Privacy-danger - Page 2

Résolu
  1. g!rly Contributeur
    salut pbib,

    peux tu faire un scan a l´aide d´antivir et poster le rapport ici stp

    @+
    1. pbib Auteur
      Bonjour
      Excuses moi j'etais parti en week end , voici le rapport

      AntiVir PersonalEdition Classic
      Report file date: dimanche 2 mars 2008 14:50

      Scanning for 1129035 virus strains and unwanted programs.

      Licensed to: Avira AntiVir PersonalEdition Classic
      Serial number: 0000149996-ADJIE-0001
      Platform: Windows XP
      Windows version: (Service Pack 2) [5.1.2600]
      Username: SYSTEM
      Computer name: PASCAL-5C8F1DD3

      Version information:
      BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
      AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
      AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
      LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
      LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
      ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
      ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 15:28:19
      ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 24/02/2008 16:02:53
      ANTIVIR3.VDF : 7.0.2.215 117248 Bytes 29/02/2008 13:49:45
      AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 02/03/2008 13:49:45
      AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
      AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
      AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
      AVPACK32.DLL : 7.6.0.3 360488 Bytes 30/01/2008 15:28:19
      AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
      AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
      AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
      NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
      RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
      RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
      SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

      Configuration settings for the scan:
      Jobname..........................: Complete system scan
      Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
      Logging..........................: low
      Primary action...................: interactive
      Secondary action.................: ignore
      Scan master boot sector..........: on
      Scan boot sector.................: on
      Boot sectors.....................: D:,
      Scan memory......................: on
      Process scan.....................: on
      Scan registry....................: on
      Search for rootkits..............: on
      Scan all files...................: All files
      Scan archives....................: on
      Recursion depth..................: 20
      Smart extensions.................: on
      Macro heuristic..................: on
      File heuristic...................: high

      Start of the scan: dimanche 2 mars 2008 14:50

      Starting search for hidden objects.
      '48468' objects were checked, '0' hidden objects were found.

      The scan of running processes will be started
      Scan process 'iexplore.exe' - '1' Module(s) have been scanned
      Scan process 'avscan.exe' - '1' Module(s) have been scanned
      Scan process 'avcenter.exe' - '1' Module(s) have been scanned
      Scan process 'avgnt.exe' - '1' Module(s) have been scanned
      Scan process 'msimn.exe' - '1' Module(s) have been scanned
      Scan process 'httpd.exe' - '1' Module(s) have been scanned
      Scan process 'avguard.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
      Scan process 'alg.exe' - '1' Module(s) have been scanned
      Scan process 'CALMAIN.exe' - '1' Module(s) have been scanned
      Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned
      Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned
      Scan process 'btwdins.exe' - '1' Module(s) have been scanned
      Scan process 'sched.exe' - '1' Module(s) have been scanned
      Scan process 'nhksrv.exe' - '1' Module(s) have been scanned
      Scan process 'httpd.exe' - '1' Module(s) have been scanned
      Scan process 'KHALMNPR.exe' - '1' Module(s) have been scanned
      Scan process 'KEM.exe' - '1' Module(s) have been scanned
      Scan process 'BTTray.exe' - '1' Module(s) have been scanned
      Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
      Scan process 'MediaCenter.exe' - '1' Module(s) have been scanned
      Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
      Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
      Scan process 'explorer.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'svchost.exe' - '1' Module(s) have been scanned
      Scan process 'lsass.exe' - '1' Module(s) have been scanned
      Scan process 'services.exe' - '1' Module(s) have been scanned
      Scan process 'winlogon.exe' - '1' Module(s) have been scanned
      Scan process 'csrss.exe' - '1' Module(s) have been scanned
      Scan process 'smss.exe' - '1' Module(s) have been scanned
      37 processes with 37 modules were scanned

      Starting master boot sector scan:
      Master boot sector HD0
      [NOTE] No virus was found!
      Master boot sector HD1
      [NOTE] No virus was found!
      Master boot sector HD2
      [NOTE] No virus was found!
      [WARNING] The boot sector file could not be read!
      [WARNING] Error code: 0x0015
      Master boot sector HD3
      [NOTE] No virus was found!
      [WARNING] The boot sector file could not be read!
      [WARNING] Error code: 0x0015

      Start scanning boot sectors:
      Boot sector 'C:\'
      [NOTE] No virus was found!
      Boot sector 'D:\'
      [NOTE] No virus was found!

