trojan Win32:TratBHO[Trj]Fermé

Question

Bonjour amis de la toile,je suis infecte par le virus Win32:TratBHO[Trj] et je cherche de l'aide pour m'en debarasser.merci d'avance a qui voudra bien m'aider.

g!rly · Answer

salut crousps,

procede comme ceci :

Télécharge HijackThis ici : 

-> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

Tutoriel d´utilisation (video) :

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

Post le rapport généré ici stp...

et

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

post les deux rapports ici stp

@+

crousps · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:04:04, on 18/01/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\csrss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\System32\svchost.exe
D:\Program Files\aswUpdSv.exe
D:\Program Files\ashServ.exe
I:\WINDOWS\Explorer.EXE
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\alg.exe
I:\WINDOWS\System32\FTRTSVC.exe
D:\Program Files\ashWebSv.exe
D:\Program Files\ashMaiSv.exe
C:\Program Files\qttask.exe
D:\PROGRA~1\ashDisp.exe
I:\WINDOWS\Mixer.exe
I:\WINDOWS\System32\ctfmon.exe
I:\PROGRA~1\Wanadoo\TaskBarIcon.exe
E:\Program Files\PeerGuardian2\pg2.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\Program Files\MSN Messenger\MsnMsgr.Exe
I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
I:\PROGRA~1\Wanadoo\ComComp.exe
I:\PROGRA~1\Wanadoo\Toaster.exe
I:\PROGRA~1\Wanadoo\Inactivity.exe
I:\PROGRA~1\Wanadoo\PollingModule.exe
I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\Program Files\ashSimpl.exe
I:\Program Files\Internet Explorer\iexplore.exe
I:\Program Files\Internet Explorer\iexplore.exe
D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
I:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis.exe
I:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail?service=communiquer&u=http://webmail.wanadoo.fr/wanadoo/inbox.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL
F3 - REG:win.ini: run= 
F2 - REG:system.ini: UserInit=I:\WINDOWS\system32\userinit.exe,I:\WINDOWS\System32
tos.exe,
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {CBFA0E8E-7489-4A16-8D6E-0D58BFFB6134} - I:\WINDOWS\System32\gebyxwv.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684BB} - I:\Program Files\Helper\superfindout.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AdobeUpdater] I:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [userinit] I:\WINDOWS\System32
tos.exe
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\webelated.htm
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - I:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

crousps · Answer

ComboFix 08-01-18.4 - jean-michel 2008-01-18 16:33:59.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.49 [GMT 1:00] Running from: I:\Documents and Settings\jean-michel\Bureau\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . I:\Program Files\Helper I:\Program Files\Helper\superfinderusa.dll I:\Program Files\Helper\superfindout.dll I:\Program Files\Internet Explorer\setupapi.dll I:\WINDOWS\system32\gebyxwv.dll I:\WINDOWS\system32\khfddcy.dll I:\WINDOWS\system32 tos.exe I:\WINDOWS\system32\urqppnn.dll I:\WINDOWS\system32\wsnpoem\audio.dll I:\WINDOWS\system32\wsnpoem\video.dll I:\WINDOWS\system32\wsnpoem . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))))))) . 2008-01-18 16:32 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\NirCmd.exe 2008-01-18 12:25 . 2008-01-18 14:46 d-------- I:\VundoFix Backups 2008-01-13 19:34 . 2008-01-13 19:34 268 --ah----- I:\sqmdata01.sqm 2008-01-13 19:34 . 2008-01-13 19:34 244 --ah----- I:\sqmnoopt01.sqm 2008-01-12 19:54 . 2008-01-12 19:54 244 --ah----- I:\sqmnoopt00.sqm 2008-01-12 19:54 . 2008-01-12 19:54 232 --ah----- I:\sqmdata00.sqm 2008-01-11 20:42 . 2008-01-11 20:42 54,764 --a------ I:\WINDOWS\system32\dxdss.sys 2008-01-11 20:42 . 2008-01-11 20:42 8 --a------ I:\WINDOWS\system32\-1136357504 2008-01-10 12:39 . 2008-01-10 12:39 d-------- I:\WINDOWS\system32\Kaspersky Lab 2008-01-06 15:48 . 2008-01-18 16:43 d-a------ I:\Documents and Settings\All Users\Application Data\TEMP 2008-01-06 15:48 . 2004-08-30 21:00 1,499,136 --a------ I:\WINDOWS\system32\BTCPatcher.exe 2008-01-06 15:48 . 2008-01-06 18:17 39,936 --a------ I:\WINDOWS\system32\NTSpool.exe 2008-01-06 15:48 . 2008-01-06 15:48 37,888 --a------ I:\WINDOWS\system32 ar.exe 2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-01-01 21:26 . 2006-10-08 21:51 23,856 --a------ I:\WINDOWS\system32\spupdsvc.exe 2008-01-01 21:13 . 2006-11-13 14:45 1,419,232 --a------ I:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-01-01 21:13 . 2007-02-27 14:31 21,504 --a------ I:\WINDOWS\system32\drivers\motmodem.sys 2008-01-01 21:12 . 2008-01-01 21:12 d-------- I:\Program Files\Fichiers communs\Motorola Shared 2008-01-01 21:01 . 2008-01-01 21:15 d-------- I:\Program Files\Motorola Phone Tools 2008-01-01 21:01 . 2008-01-17 22:56 d-------- I:\Documents and Settings\All Users\Application Data\BVRP Software 2007-12-31 14:34 . 2007-12-31 14:34 54,156 --ah----- I:\WINDOWS\QTFont.qfn 2007-12-31 14:34 . 2007-12-31 14:34 1,409 --a------ I:\WINDOWS\QTFont.for 2007-12-31 13:21 . 2007-12-31 13:21 d-------- I:\Documents and Settings\jean-michel\Application Data\Arcsoft 2007-12-31 12:50 . 2007-12-31 12:50 d-------- I:\Documents and Settings\jean-michel\Application Data\Panasonic 2007-12-31 12:04 . 2007-12-31 12:04 d-------- I:\WINDOWS\Cache 2007-12-31 12:03 . 2007-12-31 12:03 d-------- I:\Program Files\Fichiers communs\ArcSoft 2007-12-31 12:03 . 2005-02-23 14:58 11,776 --a------ I:\WINDOWS\system32\drivers\afc.sys 2007-12-31 12:01 . 2007-12-31 12:01 d-------- I:\Program Files\ArcSoft 2007-12-31 12:01 . 2004-05-04 11:53 1,645,320 --a------ I:\WINDOWS\system32\gdiplus.dll 2007-12-31 12:01 . 1995-08-01 04:44 212,480 --a------ I:\WINDOWS\PCDLIB32.DLL 2007-12-31 12:01 . 2005-01-24 17:16 143,360 --a------ I:\WINDOWS\system32\PhotoBase Screen Saver.scr 2007-12-31 12:01 . 2003-09-20 08:45 21,248 --a------ I:\WINDOWS\system32\drivers\pfc.sys 2007-12-31 11:58 . 2007-12-31 11:58 d-------- I:\Program Files\Panasonic 2007-12-24 22:54 . 2007-12-24 22:57 d-------- I:\Documents and Settings\jean-michel\Contacts 2007-12-24 22:50 . 2008-01-01 21:13 d----c--- I:\WINDOWS\system32\DRVSTORE 2007-12-24 21:57 . 2007-12-24 22:52 d-------- I:\Program Files\MSN Messenger 2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a------ I:\WINDOWS\system32\drivers\mouhid.sys 2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a--c--- I:\WINDOWS\system32\dllcache\mouhid.sys 2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a------ I:\WINDOWS\system32\drivers\hidusb.sys 2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a--c--- I:\WINDOWS\system32\dllcache\hidusb.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 15:43 --------- d-----w I:\Program Files\Wanadoo 2008-01-17 21:56 --------- d--h--w I:\Program Files\InstallShield Installation Information 2008-01-05 23:14 --------- d-----w I:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-01 20:01 92,064 ----a-w I:\Documents and Settings\jean-michel\mqdmmdm.sys 2008-01-01 20:01 9,232 ----a-w I:\Documents and Settings\jean-michel\mqdmmdfl.sys 2008-01-01 20:01 79,328 ----a-w I:\Documents and Settings\jean-michel\mqdmserd.sys 2008-01-01 20:01 66,656 ----a-w I:\Documents and Settings\jean-michel\mqdmbus.sys 2008-01-01 20:01 6,208 ----a-w I:\Documents and Settings\jean-michel\mqdmcmnt.sys 2008-01-01 20:01 5,936 ----a-w I:\Documents and Settings\jean-michel\mqdmwhnt.sys 2008-01-01 20:01 4,048 ----a-w I:\Documents and Settings\jean-michel\mqdmcr.sys 2008-01-01 20:01 25,600 ----a-w I:\Documents and Settings\jean-michel\usbsermptxp.sys 2008-01-01 20:01 22,768 ----a-w I:\Documents and Settings\jean-michel\usbsermpt.sys 2007-12-22 10:48 --------- d-----w I:\Program Files\Google 2007-12-06 20:48 --------- d-----w I:\Program Files\Fichiers communs\Adobe 2007-12-06 17:07 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\AdobeUM 2007-12-06 16:42 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\Microsoft Web Folders 2007-12-06 16:40 --------- d-----w I:\Program Files\microsoft frontpage 2007-12-04 14:56 93,264 ----a-w I:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w I:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w I:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w I:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w I:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w I:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w I:\WINDOWS\system32\AVASTSS.scr 2007-11-29 16:17 --------- d-----w I:\Program Files\Fichiers communs\Ahead 2007-11-24 14:56 --------- d-----w I:\Program Files\Fichiers communs\InstallShield . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312] "PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824] "WOOKIT"="I:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880] "swg"="I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-22 11:48 68856] "AdobeUpdater"="I:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 10:37 2321600] "MsnMsgr"="I:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\qttask.exe" [2007-04-27 09:41 282624] "avast!"="D:\PROGRA~1\ashDisp.exe" [2007-12-04 14:00 79224] "WOOWATCH"="I:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480] "WOOTASKBARICON"="I:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768] "C-Media Mixer"="Mixer.exe" [2002-03-25 15:02 1228800 I:\WINDOWS\mixer.exe] "NeroFilterCheck"="I:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer un] "System Patcher"= BTCPatcher.exe "NTSpool"= NTSpool.exe R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;I:\WINDOWS\System32\DRIVERS\WlanUIG.sys [2005-06-17 10:27] S3 motmodem;Motorola USB CDC ACM Driver;I:\WINDOWS\System32\DRIVERS\motmodem.sys [2007-02-27 14:31] S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);I:\WINDOWS\System32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23] S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;I:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23] S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;I:\WINDOWS\System32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23] S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);I:\WINDOWS\System32\DRIVERS\sea1bus.sys [2007-01-04 12:01] *Newly Created Service* - PGFILTER . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-01-14 21:45:16 I:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - I:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-18 16:43:32 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-18 16:44:49 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-18 15:44:38

