Virus msn 17PHolmes...

Question

Bonjour,
 J'ai eut le virus msn dont tout le monde parle, j'ai fiat les manips conseillées voilà mon rapport :

MSNFix 1.639-2  
 
C:\Documents and Settings\Adrien\Bureau\MSNFix 
Fix exécuté le 21/01/2008 - 17:15:26,78 By Adrien 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\DOCUME~1\Adrien\LOCALS~1\Temp\services.exe 
... C:\DOCUME~1\Adrien\LOCALS~1\Temp\services.exe 
... C:\Documents and Settings\Adrien\??????.exe 
... C:\WINDOWS\mrofinu*.exe 
... C:\WINDOWS\mrofinu*.exe.tmp 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
/!\ ...  C:\DOCUME~1\Adrien\LOCALS~1\Temp\services.exe   
/!\ ...  C:\DOCUME~1\Adrien\LOCALS~1\Temp\services.exe   
.. OK ... C:\Documents and Settings\Adrien\??????.exe  
/!\ ...  C:\WINDOWS\mrofinu*.exe   
.. OK ... C:\WINDOWS\mrofinu*.exe.tmp  
 
 
 
************************ Nettoyage du registre 
 

Je dois faire autre chose ? Merci d'avance, bon site !

nardino · Answer

Bonsoir.
Par acquis de conscience, l'outil MSNFix ayant bien fait son travail, nous pouvons contrôler la présence d'une autre infection avec Hijackthis.
Télécharge Hijackthis de Trend Micro:
http://www.trendsecure.com/portal/en-US/threat_analytics/hijackthis.php?page=download
Installes-le.
Il sera dans C:\Program Files\TrendMicro\HijackThis2.0.2\HijackThis.exe
	
	[*]Lances-le par Do a system scan and save a logfile.
	[*]A la fin du scan, un blocnote va s'ouvrir, enregistre le sous HJT1.txt.
	[*]Puis sans le fermer :
CTRL+A pour tout sélectionner
CTRL+C pour copier 
CTRL+V pour coller dans la réponse
	[*]Tu le refermes pour le moment.
	[*]Tu attends les résultats de l'analyse.

Adrienb · Answer

Voici le "HJT1.txt que vous m'avez dit de faire !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:42:29, on 21/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\bhij.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://msnia.login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - C:\Program Files\Helper\superfindout.dll
O2 - BHO: Microsoft copyright - {FFFFFFFF-F538-4f86-ABAF-E9D94D5C007C} - socksys.dll (file missing)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [WintelUpdate] C:\bhij.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

Adrienb · Answer

Est-ce que c'est normal que depuis mon pare-feu de windows arrête pas de se désactiver tout seul ?! J'arrête pas de le remmetre mais il s'enlève, on m'a aussi dit de chercher un fichier nommé mrofinu1148 j'en ai trouvé deux en faisant une recherche jlé ai supprimé.

Adrienb · Answer

Aussi avast vient de me prévenir qu'il avait trouver 3 cheval de troie dont un que je n'arrive ni a supprimer ni à mettre en quarantaine, je sais pas quoi faire ! Mon écran "saute" quelque fois enfin surtout ma barre de tâche !

féessonores · Answer

Bonsoir Nardino !!!

Je te remercie tout d'abord pour l'aide apportée grace à ton mess sur ce putain de virus de merde de msn,

ca fées 3 jours que je beug dessus je suis en 1ere année de bts option develloper et g tt essayer 

meme en ouvrant le virus sous code block en me disant bêtement que je pouvais le remanier et le rendre inefficace lol 

bon ba juste je voulais te dire buen et merci surtout et te demander vite fée si ce mini log que  g télécharger sur ton lien 

fonctionnai avec d'autre virus dans ce genre car j'en ai déjà entendu parler de sdfix

donc je voulais savoir si c'étai le meme ou si c'étai une autre version de ce prog ?

meme si je n'ai pas de réponse ct bien gentil de ta part de prendre 5 min pour régler ce problème sur la toile

bizz @++ je ferai la meme maintenant

nardino · Answer

Bonsoir,
1°-Télécharge Antivir

-Antivir de Avira : https://www.avira.com/

Clique sur "download here" en bas de la colonne Classic et dans la fenêtre suivante clique sur la version de ton système. 
(Attention pas disponible pour Vista 64 bits.)

