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

__________________

colle le rapport d'un scan en ligne
avec un des suivants:

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm

Bonjour,

Tout d'abord merci pour cette rapidité de réponse.
Je joints ci-dessous le rapport réalisé avec HijackThis en fait je l'avais déjà installé donc j'ai pas pu faire comme vous me l'aviez indiquer.
De plus j'ai oublier de préciser que je n'arrive plus à accéder au panneau de configuration et gestionnaire de taches (je ne peu donc pas supprimer les logiciels déjà installer, je ne sait pas si cela est important ou non.
Siinon j'essai de faire un scan de mon disque dur avec une des trois solutions proposés mais lors de chaque essai ma connection est intérompu je pense que c'est du au fait que je soit en bas débit (ile de la Réunion).
Je vous envoi le rapport de scan des que j'y arrive!!!!!
Merci encore pour votre aide.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:38:38, on 13/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\derc32xz.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\Wanadoo\AlertModule.exe
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lstard.stormcorp.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [frun] C:\WINDOWS\derc32xz.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [noskrnl] C:\WINDOWS\noskrnl.exe
O4 - HKCU\..\RunOnce: [Index.dat cleaner] C:\driver\delindex.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Booster Orange.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://193.253.98.130:2222/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC25E99A-9535-4428-872E-010D639CE2F4}: NameServer = 80.10.246.134 80.10.246.7
O20 - AppInit_DLLs: C:\WINDOWS\system32\skuns.dat
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Meslowatrbam - ESS Technology, Inc. - (no file)

si tu as un bas debit abandonne le scan en ligne:

smit fraud fix (colle le rapport)

1/ telecharger :

http://siri.urz.free.fr/Fix/SmitfraudFix.php

2/ double clique sur smitfraudfix. puis sélectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes. une fois le rapport effectué redémarre en mode sans échec (en appuyant sur F8 ou suppr, ou F5 au démarrage en général)

3/ puis refaire comme en 2/ mais sélectionne l'option 2 et appuyer sur entrée pour commencer la désinfection. lorsque le programme demande si tu veut nettoyer le registre mets oui en tapant 0 et entrée
__________________

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing)

O4 - HKLM\..\Run: [Lexmark_X79-55] C:\WINDOWS\system32\lsasss.exe

O4 - HKLM\..\Run: [frun] C:\WINDOWS\derc32xz.exe

O4 - HKLM\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [Undefined] C:\WINDOWS\system32\winter.exe
O4 - HKCU\..\Run: [noskrnl] C:\WINDOWS\noskrnl.exe
O4 - HKCU\..\RunOnce: [Index.dat cleaner] C:\driver\delindex.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O20 - AppInit_DLLs: C:\WINDOWS\system32\skuns.dat

_______________________

télécharge OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe (de Old_Timer) sur ton Bureau.
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\WINDOWS\derc32xz.exe
C:\WINDOWS\system32\winter.exe
C:\WINDOWS\noskrnl.exe
C:\WINDOWS\system32\EBPCH.dll
C:\WINDOWS\system32\skuns.dat

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

__________________________

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
___________________________

recolle un rapport hijackthis et dis tes soucis

SmitFraudFix v2.274

Rapport fait à 7:13:55,47, 15/01/2008
Executé à partir de C:\Documents and Settings\stephane\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\derc32xz.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\Wanadoo\AlertModule.exe
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\stephane

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\stephane\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\stephane\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\WINDOWS\\system32\\skuns.dat"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: WAN (PPP/SLIP) Interface
DNS Server Search Order: 80.10.246.5
DNS Server Search Order: 80.10.246.136

HKLM\SYSTEM\CCS\Services\Tcpip\..\{DC25E99A-9535-4428-872E-010D639CE2F4}: NameServer=80.10.246.5 80.10.246.136
HKLM\SYSTEM\CS1\Services\Tcpip\..\{DC25E99A-9535-4428-872E-010D639CE2F4}: NameServer=80.10.246.5 80.10.246.136

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Relance HijackThis:

Les lignes suivantes n'apparaissent pas:

O2 - BHO: (no name) - {D27987B8-7244-4DE0-AE10-39B826B492F1} - C:\WINDOWS\system32\bronto.dll (file missing)
O4 - HKCU\..\RunOnce: [Index.dat cleaner] C:\driver\delindex.exe
O20 - AppInit_DLLs: C:\WINDOWS\system32\skuns.dat

OTMoveIt:

File/Folder C:\WINDOWS\derc32xz.exe not found.
File/Folder C:\WINDOWS\system32\winter.exe not found.
File/Folder C:\WINDOWS\noskrnl.exe not found.
LoadLibrary failed for C:\WINDOWS\system32\EBPCH.dll
C:\WINDOWS\system32\EBPCH.dll NOT unregistered.
File move failed. C:\WINDOWS\system32\EBPCH.dll scheduled to be moved on reboot.
File/Folder C:\WINDOWS\system32\skuns.dat not found.

Created on 01/15/2008 11:24:51

combofix:
J''ai réussi à télécharger mais apparament il ne fonctionne pas j'ai un message d'erreur qui je crois me dis de telecharger une autre version (je suis nul en anglais).
Donc impossible d'avoir le rapport!!!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:14:36, on 15/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\Wanadoo\AlertModule.exe
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lstard.stormcorp.net/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [avast!] "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Booster Orange.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://193.253.98.130:2222/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC25E99A-9535-4428-872E-010D639CE2F4}: NameServer = 80.10.246.5 80.10.246.136
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Meslowatrbam - ESS Technology, Inc. - (no file)

refix cette ligne

O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll

____________________

télécharges et installes :

kill box
https://www.bleepingcomputer.com/download/linux/

aide kill box
http://perso.wanadoo.fr/jesses/Docs/Logiciels/KillBox.htm

- Redémarre en mode sans échec, si tu sais pas comment on fait lis ceci

- Double-clic sur fix.reg

Ouvres killbox
- Sélectionne "delete on reboot"
- Clique sur le dossier jaune à droite et sélectionne le fichier : C:\WINDOWS\system32\EBPCH.dll

- Clique sur la croix rouge et et blanche
- Répond yes et laisse redémarrer ton pc.
N'hésite pas à consulter l'Aide killbox

Vérifie que le fichier C:\WINDOWS\system32\EBPCH.dll n'est plus présent.