      Starting to scan the registry.
      The registry was scanned ( '33' files ).

      Starting the file scan:

      Begin scan in 'C:\' <Disque dur 40 Go>
      C:\pagefile.sys
      [WARNING] The file could not be opened!
      Begin scan in 'D:\' <Disque dur 160 Go>

      End of the scan: dimanche 2 mars 2008 15:56
      Used time: 1:06:23 min

      The scan has been done completely.

      6813 Scanning directories
      291849 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
      291849 Files not concerned
      4801 Archives were scanned
      1 Warnings
      0 Notes
      48468 Objects were scanned with rootkit scan
      0 Hidden objects were found
  2. g!rly Contributeur
    salut pbib,

    merci pour le scan ;-)

    fais ceci :

    nettoie tes fichiers temporaires avec ceci : atf cleaner, regarde le tuto...

    http://www.infosecu.fr/atf.html

    telecharge le ici :

    http://serveur1.archive-host.com/membres/up/1366464061/ATF-Cleaner.rar

    Ccleaner:

    -> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo):

    http://www.commentcamarche.net/telecharger/telechargement 168 ccleaner

    -> L´installer.

    -> Une fois installé et lancé :

    Dans la colonne de gauche, click sur :

    ->"erreurs" :

    Coches toutes les cases sous"l´integrité du registre", puis click en bas sur "chercher des erreurs" une fois terminé, clic sur "reparer les erreurs", tu auras un message pour sauvegarder ta base de registre, tu click "oui" puis tu recommence jusqu'à ce qu'il ne trouve plus rien.

    ps : les sauvegardes que tu auras faites, pourront etre supprimées ulterieurement si tout va bien.

    ->"nettoyeur"

    quitte ton navigateur avant de le lancer, dans les propriétés du nettoyeur de l´onglet "windows" et "applications"décoche la derniere case (Avancé si elle est cochée) puis click sur "lancer le nettoyage" qunand il aura terminé le scan click en bas a droite sur "lancer le nettoyage" et accepte par oui.

    -> Tutoriel en image :

    https://www.vulgarisation-informatique.com/nettoyer-windows-ccleaner.php

    -> Pour ceux qui voudraient aller plus loin en compagnie de jesses (fonctions avancés) :

    http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

    Vide tes fichiers temporaires avec ceci:
    ->Clean Up 40:
    http://pageperso.aol.fr/balltrap34/CleanUp40.exe
    ->aide en image:(merci a Balltrap34)
    http://pageperso.aol.fr/balltrap34/democleanup.htm

    click sur option et décoche la case devant : delete prefect files

    vide le manuellement :

    :: Le contenu du dossier prefetch ::

    * C:\WINDOWS\Prefetch <= sauf le fichier layout.ini

    * Ne pas oublier de vider la corbeille !

    pour vider le dossier prefect fais ceci :

    Affiche tous les fichiers et dossiers :
    Pour cela :
    Clique sur démarrer/panneau de configuration/option des dossiers/affichage

    Cocher afficher les dossiers cacher

    Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

    Décocher masquer les extensions dont le type est connu

    Puis fais «Ok» pour valider les changements.

    Et appliquer !

    puis

    telecharge et instal regcleaner:

    http://www.01net.com/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/4894.html

    tutorial :

    https://forums.cnetfrance.fr

    http://www.softastuces.com/tuto/maint/regcleaner/

    dis moi quoi

    @+
    1. pbib Auteur
      Bonjour ,

      Pourrais-tu m'aider concernant mon post du 19/03 car je n'ai pas réponse et je suis presque bloqué ?
      Merci
  4. pbib Auteur
    Bonjour,

    Je pense etre infecté par ultimateCleaner 2007 .