Enregistre le fichier (16.4 Mo) et installe le programme.
Voici un tutoriel pour ce faire et bien paramétrer le programme.

http://speedweb1.free.fr/frames2.php?page=tuto5
Merci à Tesgaz.

Mets-le à jour et referme-le.

2°-Démarrage en mode sans échec 

Important de faire la procédure sous ce mode.
Il faut choisir la même session que celle qui est infectée et non pas la session Administrateur qui apparaît.

Après la fermeture de la première fenêtre, au tout début de la phase de démarrage du PC (boot), appuie sur F8.
Une fenêtre de type DOS s'ouvre, sélectionne [b]Mode sans échec[/b] à l'aide des flèches du clavier et clique sur Entrée (Enter).
Ne t'inquiète pas de l'aspect, Windows démarre avec le minimum nécessaire et peut prendre quelque minutes pour démarrer.

3°-Scan antivirus

Tu cliques sur l'icône du bureau pour lancer Antivir.
Dans l'onglet Scanner,; tu cliques sur la croix devant Manual Selection et tu coches Poste de travail.
Tu laisses tout coché pour la première analyse.
Tu cliques sur l'icône en forme de loupe en-dessous de Status pour lancer l'analyse qui peut durée une heure.
Il est préférable de ne pas s'éloigner pour répondre aux messages en cas d'alerte.
Tu choisis "Moved to quarantine" pour tout ce qu'il trouve.
Quand le scan est terminé, tu clique sur End.

4°-Redémarrage en mode normal

Tu postes le rapport Antivir.
Tu ouvres le programme et dans l'onglet Reports, choisi Scan avec la date correspondante, double-clique dessus et ensuite sur Report file 
Fais un copier-coller de la totalité du rapport ici avec un nouveau rapport Hijackthis.
Ce programme sera désinstallé ou remplacera ton antivirus existant selon tes souhaits car il ne faut pas garder deux antivirus actifs en même temps.

AdrienB · Answer

Bon okay je fais ça alors et je redis quoi

AdrienB · Answer

Bonjour alors j'ai fait les manips avec antivir voilà le rapport :

AntiVir PersonalEdition Classic
Report file date: mardi 22 janvier 2008 11:04

Scanning for 1060579 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: Adrien
Computer name: BERTEAUX-QN49KU

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:33:40
ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 15/01/2008 22:33:40
ANTIVIR3.VDF : 7.0.2.25 271360 Bytes 21/01/2008 22:33:40
AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 21/01/2008 22:33:41
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 21/01/2008 22:33:41
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: J:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: mardi 22 janvier 2008 11:04

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'aawservice.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
13 processes with 13 modules were scanned

Start scanning boot sectors:
Boot sector 'A:\'
[NOTE] In the drive 'A:\' no data medium is inserted!
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'F:\'
[NOTE] In the drive 'F:\' no data medium is inserted!
Boot sector 'G:\'
[NOTE] In the drive 'G:\' no data medium is inserted!
Boot sector 'H:\'
[NOTE] In the drive 'H:\' no data medium is inserted!
Boot sector 'I:\'
[NOTE] In the drive 'I:\' no data medium is inserted!
Boot sector 'J:\'
[NOTE] In the drive 'J:\' no data medium is inserted!

Starting to scan the registry.
The registry was scanned ( '27' files ).

Starting the file scan:

Begin scan in 'A:\'
Search path A:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'C:\'
C:\cvbkwtb.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '47f7c028.qua'!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\tuwwp.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
[INFO] The file was moved to '480cc02a.qua'!
C:\upaq.exe
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '47f6c028.qua'!
C:\Documents and Settings\Adrien\Bureau\MSNFix\21012008_17184812.zip
[0] Archive type: ZIP
--> backup/aerqow.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/bipsgh.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/bkbszd.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ceztbd.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/cgubut.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ckhasb.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/cuhnai.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/cvpmyr.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/dqnpja.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/dwtoke.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/eesamr.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/efojzp.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/elrdwl.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/esfuhy.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/feibpj.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/fyropn.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/gcjiae.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/gnpyaw.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/govbaq.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/gsjrvn.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/gwbstv.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/gypmrz.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/gzpvlt.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/gzunvf.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/hdvrzb.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/hounma.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/hrsezi.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/htezzx.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/htgykq.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/htpoob.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/huumox.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/hwphsd.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/hzsjcr.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/icpqgq.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/iemuwd.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ikshrr.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/imuori.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/inpwyc.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/iqoqom.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/iyrute.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/iznfhe.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jbtafn.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jcjttw.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jdvtkt.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jgtdht.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jsikrf.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jxcmtx.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jxuzyq.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jytara.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/jzysvo.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/kbypjl.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/kiuexc.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/klsimn.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/lcxdwg.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ldrvbk.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/lnkork.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/lygyap.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/mbvyhm.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/menrdj.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/mllnxl.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/mnmpet.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/moyfwn.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/msnllg.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/nbrfmv.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/nfbscj.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/npwfjt.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/nsxajy.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/ocpuqq.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ojctye.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/okksyw.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/owucxm.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/pihpwa.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/pjusod.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/poyfdp.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/qhwbbx.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/qkmikx.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/qlahck.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/qovqdm.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/qqyjvf.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/qrufgm.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/qwetem.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/qykjfi.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/qzkulf.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/rpczlb.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/rrrrhl.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/rxqwdu.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/seqzrp.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/services.exe
[DETECTION] Contains detection pattern of the worm WORM/IrcBot.46056.1
--> backup/slsokg.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/smngkf.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/taqxsd.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/tlqufb.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/tvddhh.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/txugao.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ukwfbz.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/vpaohl.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/vqdsjm.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/vvxitn.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/vyfwvy.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/wbedgc.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/wrgdfm.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/xbkxwv.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/xealll.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/xfdygk.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/xlnfns.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/xoerhb.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/xtjwtl.exe
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
--> backup/xwfzge.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ycfstw.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/yeucuq.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ytadny.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/ytlsed.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/zaqybf.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/zizuax.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
--> backup/zmkiua.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '47c5c07b.qua'!
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\47f6c028.qua
[DETECTION] Is the Trojan horse TR/Crypt.XPACK.Gen
[INFO] The file was moved to '47fbc13a.qua'!
C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\480cc02a.qua
[DETECTION] Is the Trojan horse TR/Crypt.FSPM.Gen
[INFO] The file was moved to '47c5c13d.qua'!
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinSmallazl.zip
[DETECTION] Contains suspicious code GEN/PwdZIP
[INFO] The file was moved to '4803c184.qua'!
C:\Documents and Settings\Berteaux\Local Settings\Temporary Internet Files\Content.IE5\HKKV8541\in[1].htm
[DETECTION] Contains suspicious code HEUR/Exploit.HTML
[INFO] The file was moved to '47f0c1d8.qua'!
C:\Documents and Settings\Berteaux\Local Settings\Temporary Internet Files\Content.IE5\ISZ3ZWNU\in[1].htm
[DETECTION] Contains suspicious code HEUR/Exploit.HTML
[INFO] The file was moved to '47f0c1db.qua'!
C:\Documents and Settings\Berteaux\Local Settings\Temporary Internet Files\Content.IE5\SRY6TL1Z\in[1].htm
[DETECTION] Contains suspicious code HEUR/Exploit.HTML
[INFO] The file was moved to '47f0c1e1.qua'!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\ISBLM5F7\df34[1].htm
[DETECTION] Is the Trojan horse TR/Agent.18944
[INFO] The file was moved to '47c8c1f5.qua'!
C:\WINDOWS\$NtUninstallKB835732$\callcont.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\helpctr.exe
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\msgina.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\mst120.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\netapi32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll
[WARNING] The file could not be opened!
C:\WINDOWS\$NtUninstallKB835732$\schannel.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\astq.tga
[DETECTION] Is the Trojan horse TR/Rootkit.Gen
[INFO] The file was moved to '4809d2c7.qua'!
Begin scan in 'D:\' <CANON_IJ>
Begin scan in 'E:\' <KINGDOMS>
Begin scan in 'F:\'
Search path F:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'G:\'
Search path G:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'H:\'
Search path H:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'I:\'
Search path I:\ could not be opened!
Le périphérique n'est pas prêt.