crousps · Answer

voila c'est fait.et maintenant que dois je faire?

crousps · Answer

merci encore g!rly . a priori mon probleme avec ce mechant cheval de troie est resolu et je ne peux qu'inviter vos lecteurs a se referer a sa soluce.
sympa.

g!rly · Answer

re,

peux tu poster un nouveau hijack this stp

@+

crousps · Answer

pas de probleme,le voici.Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:12:44, on 18/01/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
D:\Program Files\aswUpdSv.exe
D:\Program Files\ashServ.exe
I:\WINDOWS\system32\spoolsv.exe
I:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\qttask.exe
D:\PROGRA~1\ashDisp.exe
I:\WINDOWS\Mixer.exe
I:\PROGRA~1\Wanadoo\TaskBarIcon.exe
I:\WINDOWS\System32\ctfmon.exe
E:\Program Files\PeerGuardian2\pg2.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\Program Files\MSN Messenger\MsnMsgr.Exe
I:\WINDOWS\System32\svchost.exe
I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
I:\PROGRA~1\Wanadoo\ComComp.exe
I:\PROGRA~1\Wanadoo\Toaster.exe
I:\PROGRA~1\Wanadoo\Inactivity.exe
I:\PROGRA~1\Wanadoo\PollingModule.exe
I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
D:\Program Files\ashWebSv.exe
I:\PROGRA~1\Wanadoo\Watch.exe
I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
D:\Program Files\ashMaiSv.exe
D:\Program Files\ashSimpl.exe
I:\Program Files\Internet Explorer\iexplore.exe
D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
I:\Program Files\Internet Explorer\iexplore.exe
I:\WINDOWS\explorer.exe
E:\Program Files\eMule\emule.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ashDisp.exe
O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\ashWebSv.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - I:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

g!rly · Answer

re,

peux tu egalement refaire un combofix et le poster, car il me manque des infos pour la suite.

@+

crousps · Answer

pas de probleme .ComboFix 08-01-18.4 - jean-michel 2008-01-18 19:25:10.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.39 [GMT 1:00] Running from: I:\Documents and Settings\jean-michel\Bureau\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . I:\Program Files\Helper I:\Program Files\Helper\superfindout.dll . ((((((((((((((((((((((((((((( Fichiers créés 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))))))) . 2008-01-18 17:01 . 2008-01-18 17:01 d-------- I:\Documents and Settings\jean-michel\Application Data\Simply Super Software 2008-01-18 17:01 . 2003-02-02 19:06 153,088 --a------ I:\WINDOWS\system32\UNRAR3.dll 2008-01-18 17:01 . 2002-03-06 00:00 75,264 --a------ I:\WINDOWS\system32\unacev2.dll 2008-01-18 16:32 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\NirCmd.exe 2008-01-18 12:25 . 2008-01-18 14:46 d-------- I:\VundoFix Backups 2008-01-13 19:34 . 2008-01-13 19:34 268 --ah----- I:\sqmdata01.sqm 2008-01-13 19:34 . 2008-01-13 19:34 244 --ah----- I:\sqmnoopt01.sqm 2008-01-12 19:54 . 2008-01-12 19:54 244 --ah----- I:\sqmnoopt00.sqm 2008-01-12 19:54 . 2008-01-12 19:54 232 --ah----- I:\sqmdata00.sqm 2008-01-11 20:42 . 2008-01-11 20:42 54,764 --a------ I:\WINDOWS\system32\dxdss.sys 2008-01-11 20:42 . 2008-01-11 20:42 8 --a------ I:\WINDOWS\system32\-1136357504 2008-01-10 12:39 . 2008-01-10 12:39 d-------- I:\WINDOWS\system32\Kaspersky Lab 2008-01-06 15:48 . 2008-01-18 17:52 d-a------ I:\Documents and Settings\All Users\Application Data\TEMP 2008-01-06 15:48 . 2004-08-30 21:00 1,499,136 --a------ I:\WINDOWS\system32\BTCPatcher.exe 2008-01-06 15:48 . 2008-01-06 18:17 39,936 --a------ I:\WINDOWS\system32\NTSpool.exe 2008-01-06 15:48 . 2008-01-06 15:48 37,888 --a------ I:\WINDOWS\system32\rar.exe 2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-01-01 21:26 . 2006-10-08 21:51 23,856 --a------ I:\WINDOWS\system32\spupdsvc.exe 2008-01-01 21:13 . 2006-11-13 14:45 1,419,232 --a------ I:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-01-01 21:13 . 2007-02-27 14:31 21,504 --a------ I:\WINDOWS\system32\drivers\motmodem.sys 2008-01-01 21:12 . 2008-01-01 21:12 d-------- I:\Program Files\Fichiers communs\Motorola Shared 2008-01-01 21:01 . 2008-01-01 21:15 d-------- I:\Program Files\Motorola Phone Tools 2008-01-01 21:01 . 2008-01-17 22:56 d-------- I:\Documents and Settings\All Users\Application Data\BVRP Software 2007-12-31 14:34 . 2007-12-31 14:34 54,156 --ah----- I:\WINDOWS\QTFont.qfn 2007-12-31 14:34 . 2007-12-31 14:34 1,409 --a------ I:\WINDOWS\QTFont.for 2007-12-31 13:21 . 2007-12-31 13:21 d-------- I:\Documents and Settings\jean-michel\Application Data\Arcsoft 2007-12-31 12:50 . 2007-12-31 12:50 d-------- I:\Documents and Settings\jean-michel\Application Data\Panasonic 2007-12-31 12:04 . 2007-12-31 12:04 d-------- I:\WINDOWS\Cache 2007-12-31 12:03 . 2007-12-31 12:03 d-------- I:\Program Files\Fichiers communs\ArcSoft 2007-12-31 12:03 . 2005-02-23 14:58 11,776 --a------ I:\WINDOWS\system32\drivers\afc.sys 2007-12-31 12:01 . 2007-12-31 12:01 d-------- I:\Program Files\ArcSoft 2007-12-31 12:01 . 2004-05-04 11:53 1,645,320 --a------ I:\WINDOWS\system32\gdiplus.dll 2007-12-31 12:01 . 1995-08-01 04:44 212,480 --a------ I:\WINDOWS\PCDLIB32.DLL 2007-12-31 12:01 . 2005-01-24 17:16 143,360 --a------ I:\WINDOWS\system32\PhotoBase Screen Saver.scr 2007-12-31 12:01 . 2003-09-20 08:45 21,248 --a------ I:\WINDOWS\system32\drivers\pfc.sys 2007-12-31 11:58 . 2007-12-31 11:58 d-------- I:\Program Files\Panasonic 2007-12-24 22:54 . 2007-12-24 22:57 d-------- I:\Documents and Settings\jean-michel\Contacts 2007-12-24 22:50 . 2008-01-01 21:13 d----c--- I:\WINDOWS\system32\DRVSTORE 2007-12-24 21:57 . 2007-12-24 22:52 d-------- I:\Program Files\MSN Messenger 2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a------ I:\WINDOWS\system32\drivers\mouhid.sys 2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a--c--- I:\WINDOWS\system32\dllcache\mouhid.sys 2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a------ I:\WINDOWS\system32\drivers\hidusb.sys 2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a--c--- I:\WINDOWS\system32\dllcache\hidusb.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 18:08 --------- d-----w I:\Program Files\Wanadoo 2008-01-17 21:56 --------- d--h--w I:\Program Files\InstallShield Installation Information 2008-01-05 23:14 --------- d-----w I:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-01 20:01 92,064 ----a-w I:\Documents and Settings\jean-michel\mqdmmdm.sys 2008-01-01 20:01 9,232 ----a-w I:\Documents and Settings\jean-michel\mqdmmdfl.sys 2008-01-01 20:01 79,328 ----a-w I:\Documents and Settings\jean-michel\mqdmserd.sys 2008-01-01 20:01 66,656 ----a-w I:\Documents and Settings\jean-michel\mqdmbus.sys 2008-01-01 20:01 6,208 ----a-w I:\Documents and Settings\jean-michel\mqdmcmnt.sys 2008-01-01 20:01 5,936 ----a-w I:\Documents and Settings\jean-michel\mqdmwhnt.sys 2008-01-01 20:01 4,048 ----a-w I:\Documents and Settings\jean-michel\mqdmcr.sys 2008-01-01 20:01 25,600 ----a-w I:\Documents and Settings\jean-michel\usbsermptxp.sys 2008-01-01 20:01 22,768 ----a-w I:\Documents and Settings\jean-michel\usbsermpt.sys 2007-12-22 10:48 --------- d-----w I:\Program Files\Google 2007-12-06 20:48 --------- d-----w I:\Program Files\Fichiers communs\Adobe 2007-12-06 17:07 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\AdobeUM 2007-12-06 16:42 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\Microsoft Web Folders 2007-12-06 16:40 --------- d-----w I:\Program Files\microsoft frontpage 2007-12-04 14:56 93,264 ----a-w I:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w I:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w I:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w I:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w I:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w I:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w I:\WINDOWS\system32\AVASTSS.scr 2007-11-29 16:17 --------- d-----w I:\Program Files\Fichiers communs\Ahead 2007-11-24 14:56 --------- d-----w I:\Program Files\Fichiers communs\InstallShield . ((((((((((((((((((((((((((((( snapshot@2008-01-18_16.44.19.26 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-18 13:49:00 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-01-18 15:42:45 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-01-18 16:52:04 16,384 ----atw I:\WINDOWS\Temp\Perflib_Perfdata_5e0.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312] "PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824] "WOOKIT"="I:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880] "swg"="I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-22 11:48 68856] "MsnMsgr"="I:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\qttask.exe" [2007-04-27 09:41 282624] "avast!"="D:\PROGRA~1\ashDisp.exe" [2007-12-04 14:00 79224] "WOOWATCH"="I:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480] "WOOTASKBARICON"="I:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768] "C-Media Mixer"="Mixer.exe" [2002-03-25 15:02 1228800 I:\WINDOWS\mixer.exe] "NeroFilterCheck"="I:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048] "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-18 17:01 737872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312] I:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ LUMIX Simple Viewer.lnk - I:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-12-31 11:58:56] Microsoft Office.lnk - I:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56] Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter.lnk - I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2007-11-15 16:53:17] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run] "System Patcher"= BTCPatcher.exe "NTSpool"= NTSpool.exe R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;I:\WINDOWS\System32\DRIVERS\WlanUIG.sys [2005-06-17 10:27] S3 motmodem;Motorola USB CDC ACM Driver;I:\WINDOWS\System32\DRIVERS\motmodem.sys [2007-02-27 14:31] S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);I:\WINDOWS\System32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23] S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;I:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23] S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;I:\WINDOWS\System32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23] S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);I:\WINDOWS\System32\DRIVERS\sea1bus.sys [2007-01-04 12:01] . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-01-14 21:45:16 I:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - I:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-18 19:30:43 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-01-18 19:32:43 ComboFix-quarantined-files.txt 2008-01-18 18:31:47 ComboFix2.txt 2008-01-18 15:44:50