_______________________

scan avec avast en mode sans echec ainsi qu'avec avg antispyware que tu as

http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fdocid/20020905112131924

Bonsoir,

Pratique le lien pour le mode sans echec, bon voila j'ai essayé plusieurs solutions avec Killbox, mais le virus est toujours la.
Quand je choisi la premiére solution comme tu me l'avais indiqué a la fin du programme il me demande si je veux redemarer je fais ok et il y a un message qui s'affiche:

"Pendingfilerenameoperations registry data has been removed by external process"

avec les autres essais (proposer dans l'aide) tout ce passe bien mais l'ordinateur ne redemare pas seul de lui meme.

Sinon j'ai pas compris dans la derniére reponse:

refix cette ligne ???

O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll

Double-clic sur fix.reg ?????

Voila j'essai de chercher sur le web mais je ne trouve rien, donc si vous avez d'autre solutions .
Encore merci pour votre aide, je n'ai eu aucune autre aide.

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll

_______________

Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

 Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean
 Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec
 Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
Manuel de clean :
http://kerio.probb.fr/tuto-Clean-h37.html
https://kerio.probb.fr/

___________________

il me faudrait un rapport combofix!

________________

remplace avast par antivir plus efficcae et colle un rapport:

https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)

ComboFix 08-01-16.4 - stephane 2008-01-16 12:46:17.1 - NTFSx86
Running from: C:\Documents and Settings\stephane\Bureau\combofix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Documents\Ma musique\Desktop_.ini
C:\Documents and Settings\All Users\Documents\Mes images\Desktop_.ini
C:\Documents and Settings\stephane\ravmonlog
C:\WINDOWS\noskrnl.config
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\system32\EBPCH.dll . . . . Echec de suppression

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SYMAVC32
-------\LEGACY_XLAVBA8
-------\symavc32
-------\xlavba8

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-16 to 2008-01-16 ))))))))))))))))))))))))))))))))))))
.

2008-01-16 12:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Program Files\Avira
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-15 22:23 . 2008-01-15 22:23 5,706,439 --a------ C:\upload_moi_JMA-.tar.gz
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-15 09:55 . 2005-06-30 14:51 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-15 09:55 . 2005-06-30 16:41 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-01-15 09:55 . 2005-06-30 15:03 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-15 09:55 . 2005-06-30 15:04 119 --a------ C:\Documents and Settings\Administrateur\user.bat
2008-01-15 07:01 . 2008-01-15 10:01 2,606 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-15 06:58 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-15 06:58 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-15 06:58 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-15 06:58 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-15 06:58 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-15 06:58 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-14 12:12 . 2008-01-14 12:35 <REP> d-------- C:\Program Files\Panda Security
2008-01-10 15:32 . 2008-01-10 15:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-10 15:32 . 2008-01-10 15:32 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-16 08:14 . 2007-12-16 08:14 70,656 --a------ C:\Documents and Settings\stephane\kolenkor.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 10:55 --------- d-----w C:\Program Files\Wanadoo
2008-01-16 10:52 --------- d-----w C:\Documents and Settings\stephane\Application Data\OpenOffice.org2
2008-01-12 18:07 --------- d-----w C:\Program Files\Google
2008-01-06 10:44 --------- d-----w C:\Program Files\eMule
2007-12-15 22:04 --------- d-----w C:\Program Files\Winamp
2007-12-15 21:58 --------- d-----w C:\Program Files\Space Station
2007-12-15 21:58 --------- d-----w C:\Program Files\Smart Panel
2007-12-15 21:57 --------- d-----w C:\Program Files\Slide
2007-12-15 21:57 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2007-12-15 21:56 --------- d-----w C:\Program Files\QuickTime
2007-12-15 21:55 --------- d-----w C:\Program Files\Picasa2
2007-12-15 21:54 --------- d-----w C:\Program Files\PDFCreator
2007-12-15 21:53 --------- d-----w C:\Program Files\PDF2Word v1.3
2007-12-15 21:53 --------- d-----w C:\Program Files\OpenOffice.org 2.1 Installation Files
2007-12-15 21:34 --------- d-----w C:\Program Files\Nvu
2007-12-15 21:33 --------- d-----w C:\Program Files\MSN Messenger
2007-12-15 21:29 --------- d-----w C:\Program Files\Microsoft GIF Animator
2007-12-15 21:29 --------- d-----w C:\Program Files\Mailing List Deluxe
2007-12-15 21:25 --------- d-----w C:\Program Files\LoadBook
2007-12-15 21:25 --------- d-----w C:\Program Files\Juice
2007-12-15 20:57 --------- d-----w C:\Program Files\DIFX
2007-12-15 20:49 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-12-15 17:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-15 11:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-15 11:24 --------- d-----w C:\Documents and Settings\stephane\Application Data\COWON
2007-12-14 17:48 --------- d-----w C:\Documents and Settings\stephane\Application Data\Grisoft
2007-12-14 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-14 17:29 --------- d-----w C:\Program Files\Yahoo!
2007-12-14 17:26 --------- d-----w C:\Program Files\CCleaner
2007-12-13 13:52 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-13 13:40 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-12-13 13:40 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-12-13 13:39 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-12-09 06:56 287,232 ----a-w C:\Documents and Settings\stephane\libcurl.dll
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-12-03 12:30 167,936 ----a-w C:\WINDOWS\ddubbv.exe
2007-11-15 15:04 4,112,760 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2007-11-12 16:15 55,808 ----a-w C:\WINDOWS\system32\spoolv.exe
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-03-19 09:16 62,832 ----a-w C:\Documents and Settings\stephane\Application Data\GDIPFONTCACHEV1.DAT
2005-06-30 14:04 119 ----a-w C:\WINDOWS\system32\config\systemprofile\user.bat
2005-06-30 14:04 119 ----a-w C:\Documents and Settings\Default User\user.bat
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38784EB6-548A-45F3-8898-58ADF30816D0}]
C:\WINDOWS\system32\EBPCH.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"LClock"="lclock.exe" [2004-12-08 17:06 65536 C:\WINDOWS\LClock.exe]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-28 13:02 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-05-02 07:08 366400]
"avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25 249896]
"combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-04 01:54 400896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="C:\WINDOWS\LSD\end.cmd" [2002-12-22 13:56 2176]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 01:37 44544]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
"NoWindowsUpdate"= 1 (0x1)
"NoControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"SfcDisable"=dword:ffffff9d