Begin scan in 'J:\'
Search path J:\ could not be opened!
Le périphérique n'est pas prêt.

End of the scan: mardi 22 janvier 2008 12:34
Used time: 1:30:41 min

The scan has been done completely.

3877 Scanning directories
176106 Files were scanned
122 viruses and/or unwanted programs were found
4 Files were classified as suspicious:
0 files were deleted
0 files were repaired
12 files were moved to quarantine
0 files were renamed
14 Files cannot be scanned
175984 Files not concerned
1616 Archives were scanned
14 Warnings
0 Notes

Et le rapport de Hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:54:48, on 22/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\bhij.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://msnia.login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - C:\Program Files\Helper\superfindout.dll
O2 - BHO: Microsoft copyright - {FFFFFFFF-F538-4f86-ABAF-E9D94D5C007C} - socksys.dll (file missing)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [WintelUpdate] C:\bhij.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

nardino · Answer

Bonjour.

Tu peux désinstaller Antivir et supprimer le dossier.
Tu peux supprimer MSNFix et son rapport.
Passe un coup de CCleaner que tu conserves pour nettoyer régulièrement les fichiers temporaires.
Conserve AVG et Spybot qui offrent chacun d'eux des services différents et cohabitent sans soucis.
En revanche l'utilité d'Adaware est discutable.

Tu lances Hijackthis par Scan only et tu coches :

O2 - BHO: e404 helper - {F10587E9-0E47-4CBE-84AE-7DD20B8684CC} - C:\Program Files\Helper\superfindout.dll
O2 - BHO: Microsoft copyright - {FFFFFFFF-F538-4f86-ABAF-E9D94D5C007C} - socksys.dll (file missing) 
O4 - HKCU\..\Run: [WintelUpdate] C:\bhij.exe 

Tu cliques sur Fix checked.

Télécharge OTMoveIt : http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe Sur ton bureau. Important.

Tu le lances, il ne nécessite pas d'installation.
Tu inscris (ou tu colles) le chemin du fichier/dossier à supprimer (C'est à dire ce qui suit)dans la fenêtre de gauche (Paste List of Files/Folders to be moved) et tu cliques sur MoveIt!.
(La case Unregister Dll's and OCX's doit être cochée.)

C:\bhij.exe

Le fichier passe alors dans la fenêtre de droite.
Et tu obtiendras à la racine du système un dossier C:\_OTMoveIt
Dans ce dernier un sous-dossier Moved Files dans lequel il y aura une sauvegarde du/des fichier(s) supprimé(s) et un fichier de ce type
 ********_******.log (mm/jj/aaaa_hh/mm/ss = date et horaire de la suppression).
Tu le posteras par copier-coller pour contrôle.

Redémarre si besoin est et poste le rapport avec un nouveau Hijackthis.

Adrienb · Answer

Alors déjà je n'arrive ni à desinstaller antivir (bizzarement) ou je peux trouver le moyen de l désinstaller ? Et je n'arrive pas non plus a faire la manip avec OTMoveIt. Je ne comprends quel fichier je dois mettre pour le faire "mover" et aller sur la fenêtre de gauche....désolé chuis pas très fort en info.

nardino · Answer

Bonsoir,
Pour désinstaller Antivir, tu passes par Ajout/Suppression des programmes.
Pour OtMoveIt, quand tu l'ouvres , tu copie-colles la liste dans la partie gauche et tu cliques sur le bouton  Move It!
La liste passe alors dans la fenêtre droite et un bloc-note s'ouvre.
Tu postes le copier-coller de ce bloc-note.

Adrienb · Answer

Daccord sauf que quand j'ouvre OTMoveIt il n'ya rien dans la fenêtr de gauche ! Les deux sont vides.

nardino · Answer

Bonjour.
Au temps pour moi.
Tu lances le fichier OTMoveIt.exe et tu cliques sur le bouton Cleanup.
Puis dans le popup [b]Cleanup list download successful. Begin cleanup process ?[/b], accepte par [b]Yes[/b]

takeno · Answer

j'ai eu ceux virus et j'ai réussi a l'enlevé grace a MSNfix, a téléchargersur http://sosvirus.changelog.fr/MSNFix.zip

Virus msn 17PHolmes...

14 réponses

Votre réponse

Discussions similaires

Newsletters