Win 32 : BHO-KD Fermé

Question

Bonsoir, je voudrais de l'aide pour me débarasser de ce fameux trojan, Win32: BHO-KD.
Avast l'a detecté il y a deja un moment mais ne veut pas le supprimer. J'ai essayé avec plusieurs antivirus : AVG, ad-Aware, a-squared, mais rien ne marche.
Quelqu'un pourrait-il  m'aider s'il vous plait?!!

ep44 · Answer

Bonsoir 

Télécharge sur le bureau

ftp://ftp.commentcamarche.com/download/HJTInstall.exe

= Double-clic dessus pour l'installer 
= Clic Do a system scan and save the log
=coller le rapport
si problème voir l'aide
http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm 
@+

ninouche85 · Answer

Voila le rapport de Hijack,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:35:30, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Adssite Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\adssite_sidebar.dll (file missing)
O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\WINDOWS\system32\iebrowserc.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: dcads - {733716E1-76D2-4003-AC39-845281C0EF85} - C:\WINDOWS\system32
shB.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {DD624302-A5B6-4B15-8878-2AB00C98DF49} - C:\WINDOWS\system32\dbnmpnt.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\Idol road.exe
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://194.7.150.2/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F1DB61-29C5-4134-8934-18ADAFEBBF7F}: NameServer = 80.10.246.130 81.253.149.10
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NeroNET - Unknown owner - C:\Program Files\Ahead\NeroNET\NeroNET.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe

ep44 · Answer

Bonsoir 

Télécharge sur le Bureau.
http://www.atribune.org/ccount/click.php?id=4

=> Double-clic VundoFix.exe.
=> Clic OK
=> Attendre le redemarrage de Vundofix
=> Clic Scan for Vundo
=> Le scan est assez long , à la fin
=> Clic Remove Vundo
=> Puis yes
=> Le Bureau disparaît un moment lors de la suppression des fichiers.
=> Message shutdown
=> clic OK
=> Redémarrage auto
=> copier le rapport qui est dans C:vundofix.txt

ensuite 
Télécharge VirtumundoBeGone  sur ton bureau .
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe 
=> double-clic sur VirtumundoBeGone.exe
=> Suis les instructions à l'écran
=> Quand le scan est terminé, enregistre le rapport.
=> Copie/Colle le ici


ensuite
Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/Combo-Fix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix,
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

@+

ninouche85 · Answer

Bonsoir, 
j'ai fais le scan avec Vundo mais il ne trouve rien. Est-ce normal??

ep44 · Answer

poste le rapport 
même si il ne trouve rien tu doit avoir un rapport 
ensuite lance combofix

ninouche85 · Answer

Rapport de Vundofix

VundoFix V6.7.8

Checking Java version...

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 22:42:01 07/02/2008

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.7.8

Checking Java version...

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 21:26:09 11/02/2008

Listing files found while scanning....

No infected files were found.


Beginning removal...

VundoFix V6.7.8

Checking Java version...

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 22:20:11 11/02/2008

Listing files found while scanning....


VundoFix V6.7.8

Checking Java version...

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 22:22:12 11/02/2008

Listing files found while scanning....


VundoFix V6.7.8

Checking Java version...

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Java version is 1.5.0.11

Scan started at 10:08:41 12/02/2008

Listing files found while scanning....

No infected files were found.


Beginning removal...

ninouche85 · Answer

Rapport VBG,


[02/12/2008, 14:03:04] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\NiNoUcHe\Bureau\VirtumundoBeGone.exe" )
[02/12/2008, 14:03:14] - Detected System Information:
[02/12/2008, 14:03:14] -  Windows Version: 5.1.2600, Service Pack 2
[02/12/2008, 14:03:14] -  Current Username: NiNoUcHe (Admin)
[02/12/2008, 14:03:14] -  Windows is in NORMAL mode.
[02/12/2008, 14:03:14] - Searching for Browser Helper Objects:
[02/12/2008, 14:03:14] -  BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[02/12/2008, 14:03:14] -  BHO 2: {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} (Adssite Search Assistant)
[02/12/2008, 14:03:14] -  BHO 3: {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} (BrowserCmp)
[02/12/2008, 14:03:14] -  BHO 4: {64F56FC1-1272-44CD-BA6E-39723696E350} (EoBho Class)
[02/12/2008, 14:03:14] -  BHO 5: {733716E1-76D2-4003-AC39-845281C0EF85} (dcads)
[02/12/2008, 14:03:14] -  BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/12/2008, 14:03:14] -  BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[02/12/2008, 14:03:14] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/12/2008, 14:03:14] -  No filename found. Continuing.
[02/12/2008, 14:03:14] -  BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
[02/12/2008, 14:03:14] -  BHO 9: {DD624302-A5B6-4B15-8878-2AB00C98DF49} ()
[02/12/2008, 14:03:14] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/12/2008, 14:03:14] -  Checking for HKLM\...\Winlogon\Notify\dbnmpnt
[02/12/2008, 14:03:14] -  Key not found: HKLM\...\Winlogon\Notify\dbnmpnt, continuing.
[02/12/2008, 14:03:14] - Finished Searching Browser Helper Objects
[02/12/2008, 14:03:14] - Finishing up...
[02/12/2008, 14:03:14] - Nothing found! Exiting...