g!rly · Answer

ok

instales un de ces deux par feu :

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html


a l´aide de hijack this coche et fix ceci :

O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll
O4 - HKCU\..\Policies\Explorer\Run: [System Patcher] BTCPatcher.exe
O4 - HKCU\..\Policies\Explorer\Run: [NTSpool] NTSpool.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - I:\WINDOWS\web\related.htm
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - I:\WINDOWS\System32\FTRTSVC.exe

comment fixer :

Tutoriel d´utilisation (video) :

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

puis 

click sur demarrer > executer > dans la boite de dialogue > tape : services.msc et valide par ok
dans la fenetre des services arrete ce service

France Telecom Routing Table Service (FTRTSVC)

en clickant droit dessus et en choisissant "arreter"

puis

Copie le texte ci-dessous :

File::
I:\WINDOWS\system32\NTSpool.exe
I:\WINDOWS\system32\BTCPatcher.exe
I:\Program Files\Helper\superfindout.dll 

Folder::
I:\VundoFix Backups
I:\Program Files\Helper

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684CC}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"NTSpool"=-
"System Patcher"=-

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

@+

crousps · Answer

d'accord,je vais faire ce que tu me dis,mais juste pour info,j'ai recu il y a 2-3 minutes une alerte par rapport a ce fichu cheval de troie(toujours dans windows system32).
en tout cas merci encore de ta gentillesse,de ta disponibilite et de ton talent.
bye (si tout va bien).

g!rly · Answer

re,

oui fais ce que je t´ai demandé, on verras apres si tu as encore des alertes...