R0 ciyrimbj;ciyrimbj;C:\WINDOWS\system32\drivers\ccvqyxhd.dat []
R3 Maestro;Pilote audio ESS Maestro2E (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-12-22 22:53]
R3 OBOE;Port FIR Toshiba Type-DO;C:\WINDOWS\system32\DRIVERS\tos4mo.sys [2002-12-22 22:52]
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
S3 noskrnl.sys;noskrnl.sys;C:\WINDOWS\system32\noskrnl.sys []
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32e0ec41-9e43-11da-b759-0010a4191d3f}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bfdf4d05-d12f-11db-b8f0-0060b3470e28}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cde1a7f0-78c7-11dc-9d17-101111111111}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 13:07:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-16 13:20:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-16 12:20:22

Rapport Clean:

16/01/2008 a 13:44:45,20

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\SpoonUninstall.exe FOUND

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !

HijackThis:

j'ai effacer par erreur le premier rapport je l'ai donc relancer une fois le virus supprimé???

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:13:16, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\Wanadoo\AlertModule.exe
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lstard.stormcorp.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Booster Orange.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://193.253.98.130:2222/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC25E99A-9535-4428-872E-010D639CE2F4}: NameServer = 80.10.246.5 80.10.246.136
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Meslowatrbam - ESS Technology, Inc. - (no file)

ComboFix 08-01-16.4 - stephane 2008-01-16 12:46:17.1 - NTFSx86
Running from: C:\Documents and Settings\stephane\Bureau\combofix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Documents\Ma musique\Desktop_.ini
C:\Documents and Settings\All Users\Documents\Mes images\Desktop_.ini
C:\Documents and Settings\stephane\ravmonlog
C:\WINDOWS\noskrnl.config
C:\WINDOWS\system32\svcp.csv
C:\WINDOWS\system32\winsub.xml
C:\WINDOWS\system32\EBPCH.dll . . . . Echec de suppression

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SYMAVC32
-------\LEGACY_XLAVBA8
-------\symavc32
-------\xlavba8

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-16 to 2008-01-16 ))))))))))))))))))))))))))))))))))))
.

2008-01-16 12:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Program Files\Avira
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-15 22:23 . 2008-01-15 22:23 5,706,439 --a------ C:\upload_moi_JMA-.tar.gz
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-15 09:55 . 2005-06-30 14:51 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-15 09:55 . 2005-06-30 16:41 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-01-15 09:55 . 2005-06-30 15:03 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-15 09:55 . 2005-06-30 15:04 119 --a------ C:\Documents and Settings\Administrateur\user.bat
2008-01-15 07:01 . 2008-01-15 10:01 2,606 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-15 06:58 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-15 06:58 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-15 06:58 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-15 06:58 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-15 06:58 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-15 06:58 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-14 12:12 . 2008-01-14 12:35 <REP> d-------- C:\Program Files\Panda Security
2008-01-10 15:32 . 2008-01-10 15:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-10 15:32 . 2008-01-10 15:32 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-16 08:14 . 2007-12-16 08:14 70,656 --a------ C:\Documents and Settings\stephane\kolenkor.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 10:55 --------- d-----w C:\Program Files\Wanadoo
2008-01-16 10:52 --------- d-----w C:\Documents and Settings\stephane\Application Data\OpenOffice.org2
2008-01-12 18:07 --------- d-----w C:\Program Files\Google
2008-01-06 10:44 --------- d-----w C:\Program Files\eMule
2007-12-15 22:04 --------- d-----w C:\Program Files\Winamp
2007-12-15 21:58 --------- d-----w C:\Program Files\Space Station
2007-12-15 21:58 --------- d-----w C:\Program Files\Smart Panel
2007-12-15 21:57 --------- d-----w C:\Program Files\Slide
2007-12-15 21:57 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2007-12-15 21:56 --------- d-----w C:\Program Files\QuickTime
2007-12-15 21:55 --------- d-----w C:\Program Files\Picasa2
2007-12-15 21:54 --------- d-----w C:\Program Files\PDFCreator
2007-12-15 21:53 --------- d-----w C:\Program Files\PDF2Word v1.3
2007-12-15 21:53 --------- d-----w C:\Program Files\OpenOffice.org 2.1 Installation Files
2007-12-15 21:34 --------- d-----w C:\Program Files\Nvu
2007-12-15 21:33 --------- d-----w C:\Program Files\MSN Messenger
2007-12-15 21:29 --------- d-----w C:\Program Files\Microsoft GIF Animator
2007-12-15 21:29 --------- d-----w C:\Program Files\Mailing List Deluxe
2007-12-15 21:25 --------- d-----w C:\Program Files\LoadBook
2007-12-15 21:25 --------- d-----w C:\Program Files\Juice
2007-12-15 20:57 --------- d-----w C:\Program Files\DIFX
2007-12-15 20:49 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-12-15 17:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-15 11:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-15 11:24 --------- d-----w C:\Documents and Settings\stephane\Application Data\COWON
2007-12-14 17:48 --------- d-----w C:\Documents and Settings\stephane\Application Data\Grisoft
2007-12-14 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-14 17:29 --------- d-----w C:\Program Files\Yahoo!
2007-12-14 17:26 --------- d-----w C:\Program Files\CCleaner
2007-12-13 13:52 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-13 13:40 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-12-13 13:40 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-12-13 13:39 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-12-09 06:56 287,232 ----a-w C:\Documents and Settings\stephane\libcurl.dll
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-12-03 12:30 167,936 ----a-w C:\WINDOWS\ddubbv.exe
2007-11-15 15:04 4,112,760 ----a-w C:\WINDOWS\system32\SpoonUninstall.exe
2007-11-12 16:15 55,808 ----a-w C:\WINDOWS\system32\spoolv.exe
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-03-19 09:16 62,832 ----a-w C:\Documents and Settings\stephane\Application Data\GDIPFONTCACHEV1.DAT
2005-06-30 14:04 119 ----a-w C:\WINDOWS\system32\config\systemprofile\user.bat
2005-06-30 14:04 119 ----a-w C:\Documents and Settings\Default User\user.bat
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38784EB6-548A-45F3-8898-58ADF30816D0}]
C:\WINDOWS\system32\EBPCH.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"LClock"="lclock.exe" [2004-12-08 17:06 65536 C:\WINDOWS\LClock.exe]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-28 13:02 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-05-02 07:08 366400]
"avast!"="C:\Program Files\Alwil Software\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2007-08-31 12:25 249896]
"combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-04 01:54 400896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="C:\WINDOWS\LSD\end.cmd" [2002-12-22 13:56 2176]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 01:37 44544]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)
"NoWindowsUpdate"= 1 (0x1)
"NoControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"SfcDisable"=dword:ffffff9d