ninouche85 · Answer

Rapport Combofix ComboFix 08-02-12.1 - NiNoUcHe 2008-02-12 14:11:49.1 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.146 [GMT 1:00]Endroit: C:\Documents and Settings\NiNoUcHe\Bureau\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Michel\Application Data\WinAntiVirus Pro 2006 C:\Documents and Settings\Michel\Application Data\WinAntiVirus Pro 2006\Logs\update.log C:\Documents and Settings\Michel\Application Data\WinAntiVirus Pro 2006\Logs\wa6Support.log C:\Documents and Settings\Michel\Application Data\WinAntiVirus Pro 2006\Logs\winav.log C:\Documents and Settings\Michel\err.log C:\Documents and Settings\NiNa\Application Data\macromedia\Flash Player\#SharedObjects\5D6TRC5H\iforex.com C:\Documents and Settings\NiNa\Application Data\macromedia\Flash Player\#SharedObjects\5D6TRC5H\iforex.com\Emerp\Events\flash_object.swf\user_data.sol C:\Documents and Settings\NiNa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com C:\Documents and Settings\NiNa\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol C:\Documents and Settings\NiNa\err.log C:\Documents and Settings\NiNa\Menu Démarrer\Programmes\WebMediaPlayer C:\Documents and Settings\NiNa\Menu Démarrer\Programmes\WebMediaPlayer\WebMediaPlayer.lnk C:\Documents and Settings\NiNa\Menu Démarrer\Programmes\WebMediaPlayer\Website.lnk C:\Program Files\Fichiers communs\{2F9E4~1 C:\Program Files\Fichiers communs\{2F9E4~2 C:\Program Files\Fichiers communs\{3F9E4~1 C:\Program Files\Fichiers communs\{3F9E4~1\Bar888.dll C:\Program Files\Fichiers communs\{3F9E4~1\UnInstall.exe C:\Program Files\Fichiers communs\uninstall information C:\Program Files\webmediaplayer C:\Program Files\webmediaplayer esources\languages.xml C:\Program Files\webmediaplayer esources\webmedias C:\Program Files\webmediaplayer\skins\classic.skn C:\Program Files\webmediaplayer\sqlite3.dll C:\Program Files\webmediaplayer\uninst.exe C:\Program Files\webmediaplayer\WebMediaPlayer.url C:\WINDOWS\pack.epk C:\WINDOWS\system32\blprlawfv.dat C:\WINDOWS\system32\blprlawfv_navps.dat C:\WINDOWS\system32\gupoqmsif.dat C:\WINDOWS\system32\gupoqmsif_nav.dat C:\WINDOWS\system32\gupoqmsif_navps.dat C:\WINDOWS\system32\khlqurvcec.dat C:\WINDOWS\system32\khlqurvcec_navps.dat C:\WINDOWS\system32\majylucr.dat C:\WINDOWS\system32\majylucr_nav.dat C:\WINDOWS\system32\majylucr_navps.dat C:\WINDOWS\system32\mkieud.dat C:\WINDOWS\system32\mkieud_nav.dat C:\WINDOWS\system32\mkieud_navps.dat C:\WINDOWS\system32 sl96.dll C:\WINDOWS\system32 vs2.inf C:\WINDOWS\system32\qmstrefak.dat C:\WINDOWS\system32\qmstrefak_nav.dat C:\WINDOWS\system32\qmstrefak_navps.dat C:\WINDOWS\system32\qmstrefak_navup.dat C:\WINDOWS\system32\stera.log C:\WINDOWS\system32\uiewfqjkm.dat C:\WINDOWS\system32\uiewfqjkm_nav.dat C:\WINDOWS\system32\uiewfqjkm_navps.dat C:\WINDOWS\system32\ybjngfxi.dat C:\WINDOWS\system32\ybjngfxi_nav.dat C:\WINDOWS\system32\ybjngfxi_navps.dat C:\WINDOWS\system32\ymihgnopz.dat C:\WINDOWS\system32\ymihgnopz_nav.dat C:\WINDOWS\system32\ymihgnopz_navps.dat . ((((((((((((((((((((((((((((( Fichiers créés 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))))))) . 2008-02-11 21:26 . 2008-02-11 21:26 d-------- C:\VundoFix Backups 2008-02-11 10:33 . 2008-02-11 10:33 d-------- C:\Program Files\Trend Micro 2008-02-09 18:30 . 2008-02-09 18:30 d-------- C:\Documents and Settings\NiNoUcHe\Shared 2008-02-09 18:29 . 2008-02-09 18:33 d-------- C:\Documents and Settings\NiNoUcHe\Incomplete 2008-02-09 18:29 . 2008-02-09 18:33 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\LimeWire 2008-02-09 12:48 . 2008-02-09 12:50 d-------- C:\Program Files\SPYWAREfighter 2008-02-09 12:48 . 2008-02-09 12:48 d-------- C:\Program Files\Fichiers communs\Application 2008-02-09 10:56 . 2008-02-09 10:56 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Grisoft 2008-02-08 11:12 . 2008-02-09 12:17 d-------- C:\Documents and Settings\Administrateur\Modèles 2008-02-07 21:50 . 2008-02-07 21:50 d-------- C:\Program Files\Lavasoft 2008-02-07 21:50 . 2008-02-07 21:52 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-07 21:49 . 2008-02-07 21:49 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-02-04 22:20 . 2008-02-04 22:20 d-------- C:\Documents and Settings\NiNa\Application Data\Okayticknoun 2008-01-31 20:11 . 2008-01-31 20:11 d-------- C:\Documents and Settings\Marie\Application Data\Okayticknoun 2008-01-28 14:58 . 2008-01-28 14:58 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Okayticknoun 2008-01-28 09:02 . 2008-01-28 09:02 d-------- C:\Documents and Settings\Michel\Application Data\Okayticknoun 2008-01-27 22:10 . 2008-01-27 22:10 46,300 --a------ C:\WINDOWS\system32\DcadsSocial-uninstall.exe 2008-01-27 11:59 . 2008-02-10 23:09 d-------- C:\Documents and Settings\Nomii 2\Application Data\BitDownload 2008-01-27 11:56 . 2008-01-27 11:56 d-------- C:\Documents and Settings\All Users\Application Data\Memo save stupid creative 2008-01-27 11:55 . 2008-01-27 11:55 d-------- C:\Program Files\Okayticknoun 2008-01-27 11:55 . 2008-02-10 22:01 d-------- C:\Program Files\BitDownload 2008-01-19 19:01 . 2008-02-12 09:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-01-19 19:01 . 2008-01-19 19:01 1,409 --a------ C:\WINDOWS\QTFont.for 2008-01-19 19:00 . 2008-01-19 19:00 d-------- C:\Program Files\iTunes 2008-01-19 19:00 . 2008-01-19 19:00 d-------- C:\Program Files\iPod 2008-01-19 18:56 . 2008-01-19 18:56 d-------- C:\Program Files\Bonjour 2008-01-19 18:50 . 2008-01-19 18:50 d-------- C:\Program Files\Apple Software Update 2008-01-19 18:47 . 2008-01-15 02:39 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys 2008-01-18 11:06 . 2008-01-18 11:06 294,912 --a------ C:\WINDOWS\system32\iebrowserc.dll 2008-01-15 22:39 . 2008-01-15 22:39 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Samsung 2008-01-15 14:16 . 2008-02-10 14:12 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Apple Computer 2008-01-13 18:32 . 2008-01-14 07:31 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\AdobeUM 2008-01-13 12:11 . 2008-02-05 20:19 d-------- C:\Program Files\Windows Live Safety Center 2008-01-13 11:33 . 2008-01-13 11:33 d-------- C:\Program Files\Veoh Networks . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-12 09:07 --------- d-----w C:\Program Files\eMule 2008-02-09 11:17 --------- d-----w C:\Program Files\Spyware Doctor 2008-02-04 21:21 --------- d-----w C:\Program Files\AdVantage 2008-02-02 20:56 --------- d-----w C:\Documents and Settings\Marie\Application Data\Skype 2008-02-02 16:07 --------- d-----w C:\Documents and Settings\Marie\Application Data\skypePM 2008-01-27 18:35 --------- d-----w C:\Program Files\Zoom Player 2008-01-27 14:27 24,736 ----a-w C:\Documents and Settings\Nomii 2\Application Data\GDIPFONTCACHEV1.DAT 2008-01-27 10:56 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\Okayticknoun 2008-01-20 16:32 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\Ableton 2008-01-20 16:31 --------- d-----w C:\Program Files\Ableton 2008-01-19 17:56 --------- d-----w C:\Program Files\QuickTime 2008-01-14 10:05 --------- d-----w C:\Documents and Settings\NiNa\Application Data\OpenOffice.org2 2008-01-13 10:34 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-11 15:53 --------- d-----w C:\Documents and Settings\NiNoUcHe\Application Data\vlc 2008-01-10 19:20 --------- d-----w C:\Documents and Settings\NiNoUcHe\Application Data\MaxiMemo 2008-01-07 21:24 --------- d-----w C:\Program Files -CASE.180 2008-01-07 17:56 --------- d-----w C:\Documents and Settings\NiNa\Application Data\PC Tools 2008-01-06 21:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-03 18:11 --------- d-----w C:\Program Files\FotoSketcher 2007-12-24 12:04 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\Apple Computer 2007-12-20 21:18 --------- d-----w C:\Program Files\MSN Messenger 2007-12-20 21:18 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-20 10:24 --------- d-----w C:\Program Files\OpenOffice.org1.1.2 2007-12-19 20:40 --------- d-----w C:\Program Files\Extrafilm FotoFacil 2007-12-19 20:39 5,632 --sha-w C:\Program Files\Thumbs.db 2007-12-19 11:49 --------- d-----w C:\Documents and Settings\NiNa\Application Data\Skype 2007-12-19 11:10 --------- d-----w C:\Documents and Settings\NiNa\Application Data\skypePM 2007-12-18 20:51 --------- d-----w C:\Program Files\OpenOffice.org 2.3 2007-12-18 20:49 --------- d-----w C:\Program Files\Java 2007-12-18 09:40 --------- d-----w C:\Program Files\Téléchargement PHOTOWAYS 2007-12-17 09:38 --------- d-----w C:\Program Files\TimeAdjuster 2007-12-16 21:57 --------- d-----w C:\Documents and Settings\Marie\Application Data\MaxiMemo 2007-12-16 17:49 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2007-12-16 17:25 --------- d-----w C:\Program Files\Skype 2007-12-16 17:25 --------- d-----w C:\Program Files\Fichiers communs\Skype 2007-12-16 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-12-16 12:57 --------- d-----w C:\Documents and Settings\Michel\Application Data\MaxiMemo 2007-12-14 18:28 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\MaxiMemo 2007-12-13 12:12 24,736 ----a-w C:\Documents and Settings\NiNa\Application Data\GDIPFONTCACHEV1.DAT 2007-12-13 09:53 --------- d-----w C:\Program Files\Windows Live 2007-12-13 09:51 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2005-06-23 06:53 147 ----a-w C:\Program Files\INSTALL.LOG . [code]