@+

crousps · Answer

j'ai fait ce que tu m'as dit sauf que le fichier etait absent (bon signe ?). O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - I:\Program Files\Helper\superfindout.dll ComboFix 08-01-18.4 - jean-michel 2008-01-18 20:49:57.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.0.1252.1.1036.18.60 [GMT 1:00] Running from: I:\Documents and Settings\jean-michel\Bureau\ComboFix.exe Command switches used :: I:\Documents and Settings\jean-michel\CFScript.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE I:\Program Files\Helper\superfindout.dll I:\WINDOWS\system32\BTCPatcher.exe I:\WINDOWS\system32\NTSpool.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . I:\VundoFix Backups I:\VundoFix Backups\awvvs.dll.bad I:\VundoFix Backups\ddcde.dll.bad I:\VundoFix Backups\fccbyab.dll.bad I:\VundoFix Backups\fcywv.dll.bad I:\VundoFix Backups\gebyxwv.dll.bad I:\VundoFix Backups\hgdab.dll.bad I:\VundoFix Backups\hggecbc.dll.bad I:\VundoFix Backups\iiffc.dll.bad I:\VundoFix Backups\khfff.dll.bad I:\VundoFix Backups\ljjhh.dll.bad I:\VundoFix Backups\ljjjihi.dll.bad I:\VundoFix Backups\mljgdbc.dll.bad I:\VundoFix Backups\nnnml.dll.bad I:\VundoFix Backups\opnml.dll.bad I:\VundoFix Backups\oppqo.dll.bad I:\VundoFix Backups\pmnkifc.dll.bad I:\VundoFix Backups\qomkk.dll.bad I:\VundoFix Backups\qomnk.dll.bad I:\VundoFix Backups\ssttt.dll.bad I:\VundoFix Backups\wvwxv.dll.bad I:\VundoFix Backups\xxyvv.dll.bad I:\VundoFix Backups\yabxx.dll.bad I:\VundoFix Backups\yayvwww.dll.bad I:\WINDOWS\system32\BTCPatcher.exe I:\WINDOWS\system32\nnnkhff.dll I:\WINDOWS\system32\NTSpool.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-12-18 to 2008-01-18 )))))))))))))))))))))))))))))))))))) . 2008-01-18 20:27 . 2008-01-18 20:27 d-------- I:\Program Files\Trend Micro 2008-01-18 17:01 . 2008-01-18 17:01 d-------- I:\Documents and Settings\jean-michel\Application Data\Simply Super Software 2008-01-18 17:01 . 2003-02-02 19:06 153,088 --a------ I:\WINDOWS\system32\UNRAR3.dll 2008-01-18 17:01 . 2002-03-06 00:00 75,264 --a------ I:\WINDOWS\system32\unacev2.dll 2008-01-18 16:32 . 2000-08-31 08:00 51,200 --a------ I:\WINDOWS\NirCmd.exe 2008-01-13 19:34 . 2008-01-13 19:34 268 --ah----- I:\sqmdata01.sqm 2008-01-13 19:34 . 2008-01-13 19:34 244 --ah----- I:\sqmnoopt01.sqm 2008-01-12 19:54 . 2008-01-12 19:54 244 --ah----- I:\sqmnoopt00.sqm 2008-01-12 19:54 . 2008-01-12 19:54 232 --ah----- I:\sqmdata00.sqm 2008-01-11 20:42 . 2008-01-11 20:42 54,764 --a------ I:\WINDOWS\system32\dxdss.sys 2008-01-11 20:42 . 2008-01-11 20:42 8 --a------ I:\WINDOWS\system32\-1136357504 2008-01-10 12:39 . 2008-01-10 12:39 d-------- I:\WINDOWS\system32\Kaspersky Lab 2008-01-06 15:48 . 2008-01-18 17:52 d-a------ I:\Documents and Settings\All Users\Application Data\TEMP 2008-01-06 15:48 . 2008-01-06 15:48 37,888 --a------ I:\WINDOWS\system32\rar.exe 2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-01-01 21:27 . 2008-01-01 21:27 0 --ah----- I:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf 2008-01-01 21:26 . 2006-10-08 21:51 23,856 --a------ I:\WINDOWS\system32\spupdsvc.exe 2008-01-01 21:13 . 2006-11-13 14:45 1,419,232 --a------ I:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-01-01 21:13 . 2007-02-27 14:31 21,504 --a------ I:\WINDOWS\system32\drivers\motmodem.sys 2008-01-01 21:12 . 2008-01-01 21:12 d-------- I:\Program Files\Fichiers communs\Motorola Shared 2008-01-01 21:01 . 2008-01-01 21:15 d-------- I:\Program Files\Motorola Phone Tools 2008-01-01 21:01 . 2008-01-17 22:56 d-------- I:\Documents and Settings\All Users\Application Data\BVRP Software 2007-12-31 14:34 . 2007-12-31 14:34 54,156 --ah----- I:\WINDOWS\QTFont.qfn 2007-12-31 14:34 . 2007-12-31 14:34 1,409 --a------ I:\WINDOWS\QTFont.for 2007-12-31 13:21 . 2007-12-31 13:21 d-------- I:\Documents and Settings\jean-michel\Application Data\Arcsoft 2007-12-31 12:50 . 2007-12-31 12:50 d-------- I:\Documents and Settings\jean-michel\Application Data\Panasonic 2007-12-31 12:04 . 2007-12-31 12:04 d-------- I:\WINDOWS\Cache 2007-12-31 12:03 . 2007-12-31 12:03 d-------- I:\Program Files\Fichiers communs\ArcSoft 2007-12-31 12:03 . 2005-02-23 14:58 11,776 --a------ I:\WINDOWS\system32\drivers\afc.sys 2007-12-31 12:01 . 2007-12-31 12:01 d-------- I:\Program Files\ArcSoft 2007-12-31 12:01 . 2004-05-04 11:53 1,645,320 --a------ I:\WINDOWS\system32\gdiplus.dll 2007-12-31 12:01 . 1995-08-01 04:44 212,480 --a------ I:\WINDOWS\PCDLIB32.DLL 2007-12-31 12:01 . 2005-01-24 17:16 143,360 --a------ I:\WINDOWS\system32\PhotoBase Screen Saver.scr 2007-12-31 12:01 . 2003-09-20 08:45 21,248 --a------ I:\WINDOWS\system32\drivers\pfc.sys 2007-12-31 11:58 . 2007-12-31 11:58 d-------- I:\Program Files\Panasonic 2007-12-24 22:54 . 2007-12-24 22:57 d-------- I:\Documents and Settings\jean-michel\Contacts 2007-12-24 22:50 . 2008-01-01 21:13 d----c--- I:\WINDOWS\system32\DRVSTORE 2007-12-24 21:57 . 2007-12-24 22:52 d-------- I:\Program Files\MSN Messenger 2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a------ I:\WINDOWS\system32\drivers\mouhid.sys 2007-12-19 14:48 . 2001-08-23 17:04 12,288 --a--c--- I:\WINDOWS\system32\dllcache\mouhid.sys 2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a------ I:\WINDOWS\system32\drivers\hidusb.sys 2007-12-19 14:48 . 2001-08-17 22:02 9,600 --a--c--- I:\WINDOWS\system32\dllcache\hidusb.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-18 19:54 --------- d-----w I:\Program Files\Wanadoo 2008-01-17 21:56 --------- d--h--w I:\Program Files\InstallShield Installation Information 2008-01-05 23:14 --------- d-----w I:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-01-01 20:01 92,064 ----a-w I:\Documents and Settings\jean-michel\mqdmmdm.sys 2008-01-01 20:01 9,232 ----a-w I:\Documents and Settings\jean-michel\mqdmmdfl.sys 2008-01-01 20:01 79,328 ----a-w I:\Documents and Settings\jean-michel\mqdmserd.sys 2008-01-01 20:01 66,656 ----a-w I:\Documents and Settings\jean-michel\mqdmbus.sys 2008-01-01 20:01 6,208 ----a-w I:\Documents and Settings\jean-michel\mqdmcmnt.sys 2008-01-01 20:01 5,936 ----a-w I:\Documents and Settings\jean-michel\mqdmwhnt.sys 2008-01-01 20:01 4,048 ----a-w I:\Documents and Settings\jean-michel\mqdmcr.sys 2008-01-01 20:01 25,600 ----a-w I:\Documents and Settings\jean-michel\usbsermptxp.sys 2008-01-01 20:01 22,768 ----a-w I:\Documents and Settings\jean-michel\usbsermpt.sys 2007-12-22 10:48 --------- d-----w I:\Program Files\Google 2007-12-06 20:48 --------- d-----w I:\Program Files\Fichiers communs\Adobe 2007-12-06 17:07 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\AdobeUM 2007-12-06 16:42 --------- d-----w I:\Documents and Settings\jean-michel\Application Data\Microsoft Web Folders 2007-12-06 16:40 --------- d-----w I:\Program Files\microsoft frontpage 2007-12-04 14:56 93,264 ----a-w I:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w I:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w I:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w I:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w I:\WINDOWS\system32\drivers\aavmker4.sys 2007-11-29 16:17 --------- d-----w I:\Program Files\Fichiers communs\Ahead 2007-11-24 14:56 --------- d-----w I:\Program Files\Fichiers communs\InstallShield . ((((((((((((((((((((((((((((( snapshot@2008-01-18_16.44.19.26 ))))))))))))))))))))))))))))))))))))))))) . + 2000-08-31 07:00:00 163,328 ----a-w I:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE + 2008-01-18 19:49:41 237,568 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-01-18 19:49:41 8,192 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000002\UsrClass.dat + 2008-01-18 19:49:41 237,568 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000003\NTUSER.DAT + 2008-01-18 19:49:41 8,192 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000004\UsrClass.dat + 2008-01-18 19:49:41 2,310,144 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000005\NTUSER.DAT + 2008-01-18 19:49:41 8,192 ----a-w I:\WINDOWS\erdnt\Hiv-backup\Users\[u]0[/u]0000006\UsrClass.dat - 2008-01-18 13:49:00 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-01-18 15:42:45 16,384 ----a-w I:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat + 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat - 2008-01-18 13:49:00 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-01-18 15:42:45 32,768 ----a-w I:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-01-18 16:52:04 16,384 ----atw I:\WINDOWS\Temp\Perflib_Perfdata_5e0.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F10587E9-0E47-4CBE-84AE-7DD20B8684CC}] 2008-01-18 20:55 15872 --a------ I:\Program Files\Helper\superfindout.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\System32\ctfmon.exe" [2001-08-28 13:00 13312] "PeerGuardian"="E:\Program Files\PeerGuardian2\pg2.exe" [2005-09-18 18:40 1421824] "WOOKIT"="I:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 14:50 122880] "swg"="I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-22 11:48 68856] "MsnMsgr"="I:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="C:\Program Files\qttask.exe" [2007-04-27 09:41 282624] "avast!"="D:\PROGRA~1\ashDisp.exe" [2007-12-04 14:00 79224] "WOOWATCH"="I:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480] "WOOTASKBARICON"="I:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768] "C-Media Mixer"="Mixer.exe" [2002-03-25 15:02 1228800 I:\WINDOWS\mixer.exe] "NeroFilterCheck"="I:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Adobe Reader Speed Launcher"="I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048] "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-01-18 17:01 737872] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="I:\WINDOWS\System32\CTFMON.EXE" [2001-08-28 13:00 13312] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5E85C971-F9E7-4F4D-A059-14FA00220C7A}"= I:\WINDOWS\System32\nnnkhff.dll [ ] R3 WlanUIG;Sagem 802.11g Wireless LAN USB Adapter Driver;I:\WINDOWS\System32\DRIVERS\WlanUIG.sys [2005-06-17 10:27] S3 motmodem;Motorola USB CDC ACM Driver;I:\WINDOWS\System32\DRIVERS\motmodem.sys [2007-02-27 14:31] S3 SE2Ebus;Sony Ericsson Device 046 Driver driver (WDM);I:\WINDOWS\System32\DRIVERS\SE2Ebus.sys [2006-11-10 18:23] S3 SE2Emdfl;Sony Ericsson Device 046 USB WMC Modem Filter;I:\WINDOWS\System32\DRIVERS\SE2Emdfl.sys [2006-11-10 18:23] S3 SE2Emdm;Sony Ericsson Device 046 USB WMC Modem Driver;I:\WINDOWS\System32\DRIVERS\SE2Emdm.sys [2006-11-10 18:23] S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);I:\WINDOWS\System32\DRIVERS\sea1bus.sys [2007-01-04 12:01] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-01-14 21:45:16 I:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - I:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-18 20:54:39 Windows 5.1.2600 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-18 20:56:10 - machine was rebooted [jean-michel] ComboFix-quarantined-files.txt 2008-01-18 19:55:59 ComboFix2.txt 2008-01-18 18:32:45 ComboFix3.txt 2008-01-18 15:44:50 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:08:01, on 18/01/2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: I:\WINDOWS\System32\smss.exe I:\WINDOWS\system32\winlogon.exe I:\WINDOWS\system32\services.exe I:\WINDOWS\system32\lsass.exe I:\WINDOWS\system32\svchost.exe I:\WINDOWS\System32\svchost.exe D:\Program Files\aswUpdSv.exe D:\Program Files\ashServ.exe I:\WINDOWS\Explorer.EXE I:\WINDOWS\system32\spoolsv.exe C:\Program Files\qttask.exe D:\PROGRA~1\ashDisp.exe I:\WINDOWS\Mixer.exe I:\PROGRA~1\Wanadoo\TaskBarIcon.exe I:\WINDOWS\System32\ctfmon.exe E:\Program Files\PeerGuardian2\pg2.exe I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe I:\Program Files\MSN Messenger\MsnMsgr.Exe I:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe I:\PROGRA~1\Wanadoo\Toaster.exe I:\PROGRA~1\Wanadoo\Inactivity.exe I:\PROGRA~1\Wanadoo\PollingModule.exe I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE D:\Program Files\ashWebSv.exe I:\WINDOWS\system32\notepad.exe D:\Program Files\ashMaiSv.exe I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe D:\Program Files\ashSimpl.exe I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe I:\PROGRA~1\Wanadoo\ComComp.exe I:\PROGRA~1\Wanadoo\Watch.exe I:\Program Files\Internet Explorer\iexplore.exe D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe I:\Program Files\Internet Explorer\iexplore.exe I:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ashDisp.exe O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM= O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Global Startup: LUMIX Simple Viewer.lnk = ? O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ? O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\ashWebSv.exe O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