    Je joint le rapport hijackthis

    Merci de la réponse rapide

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:03:33, on 30/03/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\savedump.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Neuf\Media Center\MediaCenter.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\Program Files\Logitech\SetPoint\KEM.exe
    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
    C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
    C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
    C:\Program Files\Neuf\Media Center\httpd\httpd.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    C:\Program Files\Neuf\Media Center\httpd\httpd.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\Program Files\Canon\CAL\CALMAIN.exe
    C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: GNX Rolex - {EA7BD390-28E8-4B98-BED3-D39FA67567C4} - C:\WINDOWS\drnpfdxqfm.dll (file missing)
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: etlrlws - {1A0B93F9-A39E-40E4-82D9-0CA3AD6A5660} - C:\WINDOWS\etlrlws.dll
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
    O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://securite.neuf.fr/Ols/fscax.cab
    O21 - SSODL: altvxvm - {3D6DD288-EE25-4994-A7EA-929A9D634A49} - C:\WINDOWS\altvxvm.dll
    O21 - SSODL: bokpkov - {7C403E35-B18D-462F-A2BE-B175F3A78BF7} - C:\WINDOWS\bokpkov.dll
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
    O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
    O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
    O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
    O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    2. g!rly Contributeur
      de rien,

      Télécharge combofix.exe (par sUBs) sur ton Bureau.

      -> http://download.bleepingcomputer.com/sUBs/ComboFix.exe

      -> Double clique combofix.exe.
      -> Tape sur la touche 1 (Yes) pour démarrer le scan.
      -> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

      NOTE : Le rapport se trouve également ici : C:\Combofix.txt

      Avant d'utiliser ComboFix :

      -> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

      -> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

      Une fois fait, sur ton bureau double-clic sur Combofix.exe.

      - Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

      /!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

      - En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

      - Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

      -> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

      -> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message ainsi qu´un nouveau rapport hijack this.

      -> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

      @+
      1. pbib Auteur
        je joint les 2 rapports

        ComboFix 08-03-30.2 - Pascal 2008-03-30 20:46:49.4 - NTFSx86
        Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.691 [GMT 2:00]
        Endroit: C:\Documents and Settings\Pascal\Bureau\ComboFix.exe

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Documents and Settings\Pascal\Bureau\Error Cleaner.url
        C:\Documents and Settings\Pascal\Bureau\Privacy Protector.url
        C:\Documents and Settings\Pascal\Bureau\Spyware&Malware Protection.url
        C:\Documents and Settings\Pascal\Favoris\Error Cleaner.url
        C:\Documents and Settings\Pascal\Favoris\Privacy Protector.url
        C:\Documents and Settings\Pascal\Favoris\Spyware&Malware Protection.url
        .
        ---- Previous Run -------
        .
        C:\WINDOWS\dat.txt
        C:\WINDOWS\search_res.txt

        .
        ((((((((((((((((((((((((((((( Fichiers créés 2008-02-28 to 2008-03-30 ))))))))))))))))))))))))))))))))))))
        .

        2008-03-19 18:32 . 2008-03-20 18:59 330 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
        2008-03-18 19:11 . 2008-03-18 18:10 270,336 --a------ C:\WINDOWS\altvxvm.dll
        2008-03-18 19:11 . 2008-03-18 18:10 266,240 --a------ C:\WINDOWS\bokpkov.dll
        2008-03-18 19:11 . 2008-03-18 18:10 204,800 --a------ C:\WINDOWS\etlrlws.dll
        2008-03-18 19:11 . 2008-03-18 18:10 94,208 --a------ C:\WINDOWS\fmsxwqs.exe
        2008-03-03 18:39 . 2008-03-03 18:39 <REP> d-------- C:\Program Files\Fichiers communs\InterVideo
        2008-03-03 18:39 . 2008-03-03 18:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InterVideo
        2008-03-03 18:39 . 2007-03-27 20:56 210,456 --a------ C:\WINDOWS\system32\IVIresizeW7.dll
        2008-03-03 18:39 . 2007-03-27 20:56 206,360 --a------ C:\WINDOWS\system32\IVIresizeA6.dll
        2008-03-03 18:39 . 2007-03-27 20:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeP6.dll
        2008-03-03 18:39 . 2007-03-27 20:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeM6.dll
        2008-03-03 18:39 . 2007-03-27 20:56 194,072 --a------ C:\WINDOWS\system32\IVIresizePX.dll
        2008-03-03 18:39 . 2007-03-27 20:56 26,136 --a------ C:\WINDOWS\system32\IVIresize.dll
        2008-03-03 17:49 . 2008-03-03 17:49 <REP> d-------- C:\Program Files\CleanUp!
        2008-03-03 17:41 . 2008-03-03 17:41 <REP> d-------- C:\Program Files\CCleaner
        2008-02-26 17:25 . 2008-02-26 17:25 1,409 --a------ C:\WINDOWS\system32\tmp3D751.FOT
        2008-02-26 17:25 . 2008-02-26 17:25 1,409 --a------ C:\WINDOWS\system32\tmp36041.FOT