R0 ciyrimbj;ciyrimbj;C:\WINDOWS\system32\drivers\ccvqyxhd.dat []
R3 Maestro;Pilote audio ESS Maestro2E (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-12-22 22:53]
R3 OBOE;Port FIR Toshiba Type-DO;C:\WINDOWS\system32\DRIVERS\tos4mo.sys [2002-12-22 22:52]
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
S3 noskrnl.sys;noskrnl.sys;C:\WINDOWS\system32\noskrnl.sys []
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{32e0ec41-9e43-11da-b759-0010a4191d3f}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bfdf4d05-d12f-11db-b8f0-0060b3470e28}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cde1a7f0-78c7-11dc-9d17-101111111111}]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL AdobeR.exe e

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 13:07:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-16 13:20:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-16 12:20:22

Rapport Clean:

16/01/2008 a 13:44:45,20

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32
C:\WINDOWS\system32\SpoonUninstall.exe FOUND

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !

HijackThis:

j'ai effacer par erreur le premier rapport je l'ai donc relancer une fois le virus supprimé???

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:13:16, on 16/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Wanadoo\GestionnaireInternet.exe
C:\Program Files\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\PROGRA~1\Wanadoo\AlertModule.exe
C:\Program Files\Wanadoo\Watch.exe
C:\PROGRA~1\Wanadoo\WOOBrowser\WOOBrowser.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lstard.stormcorp.net/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Booster Orange.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://193.253.98.130:2222/activex/AMC.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{DC25E99A-9535-4428-872E-010D639CE2F4}: NameServer = 80.10.246.5 80.10.246.136
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Meslowatrbam - ESS Technology, Inc. - (no file)

Bonjour,

Comme indiqué dans le precedant message il semble que le virus est ete effacer.
Par contre j'ai un icone (alerte de sécurité windows) qui s'affiche à coté de l'horloge quand je clic dessus cela m'indique que je n'ai pas de protection alors que Antivir et Avg sont installés et en marche?????

De plus faut il que j'efface les divers logiciels installés qui ce trouve sur mon bureau??

Voila encore un grand merci pour mon virus, bonne journée

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lstard.stormcorp.net/

O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll (file missing)

_________________

si tout c'est bien passé désactive la restauration système pour purger les virus qui seraient dedans puis réactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)
------------------

recolle un rapport antivir

et dis tes soucis

___________

tu as le cd de windows avec le sp2?

Bonjour,

J'ai relancé HijackThis en cochant les deux lignes comme indiqué mais le logiciel ne va pas au bou de la manip il se bloque et aucun rapport n'est disponible.
J'ai essayé plusieurs fois la premiere ligne R1 disparait mais l'autre est toujours la à chaque lancement du logiciel.
Est ce que je dois désactive la restauration système quand meme?????

Sinon je n'ai pas le cd de windows avec le sp2 .

non ne desactive pas encore,
essaye de reinstaller antivir et avg pour voir si l'alerte persiste

Bonsoir,

J'ai enfin réussi a faire un scan avec Antivir et Avg (+ de 3h00 de temps pour celui la).
Ci-dessousl les rapports de scan???