crousps · Answer

par contre g!rly est ce qu'un pare feu est indispensable car d'abord je n'arrive pas a ouvrir kerio(il me met un message d'erreur) et j'ai deja utilise zone alarm,mais avec emule c'est pas le grand amour.alors comme protection,je me sert d'avast et de peer guardian et c'est vrai que jusqu'a present je n'avais jamais eu de soucis.

g!rly · Answer

re,

oui c´est mieux ;-)

maintenant :

tu surf avec internet explorer 6.0 = failles de securitées importantes

alors fais les mises a jour windows : tu veux la version 7.0 

et pourquoi ne pas surfer avec firefox? = plus sur,  tout en gardant ie 7.0 pour les mises a jour windows car impossible a effectuer sous firefox

http://www.firefox.fr/ 

ta version de acrobat reader n´est pas a jour, tu veux la version 8.1 derniere en date alors desinstale ta version par le panneau de configuration / ajoue et suppression de programme

et instale la derniere :

https://get2.adobe.com/reader/otherversions/

ou foxit plus léger :

https://www.clubic.com/telecharger-fiche13808-foxit-reader.html

tu n´as pas de par feu :
instales un des deux ci dessosus

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

ou zone alarm plus facil a configurer mais moins performant

http://www.kachouri.com/tuto/tuto-143-zonealarm-installation-du-firewall--pare-feu.html

puis :

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instal l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php <- tutoriel configuration du scanner...

une fois antivir ouvert click sur configuration et coche la case "expert mode" puis click sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite puis dans la nouvelle fenetre a gauche >scanner > scan all files et en dessous >scanner priority = High
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

je te dis ca car j´aimerais que tu fasse un scan complet de ta machine et que tu post le rapport ici 

donc post le rapport d´antivir dans ta preochaine réponse.

@+

crousps · Answer

bon c'est toi le ou la specialiste alors je vais suivre tes conseils et recommander tes soluces a ceux ou celles qui auraient le meme probleme.et je voudrais encore te dire merci pour tout et bonne continuation.(je noublie pas de poster le rapport d'antivir).bye.

g!rly · Answer

ok

bonne soirée`

@+

crousps · Answer

bonjour g!rly voici le rapport d'antivir que tu m'as demande. AntiVir PersonalEdition Classic Report file date: vendredi 18 janvier 2008 23:27 Scanning for 1056958 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (plain) [5.1.2600] Username: jean-michel Computer name: LOLO-NF9R3QWUIE Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:14:01 ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 15/01/2008 22:14:01 ANTIVIR3.VDF : 7.0.2.20 225792 Bytes 18/01/2008 22:14:01 AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 18/01/2008 22:14:01 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 18/01/2008 22:14:01 AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21 Configuration settings for the scan: Jobname..........................: Manual Selection Configuration file...............: I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp Logging..........................: low Primary action...................: repair Secondary action.................: delete Scan master boot sector..........: off Scan boot sector.................: on Boot sectors.....................: J:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, Macro heuristic..................: on File heuristic...................: high Start of the scan: vendredi 18 janvier 2008 23:27 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'PeerGuardian_1.99b_pr14.exe' - '1' Module(s) have been scanned Scan process 'pg2.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned Scan process 'PollingModule.exe' - '1' Module(s) have been scanned Scan process 'Inactivity.exe' - '1' Module(s) have been scanned Scan process 'Toaster.exe' - '1' Module(s) have been scanned Scan process 'ComComp.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'EspaceWanadoo.exe' - '1' Module(s) have been scanned Scan process 'WLANUTL.exe' - '1' Module(s) have been scanned Scan process 'PhLeAutoRun.exe' - '1' Module(s) have been scanned Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned Scan process 'ctfmon.exe' - '1' Module(s) have been scanned Scan process 'mixer.exe' - '1' Module(s) have been scanned Scan process 'qttask.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 34 processes with 34 modules were scanned Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Boot sector 'E:\' [NOTE] No virus was found! Boot sector 'F:\' [NOTE] No virus was found! Boot sector 'I:\' [NOTE] No virus was found! Boot sector 'J:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '36' files ). Starting the file scan: Begin scan in 'C:\' C:\imvmi.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '48072838.qua' ( QUARANTINE ) [INFO] The file was deleted! C:\ugmsfom.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '47fe2833.qua' ( QUARANTINE ) [INFO] The file was deleted! C:\yamwm.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '47fe282d.qua' ( QUARANTINE ) [INFO] The file was deleted! Begin scan in 'D:\' Begin scan in 'E:\' E:\Program Files\eMule\Temp\011.part [0] Archive type: ACE --> Breakaway Angel\01-Puttin' Out Fires.mp3 [WARNING] Error creating the file [WARNING] Error creating the file E:\Program Files\eMule\Temp\018.part [0] Archive type: ACE --> nils lofgren\Nils Lofgren - Code of the Road - Code of the Road.mp3 [WARNING] Error creating the file --> nils lofgren\Nils Lofgren - Code of the Road - Shine silently.mp3 [WARNING] No further files can be extracted from this archive. The archive will be closed [WARNING] No further files can be extracted from this archive. The archive will be closed Begin scan in 'F:\' F:\Documents and Settings\jm\Local Settings\Temp\update_12.exe [DETECTION] Contains detection pattern of the dropper DR/WinFetcher.C [INFO] A backup was created as '47f5748c.qua' ( QUARANTINE ) [INFO] The file was deleted! Begin scan in 'I:\' I:\pagefile.sys [WARNING] The file could not be opened! I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\47fe282d.qua [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '47f78156.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\48072838.qua [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '47c18158.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CTO1AHG3\df34[1].htm [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '47c481e0.qua'! I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\G7A7EBQL\df34[1].htm [DETECTION] Contains suspicious code HEUR/Malware [INFO] The file was moved to '46adc549.qua'! I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GLIFMDUP\sdfsdf[1].htm [DETECTION] Is the Trojan horse TR/Agent.131072.D.2 [INFO] A backup was created as '47f781de.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\Y5KXAH0Z\sdfsdf[1].htm [DETECTION] Is the Trojan horse TR/Agent.131072.D.2 [INFO] A backup was created as '47f781df.qua' ( QUARANTINE ) [WARNING] The file could not be deleted! I:\program1\Adobe Photoshop CS3 Crack.rar [0] Archive type: CAB (Microsoft) --> BTCPatcher.exe [DETECTION] Is the Trojan horse TR/Drop.Age.1499136 [INFO] A backup was created as '48008444.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\program1\DVD Cloner II v2.35+ Dvd Fab Gold + Platinum.zip [0] Archive type: ZIP --> DVD Fab Platinum-Gold-Express 2.70 (With Key Generator).rar [1] Archive type: RAR --> Keygen.exe [DETECTION] Is the Trojan horse TR/Agent.361747 [INFO] A backup was created as '47d58474.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\catchme2008-01-18_164244.56.zip [0] Archive type: ZIP --> ntos.exe [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '48058c69.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\Program Files\Internet Explorer\setupapi.dll.vir [DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen [INFO] A backup was created as '48058c6e.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\VundoFix Backups\fccbyab.dll.bad.vir [DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo [INFO] A backup was created as '47f48c6d.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\VundoFix Backups\hggecbc.dll.bad.vir [DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo [INFO] A backup was created as '47f88c72.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\VundoFix Backups\pmnkifc.dll.bad.vir [DETECTION] Is the Trojan horse TR/Drop.Vundo.dvo [INFO] A backup was created as '47ff8c7a.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\VundoFix Backups\yayvwww.dll.bad.vir [DETECTION] Is the Trojan horse TR/Vundo.dvo.5 [INFO] A backup was created as '480a8c6f.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\WINDOWS\system32\BTCPatcher.exe.vir [DETECTION] Is the Trojan horse TR/Drop.Age.1499136 [INFO] A backup was created as '47d48c63.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\WINDOWS\system32\khfddcy.dll.vir [DETECTION] Is the Trojan horse TR/Dldr.Small.hoo.1 [INFO] A backup was created as '47f78c77.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\WINDOWS\system32 nnkhff.dll.vir [DETECTION] Is the Trojan horse TR/Trash.Gen [INFO] A backup was created as '47ff8c7d.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\WINDOWS\system32 tos.exe.vir [DETECTION] Is the Trojan horse TR/Trash.Gen [INFO] A backup was created as '48008c84.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\QooBox\Quarantine\I\WINDOWS\system32\urqppnn.dll.vir [DETECTION] Is the Trojan horse TR/Dldr.Small.hoo.1 [INFO] A backup was created as '48028c82.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\WINDOWS\system32\dxdss.sys [WARNING] The file could not be opened! I:\WINDOWS\Temp\76906FCF.exe [WARNING] The file could not be opened! I:\WINDOWS\Temp\CF7DAB1A.exe [DETECTION] Is the Trojan horse TR/Agent.131072.D.2 [INFO] A backup was created as '47c88eed.qua' ( QUARANTINE ) [INFO] The file was deleted! I:\zic\Le Petit Roi - Jean-Pierre Ferland(320KBPS).ace [0] Archive type: ACE --> Le Petit Roi - Jean-Pierre Ferland\05 - Le Chat Du Caf‚ Des Artistes.mp3 [WARNING] Error creating the file --> Le Petit Roi - Jean-Pierre Ferland\06 - Les Immortelles.mp3 [WARNING] No further files can be extracted from this archive. The archive will be closed [WARNING] No further files can be extracted from this archive. The archive will be closed Begin scan in 'J:\' J: ele\Les Rita Mitsouko - La femme trombone Lame - 192kbps.ace [0] Archive type: ACE --> Les Rita Mitsouko\La Femme Trombone\01-Les Rita Mitsouko-La Femme Trombone-entr‚e.mp3 [WARNING] Error creating the file --> Les Rita Mitsouko\La Femme Trombone\02-Les Rita Mitsouko-La Femme Trombone-‚vasion.mp3 [WARNING] No further files can be extracted from this archive. The archive will be closed [WARNING] No further files can be extracted from this archive. The archive will be closed End of the scan: samedi 19 janvier 2008 08:43 Used time: 9:15:58 min The scan has been done completely. 11946 Scanning directories 735681 Files were scanned 22 viruses and/or unwanted programs were found 2 Files were classified as suspicious: 21 files were deleted 0 files were repaired 24 files were moved to quarantine 0 files were renamed 3 Files cannot be scanned 735659 Files not concerned 7548 Archives were scanned 16 Warnings 4 Notes