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-03-30 15:11 --------- d-----w C:\Program Files\Google
        2008-03-19 17:52 --------- d-----w C:\Program Files\Logi'clic 4
        2008-03-03 16:41 --------- d-----w C:\Documents and Settings\Pascal\Application Data\Ulead Systems
        2008-03-03 16:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
        2008-03-03 16:38 --------- d-----w C:\Program Files\Ulead Systems
        2008-03-03 16:38 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems
        2008-02-06 18:24 --------- d-----w C:\Program Files\Lavasoft
        2008-01-30 15:38 --------- d-----w C:\Program Files\Sunbelt Software
        2008-01-30 15:20 --------- d-----w C:\Program Files\Avira
        2008-01-30 15:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
        2008-01-30 15:02 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
        2008-01-29 17:40 --------- d-----w C:\Program Files\Trend Micro
        2008-01-29 14:53 --------- d-----w C:\Program Files\Fichiers communs\ReparateurDeSysteme
        2008-01-29 14:47 --------- d-----r C:\Documents and Settings\All Users\Application Data\SalesMon
        2008-01-29 14:47 --------- d-----r C:\Documents and Settings\All Users\Application Data\reparateurdesysteme
        2008-01-29 14:46 260,632 ----a-w C:\Documents and Settings\Pascal\Application Data\setup_fr[1].exe
        2008-01-29 14:39 --------- d-----w C:\Documents and Settings\Pascal\Application Data\Lavasoft
        2008-01-29 14:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
        2008-01-03 18:53 67,624 ----a-w C:\Documents and Settings\Pascal\Application Data\GDIPFONTCACHEV1.DAT
        2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
        2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

        [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA7BD390-28E8-4B98-BED3-D39FA67567C4}]
        C:\WINDOWS\drnpfdxqfm.dll

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
        "{1A0B93F9-A39E-40E4-82D9-0CA3AD6A5660}"= "C:\WINDOWS\etlrlws.dll" [2008-03-18 18:10 204800]

        [HKEY_CLASSES_ROOT\clsid\{1a0b93f9-a39e-40e4-82d9-0ca3ad6a5660}]
        [HKEY_CLASSES_ROOT\etlrlws.1]
        [HKEY_CLASSES_ROOT\TypeLib\{23642522-F6B7-4822-B100-CB0D6DA47C8D}]
        [HKEY_CLASSES_ROOT\etlrlws]

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
        "Neuf Media Center"="C:\Program Files\Neuf\Media Center\MediaCenter.exe" [2007-08-29 16:42 1008880]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-30 17:28 249896]
        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-04 14:52 286720]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

        C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
        Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-14 19:42:47 110592]
        BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 18:05:38 553021]
        Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-03-14 19:12:09 573440]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
        "altvxvm"= {3D6DD288-EE25-4994-A7EA-929A9D634A49} - C:\WINDOWS\altvxvm.dll [2008-03-18 18:10 270336]
        "bokpkov"= {7C403E35-B18D-462F-A2BE-B175F3A78BF7} - C:\WINDOWS\bokpkov.dll [2008-03-18 18:10 266240]

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "D:\\eMule\\emule.exe"=
        "C:\Program Files\Neuf\Media Center\httpd\httpd.exe"= C:\Program Files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player Neuf Cegetel)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
        "AllowInboundEchoRequest"= 1 (0x1)