----a-w         6,567,120 2005-11-03 18:18:51  C:\Documents and Settings\NiNoUcHe\Bureau\age of empires\AOE - Patch Officiel - Multilangues - V 1.01 - aoe3patch-10to101 - .exe

[/code] [color=red]Files Infected - Win32.Agent.zb[/color] . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}] C:\WINDOWS\system32\adssite_sidebar.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}] 2008-01-18 11:06 294912 --a------ C:\WINDOWS\system32\iebrowserc.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DD624302-A5B6-4B15-8878-2AB00C98DF49}] 2004-08-20 00:09 99840 --a------ C:\WINDOWS\system32\dbnmpnt.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-01-30 13:11 3497984] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-08-14 17:02 1063752] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048] "stupid creative poll axis"="C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\Idol road.exe" [2008-02-12 10:10 6372352] "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2007-06-08 11:52 115608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09 15360] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-14 01:04 5562368] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2006-11-28 18:44:41 954475] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 04:19:24 237568] Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2005-09-23 22:05:26 29696] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 09:01:04 83360] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer un] "{2F9E4904-0A27-1036-1212-030310020021}"= "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 R0 rfhmmdtb;rfhmmdtb;C:\WINDOWS\system32\drivers\lxczpjco.dat [] R3 Cap7134;ASUS TV7134 WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2004-02-04 16:42] R3 PhTVTune;ASUS WDM TV Tuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2004-02-04 16:42] R3 SpyFighter;SpyFighter Guard Device;C:\Program Files\SPYWAREfighter\spyfighter.sys [2007-06-08 11:52] R3 SPYWAREfighterRP;SPYWAREfighterRP;"C:\Program Files\SPYWAREfighter\spfprc.exe" [2007-06-08 11:52] S2 NeroNET;NeroNET;C:\Program Files\Ahead\NeroNET\NeroNET.exe [] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59] S4 COMkFwd;COMkFwd;C:\WINDOWS\system32\drivers v4isagp.sys [] . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-02-09 15:05:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-12 13:00:00 C:\WINDOWS\Tasks\B53D7D8395F6F09B.job" - c:\docume~1 omii2~1\applic~1\okayti~1\That view draw.exe "2008-02-12 13:27:00 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-12 14:21:27 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-02-12 14:27:28 ComboFix-quarantined-files.txt 2008-02-12 13:27:20 . 2008-01-09 11:00:49 --- E O F ---

ep44 · Answer

Bonsoir je regarde ton rapport 
et je te donne réponse tout à l'heure 
vous êtes combien à utiliser le pc ?
Michel;NiNa;ninouche;Nomii;marie...

ninouche85 · Answer

on est 5
merci d'avance

ep44 · Answer

regarde dans ajout/suppression de programmes si tu as ceci
BitDownload ou BitGrabber si oui supprime et regarde situ as cid help 
si tu as aussi supprime 

selectionne ceci

driver::

lxczpjco.dat


registry::


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1648E328-3E5A-4EA5-A9C6-E5F09EE272DA}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1D8282E6-BC4F-469B-AAED-7E4FF077AD93}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ExplorerBrowser Helper Objects\{DD624302-A5B6-4B15-8878-2AB00C98DF49}]


File::

C:\WINDOWS\system32\drivers\lxczpjco.dat
C:\WINDOWS\system32\iebrowserc.dll 
C:\Program Files\Okayticknoun 
C:\Program Files\BitDownload


* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt
* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

ensuite 

  Télécharge:
http://www.grisoft.cz/filedir/inst/avgas-setup-7.5.1.43.exe AVG-AntiSpyware
= Installer
= Le lancer
= Clic : Mise à jour
------
= Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.

Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
= Dans ANALYSE ( en forme de loupe )
==> Paramètres ==> sous COMMENT REAGIR==>clic sur Actions recommandées ==>Quarantaine
==> Clic : Analyse complète du système
En fin de scan ( qui est assez long)
==> Clic Appliquer toutes les actions <== ceci Très important
==> Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
-------
En mode normal
colle le rapport

ensuite on va faire un scan en ligne

avec bitdefender et colle le rapport

https://www.bitdefender.com/toolbox/

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
 plus un nouveau rapport hijack stp
@+

ninouche85 · Answer

Nouveau rapport Combofix, ComboFix 08-02-12.1 - NiNoUcHe 2008-02-13 15:02:34.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.154 [GMT 1:00]Endroit: C:\Documents and Settings\NiNoUcHe\Bureau\ComboFix.exe Command switches used :: C:\Documents and Settings\NiNoUcHe\Bureau\CFScript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE C:\Program Files\BitDownload C:\Program Files\Okayticknoun C:\WINDOWS\system32\drivers\lxczpjco.dat C:\WINDOWS\system32\iebrowserc.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\drivers\lxczpjco.dat . . . . Echec de suppression C:\WINDOWS\system32\iebrowserc.dll C:\WINDOWS\system32\drivers\lxczpjco.dat . . . . Echec de suppression . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-13 to 2008-02-13 )))))))))))))))))))))))))))))))))))) . 2008-02-11 21:26 . 2008-02-11 21:26 d-------- C:\VundoFix Backups 2008-02-11 10:33 . 2008-02-11 10:33 d-------- C:\Program Files\Trend Micro 2008-02-09 18:30 . 2008-02-09 18:30 d-------- C:\Documents and Settings\NiNoUcHe\Shared 2008-02-09 18:29 . 2008-02-09 18:33 d-------- C:\Documents and Settings\NiNoUcHe\Incomplete 2008-02-09 18:29 . 2008-02-09 18:33 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\LimeWire 2008-02-09 12:48 . 2008-02-09 12:50 d-------- C:\Program Files\SPYWAREfighter 2008-02-09 12:48 . 2008-02-09 12:48 d-------- C:\Program Files\Fichiers communs\Application 2008-02-09 10:56 . 2008-02-09 10:56 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Grisoft 2008-02-08 11:12 . 2008-02-09 12:17 d-------- C:\Documents and Settings\Administrateur\ModŠles 2008-02-07 21:50 . 2008-02-07 21:50 d-------- C:\Program Files\Lavasoft 2008-02-07 21:50 . 2008-02-07 21:52 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-07 21:49 . 2008-02-07 21:49 d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard 2008-02-04 22:20 . 2008-02-04 22:20 d-------- C:\Documents and Settings\NiNa\Application Data\Okayticknoun 2008-01-31 20:11 . 2008-01-31 20:11 d-------- C:\Documents and Settings\Marie\Application Data\Okayticknoun 2008-01-28 14:58 . 2008-01-28 14:58 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Okayticknoun 2008-01-28 09:02 . 2008-01-28 09:02 d-------- C:\Documents and Settings\Michel\Application Data\Okayticknoun 2008-01-27 22:10 . 2008-01-27 22:10 46,300 --a------ C:\WINDOWS\system32\DcadsSocial-uninstall.exe 2008-01-27 11:59 . 2008-02-10 23:09 d-------- C:\Documents and Settings\Nomii 2\Application Data\BitDownload 2008-01-27 11:56 . 2008-01-27 11:56 d-------- C:\Documents and Settings\All Users\Application Data\Memo save stupid creative 2008-01-27 11:55 . 2008-01-27 11:55 d-------- C:\Program Files\Okayticknoun 2008-01-19 19:01 . 2008-02-13 15:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-01-19 19:01 . 2008-01-19 19:01 1,409 --a------ C:\WINDOWS\QTFont.for 2008-01-19 19:00 . 2008-01-19 19:00 d-------- C:\Program Files\iTunes 2008-01-19 19:00 . 2008-01-19 19:00 d-------- C:\Program Files\iPod 2008-01-19 18:56 . 2008-01-19 18:56 d-------- C:\Program Files\Bonjour 2008-01-19 18:50 . 2008-01-19 18:50 d-------- C:\Program Files\Apple Software Update 2008-01-19 18:47 . 2008-01-15 02:39 30,464 --a------ C:\WINDOWS\system32\drivers\usbaapl.sys 2008-01-15 22:39 . 2008-01-15 22:39 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Samsung 2008-01-15 14:16 . 2008-02-10 14:12 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\Apple Computer 2008-01-13 18:32 . 2008-01-14 07:31 d-------- C:\Documents and Settings\NiNoUcHe\Application Data\AdobeUM 2008-01-13 12:11 . 2008-02-12 21:29 d-------- C:\Program Files\Windows Live Safety Center 2008-01-13 11:33 . 2008-01-13 11:33 d-------- C:\Program Files\Veoh Networks . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-12 22:28 --------- d-----w C:\Program Files\eMule 2008-02-12 22:02 --------- d-----w C:\Documents and Settings\Marie\Application Data\Skype 2008-02-12 19:39 --------- d-----w C:\Documents and Settings\Marie\Application Data\skypePM 2008-02-09 11:17 --------- d-----w C:\Program Files\Spyware Doctor 2008-02-04 21:21 --------- d-----w C:\Program Files\AdVantage 2008-01-27 18:35 --------- d-----w C:\Program Files\Zoom Player 2008-01-27 14:27 24,736 ----a-w C:\Documents and Settings\Nomii 2\Application Data\GDIPFONTCACHEV1.DAT 2008-01-27 10:56 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\Okayticknoun 2008-01-20 16:32 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\Ableton 2008-01-20 16:31 --------- d-----w C:\Program Files\Ableton 2008-01-19 17:56 --------- d-----w C:\Program Files\QuickTime 2008-01-14 10:05 --------- d-----w C:\Documents and Settings\NiNa\Application Data\OpenOffice.org2 2008-01-13 10:34 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-11 15:53 --------- d-----w C:\Documents and Settings\NiNoUcHe\Application Data\vlc 2008-01-10 19:20 --------- d-----w C:\Documents and Settings\NiNoUcHe\Application Data\MaxiMemo 2008-01-07 21:24 --------- d-----w C:\Program Files -CASE.180 2008-01-07 17:56 --------- d-----w C:\Documents and Settings\NiNa\Application Data\PC Tools 2008-01-06 21:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-01-03 18:11 --------- d-----w C:\Program Files\FotoSketcher 2007-12-24 12:04 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\Apple Computer 2007-12-20 21:18 --------- d-----w C:\Program Files\MSN Messenger 2007-12-20 21:18 --------- d-----w C:\Program Files\Messenger Plus! Live 2007-12-20 10:24 --------- d-----w C:\Program Files\OpenOffice.org1.1.2 2007-12-19 20:40 --------- d-----w C:\Program Files\Extrafilm FotoFacil 2007-12-19 20:39 5,632 --sha-w C:\Program Files\Thumbs.db 2007-12-19 11:49 --------- d-----w C:\Documents and Settings\NiNa\Application Data\Skype 2007-12-19 11:10 --------- d-----w C:\Documents and Settings\NiNa\Application Data\skypePM 2007-12-18 20:51 --------- d-----w C:\Program Files\OpenOffice.org 2.3 2007-12-18 20:49 --------- d-----w C:\Program Files\Java 2007-12-18 09:40 --------- d-----w C:\Program Files\Téléchargement PHOTOWAYS 2007-12-17 09:38 --------- d-----w C:\Program Files\TimeAdjuster 2007-12-16 21:57 --------- d-----w C:\Documents and Settings\Marie\Application Data\MaxiMemo 2007-12-16 17:49 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat 2007-12-16 17:25 --------- d-----w C:\Program Files\Skype 2007-12-16 17:25 --------- d-----w C:\Program Files\Fichiers communs\Skype 2007-12-16 17:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2007-12-16 12:57 --------- d-----w C:\Documents and Settings\Michel\Application Data\MaxiMemo 2007-12-14 18:28 --------- d-----w C:\Documents and Settings\Nomii 2\Application Data\MaxiMemo 2007-12-13 12:12 24,736 ----a-w C:\Documents and Settings\NiNa\Application Data\GDIPFONTCACHEV1.DAT 2007-12-13 09:53 --------- d-----w C:\Program Files\Windows Live 2007-12-13 09:51 --------- d-----w C:\Program Files\Microsoft SQL Server Compact Edition 2005-06-23 06:53 147 ----a-w C:\Program Files\INSTALL.LOG . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] "Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-01-30 13:11 3497984] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-20 00:09 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-08-14 17:02 1063752] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-10 15:27 385024] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048] "stupid creative poll axis"="C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\Idol road.exe" [2008-02-13 15:13 6420992] "spywarefighterguard"="C:\Program Files\SPYWAREfighter\spftray.exe" [2007-06-08 11:52 115608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 00:09 15360] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-14 01:04 5562368] [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer un] "{2F9E4904-0A27-1036-1212-030310020021}"= "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 R3 Cap7134;ASUS TV7134 WDM Video Capture;C:\WINDOWS\system32\DRIVERS\Cap7134.sys [2004-02-04 16:42] R3 PhTVTune;ASUS WDM TV Tuner;C:\WINDOWS\system32\DRIVERS\PhTVTune.sys [2004-02-04 16:42] R3 SpyFighter;SpyFighter Guard Device;C:\Program Files\SPYWAREfighter\spyfighter.sys [2007-06-08 11:52] R3 SPYWAREfighterRP;SPYWAREfighterRP;"C:\Program Files\SPYWAREfighter\spfprc.exe" [2007-06-08 11:52] S0 rfhmmdtb;rfhmmdtb;C:\WINDOWS\system32\drivers\lxczpjco.dat [2007-12-06 22:08] S2 NeroNET;NeroNET;C:\Program Files\Ahead\NeroNET\NeroNET.exe [] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM);C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2005-08-30 17:57] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter;C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2005-08-30 17:58] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers;C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2005-08-30 17:59] S4 COMkFwd;COMkFwd;C:\WINDOWS\system32\drivers v4isagp.sys [] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-02-09 15:05:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-13 14:00:00 C:\WINDOWS\Tasks\B53D7D8395F6F09B.job" - c:\docume~1 omii2~1\applic~1\okayti~1\That view draw.exe "2008-02-13 14:17:00 C:\WINDOWS\Tasks\Symantec NetDetect.job" - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-13 15:10:38 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\System32\Ati2evxx.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Spyware Doctor\svcntaux.exe C:\Program Files\Spyware Doctor\swdsvc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Temps d'accomplissement: 2008-02-13 15:17:27 - machine was rebooted ComboFix-quarantined-files.txt 2008-02-13 14:17:20 ComboFix2.txt 2008-02-12 13:27:29 . 2008-01-09 11:00:49 --- E O F ---