g!rly · Answer

bonjour, fais ceci :

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis ! 

@+

crousps · Answer

ok mais avant de faire tout ca,est ce que je dois supprimer les virus detecter par antivir ou n'est ce pas necessaire?

g!rly · Answer

oui supprime les...

peux tu me poster un rapport si tu as moyen?

@+

crousps · Answer

oui mais lequel?

g!rly · Answer

celui d´antivir

crousps · Answer

ok quand j'aurais fait tout ca je referais un scan avec antivir et je te posterais le rapport.

g!rly · Answer

ok ;-)

crousps · Answer

voila le rapport de sdfix et de hijackthis en attendant celui d'antivir.
SDFix: Version 1.129

Run by jean-michel on 19/01/2008 at 13:43

Microsoft Windows XP [version 5.1.2600]

Running From: I:\DOCUME~1\JEAN-M~1\Bureau\SDFix\SDFix

Safe Mode:
Checking Services: 


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Service mp32 - Deleted after Reboot

Normal Mode:
Checking Files: 

Trojan Files Found:

I:\Program Files\Helper\superfindout.dll - Deleted
I:\WINDOWS\system32\dxdss.sys  - Deleted



Folder I:\Program Files\Helper - Removed


Removing Temp Files...

ADS Check:

I:\WINDOWS
No streams found. 

I:\WINDOWS\system32
No streams found. 

I:\WINDOWS\system32\svchost.exe
No streams found.
 
I:\WINDOWS\system32
toskrnl.exe
No streams found.
 


                                 Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 13:49:40
Windows 5.1.2600  NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"DhcpNameServer"="192.168.1.1 0.0.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FA32F2E9-42FD-4682-9B73-510ADAAF424B}]
"DhcpNameServer"="192.168.1.1 0.0.0.0"
"DhcpDefaultGateway"=str(7):"192.168.1.1\0"
"DhcpSubnetMaskOpt"=str(7):"255.255.255.0\0"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{FA32F2E9-42FD-4682-9B73-510ADAAF424B}\Parameters\Tcpip]
"DhcpDefaultGateway"=str(7):"192.168.1.1\0"
"DhcpSubnetMaskOpt"=str(7):"255.255.255.0\0"

scanning hidden registry entries ...

scanning hidden files ...


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - I:\DOCUME~1\JEAN-M~1\Bureau\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 21 Dec 2007         4,348 ..SH. --- "I:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 13 Jan 2008        31,232 ...H. --- "I:\Documents and Settings\jean-michel\Mes documents\~WRL0995.tmp"
Mon 13 Nov 2006       319,456 A..H. --- "I:\Program Files\Fichiers communs\Motorola Shared\MotPCSDrivers\difxapi.dll"
Sun 13 Jan 2008        19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0003.tmp"
Sun 13 Jan 2008        19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0005.tmp"
Sun 13 Jan 2008        36,864 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0343.tmp"
Sun 13 Jan 2008        33,792 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0891.tmp"
Sun 13 Jan 2008        19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1058.tmp"
Sun 13 Jan 2008        19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1963.tmp"
Sun 13 Jan 2008        19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1973.tmp"
Sun 13 Jan 2008        33,280 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1981.tmp"
Sun 13 Jan 2008        19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL2082.tmp"
Sun 13 Jan 2008        31,232 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL2769.tmp"

Finished! 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:59:04, on 19/01/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\WINDOWS\system32
otepad.exe
C:\Program Files\qttask.exe
I:\PROGRA~1\Wanadoo\TaskBarIcon.exe
I:\WINDOWS\Mixer.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\WINDOWS\System32\ctfmon.exe
E:\Program Files\PeerGuardian2\pg2.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
I:\Program Files\MSN Messenger\MsnMsgr.Exe
I:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
I:\PROGRA~1\Wanadoo\ComComp.exe
I:\PROGRA~1\Wanadoo\Toaster.exe
I:\PROGRA~1\Wanadoo\Inactivity.exe
I:\PROGRA~1\Wanadoo\PollingModule.exe
I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
I:\PROGRA~1\Wanadoo\Watch.exe
D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
i:\program files\avira\antivir personaledition classic\avscan.exe
I:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

g!rly · Answer

oui post celui d´antivir stp

crousps · Answer

voila.

AntiVir PersonalEdition Classic
Report file date: samedi 19 janvier 2008  17:03

Scanning for 1056958 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (plain)  [5.1.2600]
Username:         jean-michel
Computer name:    LOLO-NF9R3QWUIE

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 13:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 12:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 15:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  14/12/2007 22:14:01
ANTIVIR2.VDF : 7.0.2.0      948736 Bytes  15/01/2008 22:14:01
ANTIVIR3.VDF : 7.0.2.20     225792 Bytes  18/01/2008 22:14:01
AVEWIN32.DLL : 7.6.0.48    3080704 Bytes  18/01/2008 22:14:01
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 10:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 07:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes  18/01/2008 22:14:01
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 07:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 07:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 11:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 12:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 12:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: delete
Scan master boot sector..........: off
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox, 
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922

Start of the scan: samedi 19 janvier 2008  17:03

Starting search for hidden objects.
'272559' objects were checked, '0' hidden objects were found.


End of the scan: samedi 19 janvier 2008  17:27
Used time: 23:56 min

The scan has been done completely.