        R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys [2002-10-16 04:57]
        R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21]
        R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21]
        R1 msikbd2k;Multimedia Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2001-12-20 10:02]
        R2 nhksrv;Netropa NHK Server;C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe [2001-08-06 07:41]
        R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 11:21]
        R3 PALLADIA;Palladia 300/400 Usb Adsl Modem;C:\WINDOWS\system32\DRIVERS\usbiad.sys [2004-07-14 19:52]
        R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
        R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 14:00]

        *Newly Created Service* - CATCHME
        .
        Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
        "2007-12-04 12:54:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        .
        **************************************************************************

        catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-03-30 21:09:50
        Windows 5.1.2600 Service Pack 2 NTFS

        Balayage processus cachés ...

        Balayage caché autostart entries ...

        Balayage des fichiers cachés ...

        Scan terminé avec succès
        Les fichiers cachés: 0

        **************************************************************************
        .
        Temps d'accomplissement: 2008-03-30 21:11:17
        ComboFix-quarantined-files.txt 2008-03-30 19:11:12
        ComboFix2.txt 2008-01-29 19:11:18
        Pre-Run: 28,263,600,128 octets libres
        Post-Run: 28,277,735,424 octets libres
        .
        2008-03-12 15:36:59 --- E O F ---

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 21:16:35, on 30/03/2008
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16608)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Neuf\Media Center\MediaCenter.exe
        C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
        C:\Program Files\Logitech\SetPoint\KEM.exe
        C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
        C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
        C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
        C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
        C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
        C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
        C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
        C:\Program Files\Neuf\Media Center\httpd\httpd.exe
        C:\Program Files\Canon\CAL\CALMAIN.exe
        C:\Program Files\Neuf\Media Center\httpd\httpd.exe
        C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\explorer.exe
        C:\Program Files\Outlook Express\msimn.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
        O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O2 - BHO: GNX Rolex - {EA7BD390-28E8-4B98-BED3-D39FA67567C4} - C:\WINDOWS\drnpfdxqfm.dll (file missing)
        O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
        O3 - Toolbar: etlrlws - {1A0B93F9-A39E-40E4-82D9-0CA3AD6A5660} - C:\WINDOWS\etlrlws.dll
        O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
        O4 - Global Startup: BTTray.lnk = ?
        O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
        O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
        O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
        O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
        O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
        O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
        O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
        O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
        O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
        O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
        O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
        O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
        O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://securite.neuf.fr/Ols/fscax.cab
        O21 - SSODL: altvxvm - {3D6DD288-EE25-4994-A7EA-929A9D634A49} - C:\WINDOWS\altvxvm.dll
        O21 - SSODL: bokpkov - {7C403E35-B18D-462F-A2BE-B175F3A78BF7} - C:\WINDOWS\bokpkov.dll
        O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
        O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
        O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
        O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
        O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
        O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
        O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
        O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
        O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
        O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
    3. g!rly Contributeur
      salut pbib,

      a l´aide de hijack this coche et fix les lignes suivantes :

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
      O21 - SSODL: altvxvm - {3D6DD288-EE25-4994-A7EA-929A9D634A49} - C:\WINDOWS\altvxvm.dll
      O21 - SSODL: bokpkov - {7C403E35-B18D-462F-A2BE-B175F3A78BF7} - C:\WINDOWS\bokpkov.dll

      comment fixer :

      Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

      -> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

      puis

      Copie le texte ci-dessous :

      File::
      C:\WINDOWS\system32\tmp3D751.FOT
      C:\WINDOWS\system32\tmp36041.FOT
      C:\WINDOWS\fmsxwqs.exe
      C:\WINDOWS\altvxvm.dll
      C:\WINDOWS\bokpkov.dll
      C:\WINDOWS\etlrlws.dll

      Registry::
      [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EA7BD390-28E8-4B98-BED3-D39FA67567C4}]
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
      "{1A0B93F9-A39E-40E4-82D9-0CA3AD6A5660}"=-
      [-HKEY_CLASSES_ROOT\clsid\{1a0b93f9-a39e-40e4-82d9-0ca3ad6a5660}]
      [-HKEY_CLASSES_ROOT\etlrlws.1]
      [-HKEY_CLASSES_ROOT\TypeLib\{23642522-F6B7-4822-B100-CB0D6DA47C8D}]
      [-HKEY_CLASSES_ROOT\etlrlws]
      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
      "altvxvm"=-
      "bokpkov"=-

      Ouvre le Bloc-Notes puis colle le texte copié.
      (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
      Sauvegarde ce fichier sous le nom de CFScript.txt.

      Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

      http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

      Cela va relancer Combofix,

      Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

      Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

      ps : le probleme est-il survenu apres l´installation de :

      C:\Documents and Settings\All Users\Application Data\InterVideo

      et

      C:\Program Files\Fichiers communs\InterVideo

      dans ce cas supprime les dossiers !

      @+
      1. pbib Auteur
        Bonjour g!rly ,

        J'ai relancé combofix dont je joint le rapport mais impossible de supprimer interVideo .

        ComboFix 08-03-30.2 - Pascal 2008-03-31 17:24:56.5 - NTFSx86
        Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.682 [GMT 2:00]
        Endroit: C:\Documents and Settings\Pascal\Bureau\ComboFix.exe
        Command switches used :: C:\Documents and Settings\Pascal\Bureau\CFScript.txt

        [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

        FILE ::
        C:\WINDOWS\altvxvm.dll
        C:\WINDOWS\bokpkov.dll
        C:\WINDOWS\etlrlws.dll
        C:\WINDOWS\fmsxwqs.exe
        C:\WINDOWS\system32\tmp36041.FOT
        C:\WINDOWS\system32\tmp3D751.FOT
        .

        (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
        .

        C:\Documents and Settings\Pascal\Bureau\Error Cleaner.url
        C:\Documents and Settings\Pascal\Bureau\Privacy Protector.url
        C:\Documents and Settings\Pascal\Bureau\Spyware&Malware Protection.url
        C:\Documents and Settings\Pascal\Favoris\Error Cleaner.url
        C:\Documents and Settings\Pascal\Favoris\Privacy Protector.url
        C:\Documents and Settings\Pascal\Favoris\Spyware&Malware Protection.url
        C:\WINDOWS\altvxvm.dll
        C:\WINDOWS\bokpkov.dll
        C:\WINDOWS\etlrlws.dll
        C:\WINDOWS\fmsxwqs.exe
        C:\WINDOWS\system32\tmp36041.FOT
        C:\WINDOWS\system32\tmp3D751.FOT

        .
        ((((((((((((((((((((((((((((( Fichiers créés 2008-02-28 to 2008-03-31 ))))))))))))))))))))))))))))))))))))
        .

        2008-03-19 18:32 . 2008-03-20 18:59 330 --a------ C:\WINDOWS\system32\drivers\fwdrv.err
        2008-03-03 18:39 . 2008-03-03 18:39 <REP> d-------- C:\Program Files\Fichiers communs\InterVideo
        2008-03-03 18:39 . 2008-03-03 18:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InterVideo
        2008-03-03 18:39 . 2007-03-27 20:56 210,456 --a------ C:\WINDOWS\system32\IVIresizeW7.dll
        2008-03-03 18:39 . 2007-03-27 20:56 206,360 --a------ C:\WINDOWS\system32\IVIresizeA6.dll
        2008-03-03 18:39 . 2007-03-27 20:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeP6.dll
        2008-03-03 18:39 . 2007-03-27 20:56 198,168 --a------ C:\WINDOWS\system32\IVIresizeM6.dll
        2008-03-03 18:39 . 2007-03-27 20:56 194,072 --a------ C:\WINDOWS\system32\IVIresizePX.dll
        2008-03-03 18:39 . 2007-03-27 20:56 26,136 --a------ C:\WINDOWS\system32\IVIresize.dll
        2008-03-03 17:49 . 2008-03-30 21:30 <REP> d-------- C:\Program Files\CleanUp!
        2008-03-03 17:41 . 2008-03-03 17:41 <REP> d-------- C:\Program Files\CCleaner