AntiVir PersonalEdition Classic
Report file date: vendredi 18 janvier 2008 11:45

Scanning for 1054433 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: JMA-

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 07:10:53
ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 15/01/2008 07:10:53
ANTIVIR3.VDF : 7.0.2.15 191488 Bytes 17/01/2008 07:10:53
AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 18/01/2008 07:11:05
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 18/01/2008 07:11:09
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: vendredi 18 janvier 2008 11:45

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'WOOBrowser.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
Scan process 'Toaster.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'LClock.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'BTNtService.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '24' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\upload_moi_JMA-.tar.gz
[0] Archive type: GZ
--> upload_moi.tar
[1] Archive type: TAR (tape archiver)
--> qoobox/Quarantine/catchme2008-01-16_130551.99.zip
[2] Archive type: ZIP
--> EBPCH.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
--> WINDOWS/System32/spoolv.exe
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.cpv Backdoor server programs
[INFO] The file was deleted!
C:\!KillBox\EBPCH.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was deleted!
C:\!KillBox\EBPCH.dll( 1)
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47e08412.qua'!
C:\!KillBox\EBPCH.dll( 2)
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47e08417.qua'!
C:\!KillBox\EBPCH.dll( 3)
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47e0841a.qua'!
C:\!KillBox\EBPCH.dll( 4)
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47e0841d.qua'!
C:\!KillBox\EBPCH.dll( 5)
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47e08420.qua'!
C:\Documents and Settings\stephane\Bureau\smitfraudfix.exe
[0] Archive type: RAR SFX (self extracting)
--> SmitfraudFix\SmiUpdate.exe
[DETECTION] Is the Trojan horse TR/VB.20480
[INFO] The file was moved to '47f985f6.qua'!
C:\Documents and Settings\stephane\Bureau\SmitfraudFix\SmiUpdate.exe
[DETECTION] Is the Trojan horse TR/VB.20480
[INFO] The file was moved to '47f98601.qua'!
C:\Documents and Settings\stephane\Local Settings\Temporary Internet Files\Content.IE5\CLEN492F\69.231.116[1].htm
[DETECTION] Is the Trojan horse TR/Click.HTML.Agent.S
[INFO] The file was moved to '47be86eb.qua'!
C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll
[DETECTION] Is the Trojan horse TR/Agent.bux.1
[INFO] The file was moved to '47fe9880.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20080115-104435-332.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47f39cb0.qua'!
C:\Program Files\Trend Micro\HijackThis\backups\backup-20080115-225927-713.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47f39cb4.qua'!
C:\QooBox\Quarantine\catchme2008-01-16_130551.99.zip
[0] Archive type: ZIP
--> EBPCH.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '4804a2b1.qua'!
C:\System Volume Information\_restore{31C31D2F-992A-46A9-868D-9AE03493D097}\RP2\A0000243.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47c0a2dd.qua'!
C:\System Volume Information\_restore{31C31D2F-992A-46A9-868D-9AE03493D097}\RP2\A0000244.exe
[0] Archive type: RAR SFX (self extracting)
--> SmitfraudFix\SmiUpdate.exe
[DETECTION] Is the Trojan horse TR/VB.20480
[INFO] The file was moved to '47c0a3b4.qua'!
C:\System Volume Information\_restore{31C31D2F-992A-46A9-868D-9AE03493D097}\RP2\A0000245.exe
[DETECTION] Is the Trojan horse TR/VB.20480
[INFO] The file was moved to '47c0a3b8.qua'!
C:\System Volume Information\_restore{31C31D2F-992A-46A9-868D-9AE03493D097}\RP2\A0000246.dll
[DETECTION] Is the Trojan horse TR/Agent.bux.1
[INFO] The file was moved to '47c0a3bb.qua'!
C:\System Volume Information\_restore{31C31D2F-992A-46A9-868D-9AE03493D097}\RP2\A0000247.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47c0a3bd.qua'!
C:\System Volume Information\_restore{31C31D2F-992A-46A9-868D-9AE03493D097}\RP2\A0000248.dll
[DETECTION] Is the Trojan horse TR/Crypt.Morphine.Gen
[INFO] The file was moved to '47c0a3c0.qua'!
C:\WINDOWS\system32\spoolv.exe
[DETECTION] Contains a detection pattern of the (dangerous) backdoor program BDS/Agent.cpv Backdoor server programs
[INFO] The file was moved to '47ffaaf3.qua'!

End of the scan: vendredi 18 janvier 2008 14:34
Used time: 2:49:28 min

The scan has been done completely.

4625 Scanning directories
221788 Files were scanned
22 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
2 files were deleted
0 files were repaired
19 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
221766 Files not concerned
1717 Archives were scanned
1 Warnings
1 Notes

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 17:59:53 18/01/2008

+ Résultat de l'analyse:

HKU\S-1-5-21-1409082233-789336058-1957994488-1003\SOFTWARE\EverAd -> Adware.EverAd : Ignoré.
HKU\S-1-5-21-1409082233-789336058-1957994488-1003\SOFTWARE\EverAd\PlayJ Player -> Adware.EverAd : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@247realmedia[1].txt -> TrackingCookie.247realmedia : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@adtech[1].txt -> TrackingCookie.Adtech : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@advertising[1].txt -> TrackingCookie.Advertising : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@adviva[2].txt -> TrackingCookie.Adviva : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@atdmt[2].txt -> TrackingCookie.Atdmt : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@bluestreak[2].txt -> TrackingCookie.Bluestreak : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@fastclick[2].txt -> TrackingCookie.Fastclick : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@server.iad.liveperson[1].txt -> TrackingCookie.Liveperson : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@mediaplex[1].txt -> TrackingCookie.Mediaplex : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@ssl-hints.netflame[2].txt -> TrackingCookie.Netflame : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@realmedia[1].txt -> TrackingCookie.Realmedia : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@smartadserver[1].txt -> TrackingCookie.Smartadserver : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@weborama[2].txt -> TrackingCookie.Weborama : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Ignoré.
C:\Documents and Settings\stephane\Cookies\stephane@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Ignoré.

Fin du rapport

slt,

refais avg antispyware car tout a été ignoré, il faut supprimer ce qui est trouvé!