ep44 · Answer

Bonsoir il faut le reste !
@+

ninouche85 · Answer

Scan AVG,

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	19:42:22 13/02/2008

 + Résultat de l'analyse:	



C:\System Volume Information\_restore{A9752544-0F4E-4966-B059-84C9C1A3635D}\RP863\A0570619.dll -> Not-A-Virus.Adware.Agent : Nettoyé et sauvegardé (mise en quarantaine).
C:\System Volume Information\_restore{A9752544-0F4E-4966-B059-84C9C1A3635D}\RP863\A0570620.dll -> Not-A-Virus.Adware.Agent : Nettoyé et sauvegardé (mise en quarantaine).
:mozilla.53:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.55:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.56:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.57:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.58:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.247realmedia : Nettoyé.
:mozilla.201:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.202:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.227:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.292:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.435:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.265:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.266:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adbrite : Nettoyé.
:mozilla.236:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.237:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.239:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.240:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.241:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.242:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adrevolver : Nettoyé.
:mozilla.264:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.26:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
C:\Documents and Settings\Nomii 2\Cookies
omii_2@adtech[1].txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.10:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.11:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.12:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.20:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.21:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.22:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.23:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.24:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.9:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
C:\Documents and Settings\Nomii 2\Cookies
omii_2@advertising[2].txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.387:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adviva : Nettoyé.
:mozilla.50:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Nomii 2\Cookies
omii_2@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.25:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.51:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.58:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@bluestreak[1].txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.129:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.130:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.131:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.132:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.133:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.135:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.137:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.138:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Casalemedia : Nettoyé.
:mozilla.320:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.321:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.322:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.6:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@doubleclick[1].txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.101:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.36:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.238:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.243:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.244:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Euroclick : Nettoyé.
:mozilla.134:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.136:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.139:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Fastclick : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@fastclick[2].txt -> TrackingCookie.Fastclick : Nettoyé.
:mozilla.544:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Findwhat : Nettoyé.
:mozilla.341:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.434:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.485:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.489:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.636:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Googleadservices : Nettoyé.
:mozilla.413:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.414:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Imrworldwide : Nettoyé.
:mozilla.312:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Mediaplex : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@mediaplex[1].txt -> TrackingCookie.Mediaplex : Nettoyé.
:mozilla.450:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Netflame : Nettoyé.
:mozilla.115:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.39:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.40:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
:mozilla.56:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.57:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Revsci : Nettoyé.
:mozilla.245:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.246:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.247:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.248:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.249:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.250:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.256:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.61:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.62:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.63:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.64:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.65:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.66:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.67:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.391:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.392:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Sitestat : Nettoyé.
:mozilla.411:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Skype : Nettoyé.
:mozilla.412:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Skype : Nettoyé.
:mozilla.682:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Skype : Nettoyé.
:mozilla.26:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.27:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.28:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.29:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@smartadserver[2].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.417:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Statcounter : Nettoyé.
:mozilla.32:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.33:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.41:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.42:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.43:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.44:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.45:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.142:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tribalfusion : Nettoyé.
:mozilla.75:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.76:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.77:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.78:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.79:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Nomii 2\Cookies
omii_2@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.65:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.70:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.71:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.81:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.82:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.83:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.84:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.85:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.86:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.87:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.88:C:\Documents and Settings\Nomii 2\Application Data\Mozilla\Firefox\Profiles\9wwa92x4.default\cookies.txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.
C:\Documents and Settings\Nomii 2\Cookies
omii_2@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Nettoyé.
:mozilla.72:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.73:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
:mozilla.74:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Zedo : Nettoyé.
C:\WINDOWS\system32\dbnmpnt.dll -> Trojan.BHO.abo : Nettoyé et sauvegardé (mise en quarantaine).