        .
        (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
        .
        2008-03-30 15:11 --------- d-----w C:\Program Files\Google
        2008-03-19 17:52 --------- d-----w C:\Program Files\Logi'clic 4
        2008-03-03 16:41 --------- d-----w C:\Documents and Settings\Pascal\Application Data\Ulead Systems
        2008-03-03 16:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
        2008-03-03 16:38 --------- d-----w C:\Program Files\Ulead Systems
        2008-03-03 16:38 --------- d-----w C:\Program Files\Fichiers communs\Ulead Systems
        2008-02-06 18:24 --------- d-----w C:\Program Files\Lavasoft
        2008-01-30 15:38 --------- d-----w C:\Program Files\Sunbelt Software
        2008-01-30 15:20 --------- d-----w C:\Program Files\Avira
        2008-01-30 15:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avira
        2008-01-30 15:02 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
        2008-01-29 17:40 --------- d-----w C:\Program Files\Trend Micro
        2008-01-29 14:53 --------- d-----w C:\Program Files\Fichiers communs\ReparateurDeSysteme
        2008-01-29 14:47 --------- d-----r C:\Documents and Settings\All Users\Application Data\SalesMon
        2008-01-29 14:47 --------- d-----r C:\Documents and Settings\All Users\Application Data\reparateurdesysteme
        2008-01-29 14:46 260,632 ----a-w C:\Documents and Settings\Pascal\Application Data\setup_fr[1].exe
        2008-01-29 14:39 --------- d-----w C:\Documents and Settings\Pascal\Application Data\Lavasoft
        2008-01-29 14:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
        2008-01-03 18:53 67,624 ----a-w C:\Documents and Settings\Pascal\Application Data\GDIPFONTCACHEV1.DAT
        2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
        2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
        .

        ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
        .
        .
        REGEDIT4
        *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

        [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 14:00 15360]
        "Neuf Media Center"="C:\Program Files\Neuf\Media Center\MediaCenter.exe" [2007-08-29 16:42 1008880]

        [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
        "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-01-30 17:28 249896]
        "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-04 14:52 286720]

        [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
        "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 14:00 15360]

        C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
        Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-14 19:42:47 110592]
        BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 18:05:38 553021]
        Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-03-14 19:12:09 573440]

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
        "EnableFirewall"= 0 (0x0)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
        "D:\\eMule\\emule.exe"=
        "C:\Program Files\Neuf\Media Center\httpd\httpd.exe"= C:\Program Files\Neuf\Media Center\httpd\httpd.exe:172.16.255.0/255.255.255.0:Enabled:Serveur de partage Media Center (Player Neuf Cegetel)

        [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
        "AllowInboundEchoRequest"= 1 (0x1)

        R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\drivers\si3112r.sys [2002-10-16 04:57]
        R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21]
        R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21]
        R1 msikbd2k;Multimedia Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\msikbd2k.sys [2001-12-20 10:02]
        R2 nhksrv;Netropa NHK Server;C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe [2001-08-06 07:41]
        R2 SPF4;Sunbelt Personal Firewall 4;"C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe" [2007-04-26 11:21]
        R3 PALLADIA;Palladia 300/400 Usb Adsl Modem;C:\WINDOWS\system32\DRIVERS\usbiad.sys [2004-07-14 19:52]
        R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 14:00]
        S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]

        .
        Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
        "2007-12-04 12:54:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
        - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
        .
        **************************************************************************

        catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
        Rootkit scan 2008-03-31 17:28:56
        Windows 5.1.2600 Service Pack 2 NTFS

        Balayage processus cachés ...

        Balayage caché autostart entries ...

        Balayage des fichiers cachés ...

        Scan terminé avec succès
        Les fichiers cachés: 0

        **************************************************************************
        .
        Temps d'accomplissement: 2008-03-31 17:30:22
        ComboFix-quarantined-files.txt 2008-03-31 15:30:17
        ComboFix2.txt 2008-03-30 19:11:19
        ComboFix3.txt 2008-01-29 19:11:18
        Pre-Run: 29,033,517,056 octets libres
        Post-Run: 29,021,659,136 octets libres
        .
        2008-03-12 15:36:59 --- E O F ---
    4. g!rly Contributeur
      pbib

      c´est bien intervideo qui a provoqué l´infection alors ?