      0 Scanning directories
      0 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
 272559 Objects were scanned with rootkit scan
      0 Hidden objects were found

g!rly · Answer

ok, c´est plutot positif ;-)
comment va ton pc?
@+

crousps · Answer

ecoute ca marche plutot bien. je n'ai plus d'alerte et j'essaie de suivre tes conseils a la lettre.donc a priori R.A.S

seyaba · Answer

http://www.commentcamarche.net/forum/affich 4697782 trojan win32 tratbho trj

boro · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:13, on 20/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\csrss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\System32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\System32\alg.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\SOUNDMAN.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
H:\Program Files\HP\HP Software Update\HPWuSchd2.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\Labtec\Desktop\V5.1\moffice.exe
H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
H:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE
H:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
H:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\SuperCopier2\SuperCopier2.exe
H:\Program Files\PowerArchiver\PASTARTER.EXE
H:\Program Files\Labtec\Desktop\V5.1\MOUSE32A.EXE
H:\Program Files\MSN Messenger\msnmsgr.exe
H:\Program Files\OLITEC - Moniteur réseau 802.11g\WlanUtil.exe
H:\WINDOWS\System32\PAStiSvc.exe
H:\Program Files\MSN Messenger\usnsvc.exe
H:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
H:\PROGRA~1\MOZILL~1\FIREFOX.EXE
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe
H:\WINDOWS\system32\wbem\wmiprvse.exe
H:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = John Sina
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - H:\Program Files\Multi_Media_France	bMul1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - H:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - H:\WINDOWS\system32\urqopol.dll
O2 - BHO: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - H:\Program Files\Multi_Media_France	bMul1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {CFC8A0ED-00A7-4554-B810-A2F6CEE9F5A4} - (no file)
O3 - Toolbar: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - H:\Program Files\Multi_Media_France	bMul1.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - H:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "H:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] H:\Program Files\Labtec\Desktop\V5.1\moffice.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Nero DriveSpeed] H:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "H:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "H:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] H:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [PowerArchiver Tray] H:\Program Files\PowerArchiver\PASTARTER.EXE
O4 - HKCU\..\Run: [msnmsgr] "H:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "H:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancer l'utilitaire Olitec.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://H:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: urqopol - H:\WINDOWS\SYSTEM32\urqopol.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: STI Simulator - Unknown owner - H:\WINDOWS\System32\PAStiSvc.exe

boro · Answer

ComboFix 08-01-20.1 - moussa 2008-01-20 14:55:43.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.567 [GMT 1:00] Running from: H:\Documents and Settings\moussa\Bureau\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . H:\Autorun.inf H:\Documents and Settings\bouba\Application Data\Hotbar_Icons H:\Documents and Settings\bouba\Application Data\Hotbar_Icons\meetic.ico H:\Documents and Settings\bouba\Application Data\Hotbar_Icons\Registryrepair.ico H:\Documents and Settings\bouba\Application Data\Hotbar_Icons\wallpapere1.ico H:\Documents and Settings\bouba\Bureau\Free PC Wallpapers.lnk H:\Documents and Settings\moussa\Application Data\FunWebProducts H:\Documents and Settings\moussa\Application Data\ShoppingReport H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\Config.xml H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\db\Aliases.dbs H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\db\Sites.dbs H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\dwld\WhiteList.xip H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\report\aggr_storage.xml H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\report\send_storage.xml H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\res2\WhiteList.dbs H:\Documents and Settings\moussa\ravmonlog H:\Program Files\FunWebProducts H:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html H:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html H:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html H:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html H:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html H:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html H:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html H:\Program Files\internet explorer\msimg32.dll H:\Program Files\MyWebSearch H:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG H:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR H:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE H:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL H:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV H:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT H:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL H:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR H:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST H:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL H:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL H:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE H:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL H:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR H:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST H:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL H:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL H:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL H:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE H:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE H:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE H:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL H:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE H:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL H:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL H:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL H:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S H:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]2FD1F75 H:\Program Files\MyWebSearch\bar\Cache\145AA73F.bin H:\Program Files\MyWebSearch\bar\Cache\145AA952.bin H:\Program Files\MyWebSearch\bar\Cache\145AAB27.bin H:\Program Files\MyWebSearch\bar\Cache\145AEACF H:\Program Files\MyWebSearch\bar\Cache\14B31752 H:\Program Files\MyWebSearch\bar\Cache\16585749.bin H:\Program Files\MyWebSearch\bar\Cache\16585A37.bin H:\Program Files\MyWebSearch\bar\Cache\16585BED.bin H:\Program Files\MyWebSearch\bar\Cache\16585DF0.bin H:\Program Files\MyWebSearch\bar\Cache\165B58F0.bin H:\Program Files\MyWebSearch\bar\Cache\165B5A96.bin H:\Program Files\MyWebSearch\bar\Cache\165B5C3C.bin H:\Program Files\MyWebSearch\bar\Cache\165B5DA4.bin H:\Program Files\MyWebSearch\bar\Cache\165B5EFB.bin H:\Program Files\MyWebSearch\bar\Cache\165B6034 H:\Program Files\MyWebSearch\bar\Cache\files.ini H:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S H:\Program Files\MyWebSearch\bar\Game\CHESS.F3S H:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S H:\Program Files\MyWebSearch\bar\History\search2 H:\Program Files\MyWebSearch\bar\icons\CM.ICO H:\Program Files\MyWebSearch\bar\icons\MFC.ICO H:\Program Files\MyWebSearch\bar\icons\PSS.ICO H:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO H:\Program Files\MyWebSearch\bar\icons\WB.ICO H:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO H:\Program Files\MyWebSearch\bar\Message\COMMON.F3S H:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S H:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S H:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S H:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S H:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S H:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S H:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S H:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S H:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S H:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S H:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S H:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm H:\Program Files\MyWebSearch\bar\Settings\s_pid.dat H:\Program Files\ShoppingReport H:\Program Files\ShoppingReport\Uninst.exe H:\WINDOWS\system32\awvtq.dll H:\WINDOWS\system32\ddcyw.dll H:\WINDOWS\system32\f3PSSavr.scr H:\WINDOWS\system32\jkkjj.dll H:\WINDOWS\system32\jkklj.dll H:\WINDOWS\system32\jkklm.dll H:\WINDOWS\system32\mlljg.dll H:\WINDOWS\system32\mllji.dll H:\WINDOWS\system32\oqtwa.ini H:\WINDOWS\system32\oqtwa.ini2 H:\WINDOWS\system32\pmkhi.dll H:\WINDOWS\system32\pmnll.dll H:\WINDOWS\system32\sstqq.dll H:\WINDOWS\system32\ssttr.dll H:\WINDOWS\system32\urqopol.dll H:\WINDOWS\system32\vtstq.dll H:\WINDOWS\system32\vtstr.dll . ((((((((((((((((((((((((((((( Fichiers créés 2007-12-20 to 2008-01-20 )))))))))))))))))))))))))))))))))))) . 2008-01-20 14:50 . 2000-08-31 08:00 51,200 --a------ H:\WINDOWS\NirCmd.exe 2008-01-20 14:33 . 2008-01-20 14:33 d-------- H:\Program Files\Trend Micro 2008-01-17 14:53 . 2008-01-17 14:53 d-------- H:\Documents and Settings\bouba\Contacts 2008-01-16 18:00 . 2008-01-16 18:00 d-------- H:\Documents and Settings\bouba\Application Data\Yahoo! 2008-01-16 09:17 . 2008-01-16 09:17 57 --a------ H:\WINDOWS\DcmLtbox-WS.ini 2008-01-05 20:12 . 2008-01-05 20:12 d-------- H:\Program Files\KONAMI 2008-01-05 08:30 . 2007-10-11 00:49 6,065,664 -----c--- H:\WINDOWS\system32\dllcache\ieframe.dll 2008-01-05 08:30 . 2007-07-01 04:31 2,455,488 -----c--- H:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-01-05 08:30 . 2007-07-01 04:36 1,048,576 -----c--- H:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-01-05 08:30 . 2007-10-11 00:49 459,264 -----c--- H:\WINDOWS\system32\dllcache\msfeeds.dll 2008-01-05 08:30 . 2007-10-11 00:49 383,488 -----c--- H:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-01-05 08:30 . 2007-10-11 00:49 267,776 -----c--- H:\WINDOWS\system32\dllcache\iertutil.dll 2008-01-05 08:30 . 2007-10-11 00:49 63,488 -----c--- H:\WINDOWS\system32\dllcache\icardie.dll 2008-01-05 08:30 . 2007-10-11 00:49 52,224 -----c--- H:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-01-05 08:30 . 2007-10-10 11:59 13,824 -----c--- H:\WINDOWS\system32\dllcache\ieudinit.exe 2008-01-05 08:24 . 2008-01-05 08:31 d-------- H:\WINDOWS\system32\fr-fr 2007-12-28 20:55 . 2007-12-28 20:55 d-------- H:\Program Files\Neuf 2007-12-23 18:14 . 2007-12-23 18:14 268 --ah----- H:\sqmdata19.sqm 2007-12-23 18:14 . 2007-12-23 18:14 244 --ah----- H:\sqmnoopt19.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-20 14:02 --------- d-----w H:\Program Files\MSN Messenger 2008-01-18 18:57 12,772 ----a-w H:\Documents and Settings\moussa\Application Data\wklnhst.dat 2008-01-17 15:54 --------- d-----w H:\Documents and Settings\bouba\Application Data\Ahead 2008-01-17 07:05 --------- d-----w H:\Program Files\eMule 2008-01-16 08:22 --------- d-----w H:\Program Files\Jewel Quest 2008-01-11 18:12 --------- d-----w H:\Program Files\Yahoo! 2008-01-11 18:11 --------- d-----w H:\Program Files\Windows Live Toolbar 2008-01-11 18:09 --------- d-----w H:\Program Files\Google 2008-01-05 09:13 --------- d-----w H:\Program Files\Java 2008-01-05 07:44 --------- d-----w H:\Program Files\PowerArchiver 2007-12-28 16:51 --------- d-----w H:\Program Files\Luxor Amun Rising 2007-12-13 16:38 --------- d-----w H:\Documents and Settings\moussa\Application Data\OpenOffice.org2 2007-12-04 14:56 93,264 -c--a-w H:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w H:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w H:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w H:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w H:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-01 15:52 --------- d-----w H:\Program Files\1964 2007-12-01 02:01 --------- d-----w H:\Program Files\Windows Live Favorites 2007-11-24 14:43 --------- d--h--w H:\Program Files\InstallShield Installation Information 2007-04-15 20:15 36 -c--a-w H:\Program Files\config.2mt 2007-04-07 07:12 4,048 -c--a-w H:\Program Files\hs_err_pid3528.log 2007-04-07 07:12 4,048 -c--a-w H:\Program Files\hs_err_pid3468.log 2007-04-06 09:03 4,125 -c--a-w H:\Program Files\hs_err_pid3896.log 2007-04-05 12:53 4,048 -c--a-w H:\Program Files\hs_err_pid3964.log 2007-04-05 12:53 4,048 -c--a-w H:\Program Files\hs_err_pid3272.log 2007-04-05 12:53 4,047 -c--a-w H:\Program Files\hs_err_pid2224.log 2007-04-04 10:57 120 -c--a-w H:\Program Files\scores8.2mt 2007-03-16 17:59 3,979 -c--a-w H:\Program Files\hs_err_pid3752.log 2007-03-16 17:59 3,921 -c--a-w H:\Program Files\hs_err_pid3664.log 2007-03-15 16:37 3,921 -c--a-w H:\Program Files\hs_err_pid3616.log 2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid3700.log 2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid3676.log 2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid2440.log 2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid2388.log 2007-03-15 16:34 3,980 -c--a-w H:\Program Files\hs_err_pid2188.log 2007-03-15 16:34 3,921 -c--a-w H:\Program Files\hs_err_pid1136.log 2007-03-15 12:09 3,980 -c--a-w H:\Program Files\hs_err_pid4028.log 2007-03-14 12:47 119 -c--a-w H:\Program Files\scores0.2mt 2007-01-25 18:09 15,853 -c-ha-w H:\Program Files\install.log 2005-12-21 16:57 5,572,404 ----a-w H:\Program Files\protect.dll 2005-12-21 16:53 805,888 ----a-w H:\Program Files\Sudoku.exe 2005-12-19 09:05 0 -c--a-w H:\Program Files\log.txt 2005-12-19 09:02 5,055 -c--a-w H:\Program Files\emme.loc 2005-12-16 09:53 161,936 -c--a-w H:\Program Files\Manuel.pdf 2005-12-16 09:24 67 -c--a-w H:\Program Files\Kakuro.url 2005-12-13 15:56 278 -c--a-w H:\Program Files\settings.txt 2005-12-06 11:23 7 -c--a-w H:\Program Files\box dimensions.txt 2005-09-14 12:55 67 -c--a-w H:\Program Files\emme.url 2005-09-09 12:21 11,811,416 -c--a-w H:\Program Files\rp505fra.exe 1999-06-18 11:24 168,207 -c--a-w H:\Program Files\Unstall.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="H:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360] "SuperCopier2.exe"="H:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37 1057280] "PowerArchiver Tray"="H:\Program Files\PowerArchiver\PASTARTER.EXE" [2007-03-20 21:39 141352] "msnmsgr"="H:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352] "Yahoo! Pager"="H:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMan"="SOUNDMAN.EXE" [2006-11-17 05:42 577536 H:\WINDOWS\soundman.exe] "avast!"="H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "HPDJ Taskbar Utility"="H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-14 18:06 176128] "HP Software Update"="H:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49 49152] "DAEMON Tools"="H:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592] "FLMOFFICE4DMOUSE"="H:\Program Files\Labtec\Desktop\V5.1\moffice.exe" [2007-04-05 20:35 958464] "SunJavaUpdateSched"="H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "Adobe Reader Speed Launcher"="H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "NeroFilterCheck"="H:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648] "Nero DriveSpeed"="H:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE" [2004-04-14 05:16 561152] "Adobe Photo Downloader"="H:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="H:\WINDOWS\System32\CTFMON.EXE" [2006-03-02 13:00 15360] R2 MarxDev1;MarxDev1;H:\WINDOWS\system32\drivers\MarxDev1.sys [2001-05-28 15:30] R2 MarxDev2;MarxDev2;H:\WINDOWS\system32\drivers\MarxDev2.sys [2001-05-28 15:30] R2 MarxDev3;MarxDev3;H:\WINDOWS\system32\drivers\MarxDev3.sys [2001-05-28 15:30] R3 Tetris;Tetris driver;H:\WINDOWS\system32\Drivers\Tetris.sys [2007-03-30 21:00] S1 hidfltr;HID Filter Driver;H:\WINDOWS\system32\drivers\MWhid.sys [2004-11-03 11:20] S3 OLITEC(OLITEC);Stick USB 802.11g OLITEC Driver(OLITEC);H:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-09-29 11:00] S3 PAC207;CamMaestro 3.01 DU PC Camera;H:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-05-27 13:57] S3 W700bus;Sony Ericsson W700 Driver driver (WDM);H:\WINDOWS\system32\DRIVERS\W700bus.sys [2006-02-19 16:47] S3 W700mgmt;Sony Ericsson W700 USB WMC Device Management Drivers (WDM);H:\WINDOWS\system32\DRIVERS\W700mgmt.sys [2006-02-19 16:48] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-20 15:08:09 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-20 15:09:53 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-20 14:09:44 . 2008-01-10 02:02:54 --- E O F ---