Fin du rapport

ep44 · Answer

et le rapport de bitdefender et de hijack ;-))

ninouche85 · Answer

je n'arrive pas a lancer bitdefender!

ep44 · Answer

fait un scan en mode sans échec avec ton antivirus 
@+

ninouche85 · Answer

Scan bitdefender,

BitDefender Online Scanner
	

 
	

 

Rapport d'analyse généré à: Thu, Feb 14, 2008 - 13:39:13

 
	

 
	

 

Voie d'analyse: A:\;C:\;D:\;E:\;G:\;H:\;I:\;J:\;K:\;
	

 
	

 

 
	

 
	

 

Statistiques

Temps
	

01:28:37

Fichiers
	

451113

Directoires
	

12255

Secteurs de boot
	

4

Archives
	

5077

Paquets programmes
	

16498
	

 
	

 

Résultats

Virus identifiés
	

3

Fichiers infectés
	

3

Fichiers suspects
	

0

Avertissements
	

0

Désinfectés
	

0

Fichiers effacés
	

3
	

 
	

 

Info sur les moteurs

Définition virus
	

897155

Version des moteurs
	

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins
	

14

Archive des plugins
	

38

Unpack des plugins
	

7

E-mail plugins
	

6

Système plugins
	

1
	

 
	

 

Paramètres d'analyse

Première action
	

Désinfecté

Seconde Action
	

Supprimé

Heuristique
	

Oui

Acceptez les avertissements
	

Oui

Extensions analysées
	

*;

Excludez les extensions
	

 

Analyse d'emails
	

Oui

Analyse des Archives
	

Oui

Analyser paquets programmes
	

Oui

Analyse des fichiers
	

Oui

Analyse de boot
	

Oui
	

 
	

 
 

Fichier analysé
	

 Statut

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013
	

Infecté par: Trojan.Downloader.Small.BTF

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013
	

Echec de la désinfection

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013
	

Supprimé

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE
	

Echec de la mise à jour

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005
	

Infecté par: Trojan.Obfus.6.Gen

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005
	

Echec de la désinfection

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005
	

Supprimé

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)
	

Echec de la mise à jour

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0008
	

Infecté par: Trojan.Mailskinner.G

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0008
	

Echec de la désinfection

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0008
	

Supprimé

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)
	

Echec de la mise à jour

ep44 · Answer

fait ceci (IMPORTANT)

=démarrer
=panneau de configuration
=système
=onglet Restauration système
=coche la case (Désactiver la restauration système)
=redémarre l'ordinateur
=réactive la ensuite

ensuite refais un nouveau hijack stp

ninouche85 · Answer

Scan Hijack,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:05:34, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\wave body.exe
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [One Joy] C:\DOCUME~1\NiNoUcHe\APPLIC~1\OKAYTI~1\deleteacid.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://194.7.150.2/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F1DB61-29C5-4134-8934-18ADAFEBBF7F}: NameServer = 81.253.149.1 80.10.246.3
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NeroNET - Unknown owner - C:\Program Files\Ahead\NeroNET\NeroNET.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe

ep44 · Answer

installe ces trois logiciels 
et utilise les les uns après les autres 
sert toi des tutos 

=>CCleaner
https://www.clubic.com/telecharger-fiche14492-ccleaner.html
tuto:
https://forums.cnetfrance.fr

=> Ad-aware SE (scan passif )
https://www.google.com ou http://www.lavasoft.de/support/download/#free
Tutos :
http://home.tiscali.be/schouppeguy/adawarese/adawase.htm
démo
http://pageperso.aol.fr/balltrap34/adwseflash.zip
http://perso.orange.fr/rginformatique/section%20virus/adawrevid.asf

=> SpyBot-Search & Destroy 1.5 (scan passif + protection préventive avec ces 2 résidents, ses vaccinations et sa list Hosts )

https://www.safer-networking.org/download/

démo d utilisation
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm
https://www.malekal.com/spybot-search-destroy-proteger-desinfecter-pc-virus/
Tuto :
http://perso.orange.fr/jesses/Docs/Logiciels/Spybot.htm


ensuite refais un nouveau hijack stp
@+

ninouche85 · Answer

Nouveau scan hijack,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:44:08, on 14/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\SPYWAREfighter\spftray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\Program Files\eoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [stupid creative poll axis] C:\Documents and Settings\All Users\Application Data\Memo save stupid creative\wave body.exe
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [One Joy] C:\DOCUME~1\NiNoUcHe\APPLIC~1\OKAYTI~1\deleteacid.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://194.7.150.2/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F1DB61-29C5-4134-8934-18ADAFEBBF7F}: NameServer = 80.10.246.130 81.253.149.10
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NeroNET - Unknown owner - C:\Program Files\Ahead\NeroNET\NeroNET.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe

ep44 · Answer

tu n'as pas utiliser les logiciels indiqué plus haut ?

ninouche85 · Answer

Le lien pour Spybot ne marche pas.

ep44 · Answer

http://ftpclubic41.clubic.com/...
essaye celui-ci
@+

ninouche85 · Answer

Nouveau scan hijack,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:10:26, on 15/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\SPYWAREfighter\spfprc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqdirec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1036
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [spywarefighterguard] C:\Program Files\SPYWAREfighter\spftray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [{2F9E4904-0A27-1036-1212-030310020021}] "C:\Program Files\Fichiers communs\{2F9E4904-0A27-1036-1212-030310020021}\Update.exe" mc-110-12-0001411 (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - https://onedrive.live.com/
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://www.photoways.com/clients/uploader_v2.2.0.6.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://194.7.150.2/bin/msnchat45.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0F1DB61-29C5-4134-8934-18ADAFEBBF7F}: NameServer = 80.10.246.1 81.253.149.2
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logishrd\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NeroNET - Unknown owner - C:\Program Files\Ahead\NeroNET\NeroNET.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: SPYWAREfighterRP - SpamFighter APS - C:\Program Files\SPYWAREfighter\spfprc.exe

ep44 · Answer

Bonjour


Télécharge:
http://www.grisoft.cz/filedir/inst/avgas-setup-7.5.1.43.exe AVG-AntiSpyware
= Installer
= Le lancer
= Clic : Mise à jour
------
= Redémarre en mode Sans Échec (le démarrage peut prendre plusieurs minutes)
Attention, pas d’accès à internet dans ce mode. Enregistre ou imprime les consignes.

Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel
-------
= Dans ANALYSE ( en forme de loupe )
==> Paramètres ==> sous COMMENT REAGIR==>clic sur Actions recommandées ==>Quarantaine
==> Clic : Analyse complète du système
En fin de scan ( qui est assez long)
==> Clic Appliquer toutes les actions <== ceci Très important
==> Clic Sauvegarder rapport puis Enregistrer sous et choisir bureau
-------
En mode normal
colle le rapport

ninouche85 · Answer

rapport avg,

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	12:35:35 18/02/2008

 + Résultat de l'analyse:	



:mozilla.163:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.170:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.43:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.44:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.2o7 : Nettoyé.
:mozilla.49:C:\Documents and Settings\Michel\Application Data\Mozilla\Firefox\Profiles\9iqps168.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.66:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Adtech : Nettoyé.
:mozilla.182:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.183:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.184:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.185:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Advertising : Nettoyé.
:mozilla.69:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
C:\Documents and Settings\Nomii 2\Cookies
omii_2@atdmt[2].txt -> TrackingCookie.Atdmt : Nettoyé.
:mozilla.229:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Bluestreak : Nettoyé.
:mozilla.64:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.65:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.67:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Comclick : Nettoyé.
:mozilla.225:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.29:C:\Documents and Settings\Michel\Application Data\Mozilla\Firefox\Profiles\9iqps168.default\cookies.txt -> TrackingCookie.Doubleclick : Nettoyé.
:mozilla.41:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Estat : Nettoyé.
:mozilla.188:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Netflame : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@ssl-hints.netflame[1].txt -> TrackingCookie.Netflame : Nettoyé.
:mozilla.36:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Overture : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@serving-sys[2].txt -> TrackingCookie.Serving-sys : Nettoyé.
:mozilla.153:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.154:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.155:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.156:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Smartadserver : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@smartadserver[1].txt -> TrackingCookie.Smartadserver : Nettoyé.
:mozilla.231:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Tradedoubler : Nettoyé.
:mozilla.6:C:\Documents and Settings\Michel\Application Data\Mozilla\Firefox\Profiles\9iqps168.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.95:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
C:\Documents and Settings\Nomii 2\Cookies
omii_2@weborama[1].txt -> TrackingCookie.Weborama : Nettoyé.
:mozilla.256:C:\Documents and Settings\NiNoUcHe\Application Data\Mozilla\Firefox\Profiles\780nx3ex.default\cookies.txt -> TrackingCookie.Webtrends : Nettoyé.
C:\Documents and Settings\NiNoUcHe\Cookies
inouche@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Nettoyé.


Fin du rapport

ep44 · Answer

Bonsoir 
fait un scan en ligne

avec bitdefender et colle le rapport

https://www.bitdefender.com/toolbox/

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
@+

sebbissy · Answer

bonjour j'ai le virus win32:bho-kdo et je n'arrive pas a le supprimer avec avast

voici le rapport. merci

 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:29:21, on 18/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.1.1/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Orange
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Shareaza Web Download Hook - {0EEDB912-C5FA-486F-8334-57288578C627} - C:\Program Files\Shareaza\Plugins\RazaWebHook.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O2 - BHO: Adssite Search Assistant - {1648E328-3E5A-4EA5-A9C6-E5F09EE272DA} - C:\WINDOWS\system32\adssite_sidebar.dll
O2 - BHO: (no name) - {18818BD4-DA1B-4669-8031-35F145CBC776} - C:\WINDOWS\system32\pmnnm.dll (file missing)
O2 - BHO: BrowserCmp - {1D8282E6-BC4F-469B-AAED-7E4FF077AD93} - C:\WINDOWS\system32\iebrowserc.dll
O2 - BHO: (no name) - {2D767C9A-534B-4419-92F9-CA3FF43585EF} - C:\WINDOWS\system32\dbghel.dll
O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll
O2 - BHO: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnl0.dll
O2 - BHO: {c3fb72ac-dc59-df98-8624-6dc79386e674} - {476e6839-7cd6-4268-89fd-95cdca27bf3c} - C:\WINDOWS\system32\xweapjiu.dll (file missing)
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\urqrrsr.dll (file missing)
O2 - BHO: dcads - {6FC3C36D-7635-4D43-BA62-0D9D2F2CD06E} - C:\WINDOWS\system32
srB15.dll
O2 - BHO: Multi_Media_France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: superiorads - {79F562E5-768C-4494-8E6C-824ADA4A9C2C} - C:\WINDOWS\system32\sprt_ads.dll (file missing)
O2 - BHO: ads_optimizer - {9C8A568E-4201-478a-8536-526CF371D2E2} - C:\WINDOWS\system32
sgB37.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: Multi_Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media	bMul1.dll
O2 - BHO: (no name) - {C04FB9D4-AD8A-4BC0-9BE3-28406402C09C} - C:\WINDOWS\system32\ssqrq.dll (file missing)
O2 - BHO: WhIeHelperObj Class - {c900b400-cdfe-11d3-976a-00e02913a9e0} - C:\Program Files\webHancer\programs\whiehlpr.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Online_TV Toolbar - {40d1c3a7-4ffb-4443-b3a0-a64b2df7fc3b} - C:\Program Files\Online_TV	bOnl0.dll
O3 - Toolbar: Multi_Media_France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - C:\Program Files\Multi_Media_France	bMul0.dll
O3 - Toolbar: Multi_Media Toolbar - {b5146c40-189a-4311-bda9-fbae3e023187} - C:\Program Files\Multi_Media	bMul1.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TVPService] "C:\Program Files\HP\TVPlay\TVPService.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro	ype32.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [trioService] "C:\PROGRA~1\Freeze.com\Living 3D Dolphins	rioService.exe "
O4 - HKLM\..\Run: [DisableIPC] C:\Program Files\Cable & ADSL Optimizer\DisableIPC.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [845d713a] rundll32.exe "C:\WINDOWS\system32\dvcwhqat.dll",sitypnow
O4 - HKLM\..\Run: [spa_start] C:\WINDOWS\System32\Rundll32.exe "C:\WINDOWS\system32\sprt_ads.dll" DllStart
O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
O4 - HKLM\..\Run: [ptask] C:\Program Files\ProtectionConue\ptask.exe
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Fichiers communs\ReparateurDeSysteme\strpmon.exe" dm=http://reparateurdesysteme.com ad=http://reparateurdesysteme.com sd=http://repay.reparateurdesysteme.com
O4 - HKLM\..\Run: [bm] "C:\Program Files\Fichiers communs\ProtectionConue\bm.exe" dm=http://protectionconue.com ad=http://protectionconue.com sd=http://gregistre.protectionconue.com
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Internet Download Accelerator] C:\Program Files\IDA\ida.exe -autorun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: SmartCenter 2.0.lnk = C:\LOTSUITE\SMARTCTR\SMARTCTR.EXE
O4 - Startup: Vente Flash.lnk = C:\Program Files\Vente Flash\vente_flash.exe
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: Download with &Shareaza - res://C:\Program Files\Shareaza\Plugins\RazaWebHook.dll/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: ShopperReports - Compare product prices - {C5428486-50A0-4a02-9D20-520B59A9F9B2} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O10 - Hijacked Internet access by WebHancer
O14 - IERESET.INF: START_PAGE_URL=https://www8.hp.com/fr/fr/home.html
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://jeuxmultijoueurs.orange.fr/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: awtqo - C:\WINDOWS\system32\awtqo.dll (file missing)
O20 - Winlogon Notify: awtqppq - awtqppq.dll (file missing)
O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
O20 - Winlogon Notify: awtsp - C:\WINDOWS\system32\awtsp.dll (file missing)
O20 - Winlogon Notify: awvtr - C:\WINDOWS\system32\awvtr.dll (file missing)
O20 - Winlogon Notify: awvvw - C:\WINDOWS\system32\awvvw.dll (file missing)
O20 - Winlogon Notify: ddayv - C:\WINDOWS\system32\ddayv.dll (file missing)
O20 - Winlogon Notify: ddccc - C:\WINDOWS\system32\ddccc.dll (file missing)
O20 - Winlogon Notify: ddcya - C:\WINDOWS\system32\ddcya.dll (file missing)
O20 - Winlogon Notify: gebcc - C:\WINDOWS\system32\gebcc.dll (file missing)
O20 - Winlogon Notify: jkhfg - C:\WINDOWS\system32\jkhfg.dll (file missing)
O20 - Winlogon Notify: jkhhf - C:\WINDOWS\system32\jkhhf.dll (file missing)
O20 - Winlogon Notify: jkkjg - C:\WINDOWS\system32\jkkjg.dll (file missing)
O20 - Winlogon Notify: mljge - C:\WINDOWS\system32\mljge.dll (file missing)
O20 - Winlogon Notify: mljgg - C:\WINDOWS\system32\mljgg.dll (file missing)
O20 - Winlogon Notify: mljji - C:\WINDOWS\system32\mljji.dll (file missing)
O20 - Winlogon Notify: mllji - C:\WINDOWS\system32\mllji.dll (file missing)
O20 - Winlogon Notify: mllml - C:\WINDOWS\system32\mllml.dll (file missing)
O20 - Winlogon Notify: nnnligf - nnnligf.dll (file missing)
O20 - Winlogon Notify: pmkhe - C:\WINDOWS\system32\pmkhe.dll (file missing)
O20 - Winlogon Notify: pmkhf - C:\WINDOWS\system32\pmkhf.dll (file missing)
O20 - Winlogon Notify: pmnlj - C:\WINDOWS\system32\pmnlj.dll (file missing)
O20 - Winlogon Notify: pmnll - C:\WINDOWS\system32\pmnll.dll (file missing)
O20 - Winlogon Notify: pmnlm - C:\WINDOWS\system32\pmnlm.dll (file missing)
O20 - Winlogon Notify: pmnnm - C:\WINDOWS\system32\pmnnm.dll (file missing)
O20 - Winlogon Notify: ssqro - C:\WINDOWS\system32\ssqro.dll (file missing)
O20 - Winlogon Notify: ssqrs - C:\WINDOWS\system32\ssqrs.dll (file missing)
O20 - Winlogon Notify: sstqn - C:\WINDOWS\system32\sstqn.dll (file missing)
O20 - Winlogon Notify: ssttt - C:\WINDOWS\system32\ssttt.dll (file missing)
O20 - Winlogon Notify: urqrrsr - urqrrsr.dll (file missing)
O20 - Winlogon Notify: vtsqn - C:\WINDOWS\system32\vtsqn.dll (file missing)
O20 - Winlogon Notify: vtsqo - C:\WINDOWS\system32\vtsqo.dll (file missing)
O20 - Winlogon Notify: vtuts - C:\WINDOWS\system32\vtuts.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: CyberLink Media Library Service(HP TVPlay) - Cyberlink - C:\Program Files\HP\TVPlay\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: CyberLink Background Capture Service (CBCS HP TVPlay) (TVPCapSvc) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS HP TVPlay) (TVPSched) - Unknown owner - C:\Program Files\HP\TVPlay\Kernel\TV\TVPSched.exe