___________

supprime la sauvegarde de hijackhtis car un virus est dedans ou

vire hijackhtis de ton ordi

_________________

vire tout ce qui est dans les dossier quarantine et killbox en allant dans poste de travail puis C...

c: qoobox/Quarantine/

C:\!KillBox\

_____________________

desinstalle smitfraudfix de ton ordi
__________________

Colle le rapport :
Clean permettra de faire du nettoyage et supprimer des fichiers que des anti-virus et anti-spywares n'ont pas pu trouver. Le logiciel est régulièrement mis à jour, vous devrez donc le re-téléchargé pour obtenir une version plus récente.

 Téléchargez clean.zip, décompressez-le sur votre bureau (clic droit / extraire tout), vous obtenez alors un dossier clean
 Démarrez Windows en mode sans échec : Guide pour redémarrer en mode sans échec
 Ouvrez le dossier clean qui se trouve sur ton bureau, et double-cliquez sur clean.cmd, une fenêtre noire va apparaître pendant un instant, laissez la ouverte jusqu'à ce qu'elle se ferme.
Manuel de clean :
http://kerio.probb.fr/tuto-Clean-h37.html
https://kerio.probb.fr/
________________________

combofix (colle le rapport)
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

_______________

vire ce qui est en quarantaine dans antivir

_______________

si tout c'est bien passé désactive la restauration système pour purger les virus qui seraient dedans
puis redemarre ton ordi
puis réactive là
(dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis paramètre)
------------------

recolle ensuite un rapport antivir et dis tes soucis

a plus

ComboFix 08-01-16.4 - stephane 2008-01-19 18:42:24.3 - NTFSx86
Running from: C:\Documents and Settings\stephane\Bureau\combofix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2007-12-19 to 2008-01-19 ))))))))))))))))))))))))))))))))))))
.

2008-01-19 14:37 . 2008-01-19 14:37 1,606,879 --a------ C:\upload_moi_JMA-.tar.gz
2008-01-16 13:58 . 2008-01-16 13:58 <REP> d--hs---- C:\WINDOWS\system32\dllcache
2008-01-16 12:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Program Files\Avira
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-15 09:55 . 2005-06-30 14:51 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-01-15 09:55 . 2008-01-19 14:41 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-15 09:55 . 2005-06-30 16:41 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-01-15 09:55 . 2008-01-16 13:39 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-15 09:55 . 2005-06-30 15:04 119 --a------ C:\Documents and Settings\Administrateur\user.bat
2008-01-15 07:01 . 2008-01-15 10:01 2,606 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-15 06:58 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-15 06:58 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-15 06:58 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-15 06:58 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-15 06:58 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-15 06:58 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-14 12:12 . 2008-01-18 22:45 <REP> d-------- C:\Program Files\Panda Security
2008-01-10 15:32 . 2008-01-10 15:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-10 15:32 . 2008-01-10 15:32 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-19 13:54 --------- d-----w C:\Program Files\Wanadoo
2008-01-19 13:52 --------- d-----w C:\Documents and Settings\stephane\Application Data\OpenOffice.org2
2008-01-18 21:48 --------- d-----w C:\Program Files\Picasa2
2008-01-12 18:07 --------- d-----w C:\Program Files\Google
2008-01-06 10:44 --------- d-----w C:\Program Files\eMule
2007-12-16 07:14 70,656 ----a-w C:\Documents and Settings\stephane\kolenkor.dll
2007-12-15 22:04 --------- d-----w C:\Program Files\Winamp
2007-12-15 21:58 --------- d-----w C:\Program Files\Space Station
2007-12-15 21:58 --------- d-----w C:\Program Files\Smart Panel
2007-12-15 21:57 --------- d-----w C:\Program Files\Slide
2007-12-15 21:57 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2007-12-15 21:56 --------- d-----w C:\Program Files\QuickTime
2007-12-15 21:54 --------- d-----w C:\Program Files\PDFCreator
2007-12-15 21:53 --------- d-----w C:\Program Files\PDF2Word v1.3
2007-12-15 21:53 --------- d-----w C:\Program Files\OpenOffice.org 2.1 Installation Files
2007-12-15 21:34 --------- d-----w C:\Program Files\Nvu
2007-12-15 21:33 --------- d-----w C:\Program Files\MSN Messenger
2007-12-15 21:29 --------- d-----w C:\Program Files\Microsoft GIF Animator
2007-12-15 21:29 --------- d-----w C:\Program Files\Mailing List Deluxe
2007-12-15 21:25 --------- d-----w C:\Program Files\LoadBook
2007-12-15 21:25 --------- d-----w C:\Program Files\Juice
2007-12-15 20:57 --------- d-----w C:\Program Files\DIFX
2007-12-15 20:49 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-12-15 17:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-15 11:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-15 11:24 --------- d-----w C:\Documents and Settings\stephane\Application Data\COWON
2007-12-14 17:48 --------- d-----w C:\Documents and Settings\stephane\Application Data\Grisoft
2007-12-14 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-14 17:29 --------- d-----w C:\Program Files\Yahoo!
2007-12-13 13:52 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-13 13:40 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-12-13 13:40 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-12-13 13:39 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-12-09 06:56 287,232 ----a-w C:\Documents and Settings\stephane\libcurl.dll
2007-12-03 12:30 167,936 ----a-w C:\WINDOWS\ddubbv.exe
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-03-19 09:16 62,832 ----a-w C:\Documents and Settings\stephane\Application Data\GDIPFONTCACHEV1.DAT
2005-06-30 14:04 119 ----a-w C:\WINDOWS\system32\config\systemprofile\user.bat
2005-06-30 14:04 119 ----a-w C:\Documents and Settings\Default User\user.bat
.