g!rly · Answer

Pourriez-vous, s'il vous plait, reformuler votre problème avec des phrases complètes; bonjour et merci sont aussi des mots bien appréciés ici, puisque notre seul salaire.
http://www.technicland.com/malpolitus.swf 
@+

crousps · Answer

salut g!rly.
j'ai recu un drole de message me demandant de reformuler mon pb et de dire bonjour,merci...or il me semble que j'ai ete extremement poli avec toi et je me repete mais je tiens encore a te remercier pour tout ce que tu as fait alors,comme c'etait la 1ere fois que je me connectais a ce site,je n'ai pas du en saisir totalement le fonctionnement et la meilleure maniere de l'utiliser.si je t'ai froisse je m'en excuse encore et renouvelle mes remerciements.
a bientot dans de meilleures conditions.

g!rly · Answer

Salut croups,

Ce message était destiné a boro qui a postés des rapports grossièrement...

Aucune offence envers toi, ne t´inquiète pas ;-)

bonne continuation.

Bye`

yi-yang · Answer

bonjour, moi aussi g ce problème de trojan, je suis en train de suivre tes conseil et voici les scan que tu demande:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:49:03, on 28/01/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\WINDOWS\System32undll32.exe
C:\WINDOWS\System32\WDBtnMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: World Tv Center Toolbar - {e077da94-6314-41f1-9f08-6607df65952e} - C:\Program Files\World_Tv_Center	bWor1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: World Tv Center Toolbar - {e077da94-6314-41f1-9f08-6607df65952e} - C:\Program Files\World_Tv_Center	bWor1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: World Tv Center Toolbar - {e077da94-6314-41f1-9f08-6607df65952e} - C:\Program Files\World_Tv_Center	bWor1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\yi-yang\AppData\Local\Temp\efcab.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix: 
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A742957-CEE7-4F4C-89CF-028CA81F602D}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect Express HD 2.0etrorun.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

g!rly · Answer

Bonjour,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt ''

myau · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:31:30, on 04/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\SigmaTel\Pilotes Audio SigmaTel AC97\stacmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0C94B6BD-52F1-4B58-B823-751A1FB5C09E} - C:\Program Files\Internet Explorer\koqe89104.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2EB38E38-536E-4B72-95D6-5DDD69E54D60} - C:\WINDOWS\system32\fccya.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {D85530E8-D39D-49D0-9F36-300D594556D2} - C:\WINDOWS\system32\khfgdcb.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\Pilotes Audio SigmaTel AC97\stacmon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD	oscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: khfgdcb - khfgdcb.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

g!rly · Answer

bonjour ?!

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt ''

Trojan Win32:TratBHO[Trj]

40 réponses

Discussions similaires

Newsletters