ep44 · Answer

je te conseil de créer ton propre message 
merci
@+

ninouche85 · Answer

Rapport bitdefender



BitDefender Online Scanner
	

 
	

 

Rapport d'analyse généré à: Mon, Feb 25, 2008 - 12:46:03

 
	

 
	

 

Voie d'analyse: A:\;C:\;D:\;E:\;G:\;H:\;I:\;J:\;K:\;
	

 
	

 

 
	

 
	

 

Statistiques

Temps
	

01:13:31

Fichiers
	

87080

Directoires
	

12404

Secteurs de boot
	

4

Archives
	

2489

Paquets programmes
	

6570
	

 
	

 

Résultats

Virus identifiés
	

2

Fichiers infectés
	

2

Fichiers suspects
	

0

Avertissements
	

0

Désinfectés
	

0

Fichiers effacés
	

2
	

 
	

 

Info sur les moteurs

Définition virus
	

899742

Version des moteurs
	

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Analyse des plugins
	

14

Archive des plugins
	

38

Unpack des plugins
	

7

E-mail plugins
	

6

Système plugins
	

1
	

 
	

 

Paramètres d'analyse

Première action
	

Désinfecté

Seconde Action
	

Supprimé

Heuristique
	

Oui

Acceptez les avertissements
	

Oui

Extensions analysées
	

exe;com;dll;ocx;scr;bin;dat;386;vxd;sys;wdm;cla;class;ovl;ole;hlp;doc;dot;xls;ppt;wbk;wiz;pot;ppa;xla;xlt;vbs;vbe;mdb;rtf;htm;hta;html;xml;xtp;php;asp;js;shs;chm;lnk;pif;prc;url;smm;pfd;msi;ini;csc;cmd;bas;

Excludez les extensions
	

 

Analyse d'emails
	

Oui

Analyse des Archives
	

Oui

Analyser paquets programmes
	

Oui

Analyse des fichiers
	

Oui

Analyse de boot
	

Oui
	

 
	

 
 

Fichier analysé
	

 Statut

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013
	

Infecté par: Trojan.Downloader.Small.BTF

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013
	

Echec de la désinfection

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE=>wise0013
	

Supprimé

C:\Documents and Settings\Nomii 2\Bureau\Nouveau dossier\PATCHER.EXE
	

Echec de la mise à jour

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005
	

Infecté par: Trojan.Obfus.6.Gen

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005
	

Echec de la désinfection

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)=>lzma_solid_nsis0005
	

Supprimé

C:\Documents and Settings\Nomii 2\Shared\BitDownload Setup.exe=>(NSIS o)
	

Echec de la mise à jour

ep44 · Answer

as tu encore des soucis ?

ninouche85 · Answer

bonsoir,

j'ai juste des messages de spybot pour autoriser ou non certaines modifications mais je ne sais pas quoi répondre.

Le scan de bitdefender montre encore des virus?! Dois-je faire quelque chose d'autre?

ep44 · Answer

pour spybot 

tu ouvres spybot  et tu va dans  mode et tu choisis le mode avancés 
ensuite ==>outils==>résident==>et tu décoche la case tea timer 

ensuite si plus de soucis 
Tu peux supprimer tous les logiciels que nous avons utilisés
va dans ajout/suppression de programes et dans programmes files
pour vérifier



ensuite fait ceci (IMPORTANT)

=démarrer
=panneau de configuration
=système
=onglet Restauration système
=coche la case (Désactiver la restauration système)
=redémarre l'ordinateur
=réactive la ensuite
@-+

ninouche85 · Answer

Il semble ne plus y avoir de problèmes. 
Merci beaucoup

ep44 · Answer

ok content pour toi

;-)

Win 32 : BHO-KD

37 réponses

Discussions similaires