((((((((((((((((((((((((((((( snapshot@2008-01-16_13.19.32.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-09-07 11:05:19 62,016 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2008-01-18 07:11:11 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38784EB6-548A-45F3-8898-58ADF30816D0}]
C:\WINDOWS\system32\EBPCH.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"LClock"="lclock.exe" [2004-12-08 17:06 65536 C:\WINDOWS\LClock.exe]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-28 13:02 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-18 08:10 249896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="C:\WINDOWS\LSD\end.cmd" [2002-12-22 13:56 2176]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 01:37 44544]

C:\Documents and Settings\stephane\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 16:45:48]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-19 13:05:02]
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-12-22 12:24:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)

R0 ciyrimbj;ciyrimbj;C:\WINDOWS\system32\drivers\ccvqyxhd.dat []
R3 Maestro;Pilote audio ESS Maestro2E (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-12-22 22:53]
R3 OBOE;Port FIR Toshiba Type-DO;C:\WINDOWS\system32\DRIVERS\tos4mo.sys [2002-12-22 22:52]
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
S3 noskrnl.sys;noskrnl.sys;C:\WINDOWS\system32\noskrnl.sys []
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 18:54:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-19 19:00:25
ComboFix2.txt 2008-01-19 17:18:00

AntiVir PersonalEdition Classic
Report file date: samedi 19 janvier 2008 20:18

Scanning for 1056958 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: JMA-

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 07:10:53
ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 15/01/2008 07:10:53
ANTIVIR3.VDF : 7.0.2.20 225792 Bytes 18/01/2008 06:20:23
AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 18/01/2008 07:11:05
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 18/01/2008 07:11:09
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: samedi 19 janvier 2008 20:18

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'Watch.exe' - '1' Module(s) have been scanned
Scan process 'AlertModule.exe' - '1' Module(s) have been scanned
Scan process 'PollingModule.exe' - '1' Module(s) have been scanned
Scan process 'Inactivity.exe' - '1' Module(s) have been scanned
Scan process 'Toaster.exe' - '1' Module(s) have been scanned
Scan process 'ComComp.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'GestionnaireInternet.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'LClock.exe' - '1' Module(s) have been scanned
Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned
Scan process 'BTNtService.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
34 processes with 34 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '23' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!

End of the scan: samedi 19 janvier 2008 21:16
Used time: 59:03 min

The scan has been done completely.

4412 Scanning directories
217599 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
217599 Files not concerned
1686 Archives were scanned
1 Warnings
0 Notes

Bonsoir,
Comme convenu tout à fonctionner, mais je ne retrouve pas le rapport Clean.
J'ai toujours l'icone alertes de sécurité windows à gauche de l'horloge???
Un grand merci pour tous vos conseils techniques et toutes vos solutions, ainsi que pour votre patience.
Je pense que le virus est supprimé, par contre j'ai des vieux logiciel qui ne veulent pas etre supprimer???

# Télécharge RavAntivirus d'Evosla :
http://ww25.evosla.com/compteur.php?soft=rav_antivirus

# Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX
# Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau
# Doucle-clique sur >> RAV.exe << afin de lancer l'outil.
# Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles)
# Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain .
# Retire tes disques amovibles et redémarrez votre ordinateur.
# Poste le rapport, si infection!

______________________

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

Driver ::
ciyrimbj

File::

C:\WINDOWS\system32\EBPCH.dll

Registry::

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38784EB6-548A-45F3-8898-58ADF30816D0}]

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

_______________________

pour virer tes vieux logiciels fais le en mode sans echec ou utilise unlocker

https://www.01net.com/telecharger/windows/Utilitaire/manipulation_de_fichier/fiches/32585.html

[20/01/2008 14:02:08] - virus trouvé : f:\AUTORUN.INF
[20/01/2008 14:02:10] - virus Supprimé avec succès ==>f:\autorun.inf
[20/01/2008 14:02:22] - virus Supprimé avec succès
[20/01/2008 14:02:23] - virus trouvé : g:\AUTORUN.INF
[20/01/2008 14:02:24] - virus Supprimé avec succès ==>g:\autorun.inf
[20/01/2008 14:02:24] - virus Supprimé avec succès ==>g:\RavMonLog
[20/01/2008 14:02:29] - virus Supprimé avec succès

ComboFix 08-01-16.4 - stephane 2008-01-20 14:48:20.4 - NTFSx86
Running from: C:\Documents and Settings\stephane\Bureau\combofix.exe
Command switches used :: C:\Documents and Settings\stephane\Bureau\CFscript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\EBPCH.dll
.

((((((((((((((((((((((((((((( Fichiers créés 2007-12-20 to 2008-01-20 ))))))))))))))))))))))))))))))))))))
.

2008-01-16 13:58 . 2008-01-16 13:58 <REP> d--hs---- C:\WINDOWS\system32\dllcache
2008-01-16 12:42 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Program Files\Avira
2008-01-16 07:08 . 2008-01-16 07:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-01-15 09:55 . 2005-06-30 14:51 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-01-15 09:55 . 2008-01-19 19:26 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-01-15 09:55 . 2005-06-30 16:41 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-01-15 09:55 . 2005-06-30 16:41 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-01-15 09:55 . 2005-06-30 15:04 119 --a------ C:\Documents and Settings\Administrateur\user.bat
2008-01-15 07:01 . 2008-01-15 10:01 2,606 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-15 06:58 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-15 06:58 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-15 06:58 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-15 06:58 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-15 06:58 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-15 06:58 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-10 15:32 . 2008-01-10 15:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-10 15:32 . 2008-01-10 15:32 1,409 --a------ C:\WINDOWS\QTFont.for