      @+
      1. pbib Auteur
        Bonjour ,

        Je ne suis pas certain que c'est intervideo qui est provoqué l'infection mais la période correspond . L'infection n'a plus l'air d'etre presente mais je constate une extreme lenteur du pc .

        Merci , @+ .
    6. pbib Auteur
      Bonjour g!rly ,

      Je te joins le rapport hijackthis .

      Logfile of Trend Micro HijackThis v2.0.2
      Scan saved at 15:53:30, on 02/04/2008
      Platform: Windows XP SP2 (WinNT 5.01.2600)
      MSIE: Internet Explorer v7.00 (7.00.6000.16608)
      Boot mode: Normal

      Running processes:
      C:\WINDOWS\System32\smss.exe
      C:\WINDOWS\system32\winlogon.exe
      C:\WINDOWS\system32\services.exe
      C:\WINDOWS\system32\lsass.exe
      C:\WINDOWS\system32\svchost.exe
      C:\WINDOWS\System32\svchost.exe
      C:\WINDOWS\system32\spoolsv.exe
      C:\WINDOWS\Explorer.EXE
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
      C:\WINDOWS\system32\ctfmon.exe
      C:\Program Files\Neuf\Media Center\MediaCenter.exe
      C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
      C:\Program Files\Logitech\SetPoint\KEM.exe
      C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
      C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
      C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
      C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
      C:\WINDOWS\system32\svchost.exe
      C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
      C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
      C:\Program Files\Canon\CAL\CALMAIN.exe
      C:\Program Files\Neuf\Media Center\httpd\httpd.exe
      C:\Program Files\Neuf\Media Center\httpd\httpd.exe
      C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
      C:\WINDOWS\system32\wuauclt.exe
      C:\Program Files\Microsoft Money\System\msmoney.exe
      C:\Program Files\Outlook Express\msimn.exe
      C:\WINDOWS\System32\svchost.exe
      C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

      R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://neufportail.fr/
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
      O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
      O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
      O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
      O4 - HKCU\..\Run: [Neuf Media Center] "C:\Program Files\Neuf\Media Center\MediaCenter.exe"
      O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
      O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
      O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
      O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
      O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
      O4 - Global Startup: BTTray.lnk = ?
      O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
      O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
      O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
      O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
      O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
      O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
      O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
      O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
      O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
      O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
      O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
      O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
      O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://securite.neuf.fr/Ols/fscax.cab
      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
      O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
      O23 - Service: Capture Device Service - Unknown owner - C:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe (file missing)
      O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
      O23 - Service: Netropa NHK Server (nhksrv) - Unknown owner - C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe
      O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exe
      O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exe
      O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
      O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
      1. g!rly Contributeur
        salut,

        a l´aide de hijack this coche et fix les lignes suivantes :

        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
        O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
        O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
        O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
        O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/
        O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/default.aspx
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/default.aspx
        O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://securite.neuf.fr/Ols/fscax.cab

        comment fixer :

        Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

        -> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

        puis

        regarde ce tutorial pour mettre ta console java a jour :

        https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/

        et

        Fais un scan avec cet antispyware :

        Telecharge malwarebytes + tutoriel :

        -> https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

        Tu l´instale; le programme va se mettre automatiquement a jour.

        Une fois a jour, le programme va se lancer; click sur l´onglet parametre, et coche la case : "Arreter internet explorer pendant la suppression".

        Click maintenant sur l´onglet recherche et coche la case : "executer un examun complet".

        Puis click sur "rechercher".

        Laisse le scanner le pc...

        Si des elements on ete trouvés > click sur supprimer la selection.

        si il t´es demandé de redemarrer > click sur "yes".

        A la fin un rapport va s´ouvrir; sauvegarde le de maniere a le retrouver en vu de le poster sur le forum.

        Copie et colle le rapport stp.

        @+
        1. g!rly Contributeur
          --
          mouvement de non entraide a suivre très prochainement...
          Précédent
          • 1
          • 2

          Discussions similaires

          Privacy shield ???
          DYLLEN76

          13 réponses
          comment desinstaller PC Privacy shield ?
          Auroreboreale92

          2 réponses
          VIRUS sur mon pc
          jcld

          18 réponses