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-20 13:50 --------- d-----w C:\Program Files\Wanadoo
2008-01-20 07:41 --------- d-----w C:\Documents and Settings\stephane\Application Data\OpenOffice.org2
2008-01-12 18:07 --------- d-----w C:\Program Files\Google
2008-01-06 10:44 --------- d-----w C:\Program Files\eMule
2007-12-15 22:04 --------- d-----w C:\Program Files\Winamp
2007-12-15 21:58 --------- d-----w C:\Program Files\Space Station
2007-12-15 21:58 --------- d-----w C:\Program Files\Smart Panel
2007-12-15 21:57 --------- d-----w C:\Program Files\Satsuki Decoder Pack
2007-12-15 21:56 --------- d-----w C:\Program Files\QuickTime
2007-12-15 21:54 --------- d-----w C:\Program Files\PDFCreator
2007-12-15 21:53 --------- d-----w C:\Program Files\PDF2Word v1.3
2007-12-15 21:53 --------- d-----w C:\Program Files\OpenOffice.org 2.1 Installation Files
2007-12-15 21:34 --------- d-----w C:\Program Files\Nvu
2007-12-15 21:33 --------- d-----w C:\Program Files\MSN Messenger
2007-12-15 21:29 --------- d-----w C:\Program Files\Microsoft GIF Animator
2007-12-15 21:29 --------- d-----w C:\Program Files\Mailing List Deluxe
2007-12-15 21:25 --------- d-----w C:\Program Files\LoadBook
2007-12-15 21:25 --------- d-----w C:\Program Files\Juice
2007-12-15 20:57 --------- d-----w C:\Program Files\DIFX
2007-12-15 20:49 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-12-15 17:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-15 11:24 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-15 11:24 --------- d-----w C:\Documents and Settings\stephane\Application Data\COWON
2007-12-14 17:48 --------- d-----w C:\Documents and Settings\stephane\Application Data\Grisoft
2007-12-14 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-14 17:29 --------- d-----w C:\Program Files\Yahoo!
2007-12-13 13:52 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-13 13:40 69,689 ----a-w C:\WINDOWS\UNZIP.DLL
2007-12-13 13:40 507,904 ----a-w C:\WINDOWS\TMUPDATE.DLL
2007-12-13 13:39 286,720 ----a-w C:\WINDOWS\PATCH.EXE
2007-12-03 12:30 167,936 ----a-w C:\WINDOWS\ddubbv.exe
2007-10-25 09:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2007-03-19 09:16 62,832 ----a-w C:\Documents and Settings\stephane\Application Data\GDIPFONTCACHEV1.DAT
2005-06-30 14:04 119 ----a-w C:\WINDOWS\system32\config\systemprofile\user.bat
2005-06-30 14:04 119 ----a-w C:\Documents and Settings\Default User\user.bat
.

((((((((((((((((((((((((((((( snapshot@2008-01-16_13.19.32.75 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-16 11:44:46 131,072 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-01-20 13:47:16 131,072 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT
- 2008-01-16 11:44:46 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-01-20 13:47:16 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-01-16 11:44:46 135,168 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
+ 2008-01-20 13:47:16 135,168 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT
- 2008-01-16 11:44:47 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
+ 2008-01-20 13:47:16 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat
- 2008-01-16 11:44:50 7,086,080 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT
+ 2008-01-20 13:47:17 7,086,080 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT
- 2008-01-16 11:44:51 106,496 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
+ 2008-01-20 13:47:17 106,496 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat
- 2007-09-07 11:05:19 62,016 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2008-01-18 07:11:11 61,632 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38784EB6-548A-45F3-8898-58ADF30816D0}]
C:\WINDOWS\system32\EBPCH.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"LClock"="lclock.exe" [2004-12-08 17:06 65536 C:\WINDOWS\LClock.exe]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [ ]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-28 13:02 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-18 08:10 249896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"LSD_III"="C:\WINDOWS\LSD\end.cmd" [2002-12-22 13:56 2176]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-04 01:37 44544]

C:\Documents and Settings\stephane\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 16:45:48]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-19 13:05:02]
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2006-12-22 12:24:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMBalloonTip"= 0 (0x0)

R0 ciyrimbj;ciyrimbj;C:\WINDOWS\system32\drivers\ccvqyxhd.dat []
R3 Maestro;Pilote audio ESS Maestro2E (WDM);C:\WINDOWS\system32\drivers\essm2e.sys [2002-12-22 22:53]
R3 OBOE;Port FIR Toshiba Type-DO;C:\WINDOWS\system32\DRIVERS\tos4mo.sys [2002-12-22 22:52]
S3 BTNetFilter;Bluetooth Network Filter;C:\WINDOWS\system32\drivers\BTNetFilter.sys [2004-12-16 16:32]
S3 noskrnl.sys;noskrnl.sys;C:\WINDOWS\system32\noskrnl.sys []
S3 ZDCndis5;ZDCndis5 Protocol Driver;C:\WINDOWS\system32\ZDCndis5.SYS []

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\Auto\command - AdobeR.exe e
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 14:56:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.2180]
-> C:\WINDOWS\LC.dll
.
Completion time: 2008-01-20 14:59:53

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:27:40, on 20/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\lclock.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\stephane\Bureau\hijackthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SearchPageURL.dll
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {38784EB6-548A-45F3-8898-58ADF30816D0} - C:\WINDOWS\system32\EBPCH.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LClock] lclock.exe
O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe GestionnaireInternet.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [LSD_III] %systemroot%\LSD\end.cmd (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: Booster Orange.lnk = C:\Program Files\Booster Wanadoo\wanadoo_booster.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O9 - Extra 'Tools' menuitem: Internet Cleaner - {45819E58-6E84-4A5D-BD65-A706981E5BE8} - C:\driver\ICleaner.exe (HKCU)
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - http://193.253.98.130:2222/activex/AMC.cab
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Meslowatrbam - ESS Technology, Inc. - (no file)