Whosonstage.net/temp/BBB8_Acidente.ppt

jorginho, voila le contenu du log!

le plus bizarre c'est que maintenant, le message a changé et le fichier aussi!

FixNabload : 18/02/2008 - 14:13:19

Présent : C:\Program Files\Microsoft Studio Files
Supprimé : C:\Program Files\Microsoft Studio Files

Présent : C:\Program Files\nsnimage
Supprimé : C:\Program Files\nsnimage

Présent : C:\Program Files\RealtekAZ
Supprimé : C:\Program Files\RealtekAZ

Présent : C:\Program Files\xerox\nwmedia
Supprimé : C:\Program Files\xerox\nwmedia

Présent : C:\WINDOWS\system32\mrdv
Supprimé : C:\WINDOWS\system32\mrdv

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 20EA-3726

R‚pertoire de C:\Program Files\Realtek

12/02/2008 12:29 <REP> .
12/02/2008 12:29 <REP> ..
18/02/2008 11:14 0 exit1111111111.ext
1 fichier(s) 0 octets
2 R‚p(s) 37ÿ210ÿ038ÿ272 octets libres

merci pour l'aide!
;)

jorginho, encore moi! :D


apres avoir fait ce q M.L King a conseille, j'ai refais c q tu m'a dit, et revoila le log:

FixNabload : 18/02/2008 - 14:43:10

Le volume dans le lecteur C n'a pas de nom.
Le num‚ro de s‚rie du volume est 20EA-3726

R‚pertoire de C:\Program Files\Realtek

12/02/2008 12:29 <REP> .
12/02/2008 12:29 <REP> ..
18/02/2008 11:14 0 exit1111111111.ext
1 fichier(s) 0 octets
2 R‚p(s) 37ÿ346ÿ189ÿ312 octets libres

et maintenant???
:D

bonjour M.L king!
j'espere q ta petite s trouve bien.
j'ai fait c q tu a dit.
voila le rapport:


[b][u]SDFix: Version 1.143[/u][/b]

Run by Annick Mo‡ozinho on 18/02/2008 at 14:26

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\ANNICK~1\Bureau\SDFix

[b][u]Checking Services[/u][/b]:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


[b][u]Checking Files[/u][/b]:

No Trojan Files Found






Removing Temp Files...

[b][u]ADS Check[/u][/b]:



[b][u]Final Check[/u][/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-18 14:34:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b][u]Remaining Services[/u][/b]:



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"="C:\\Program Files\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe:*:Enabled:VoipDiscount"
"C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windows© NetMeeting©"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Magentic\\bin\\MgImp.exe"="C:\\Program Files\\Magentic\\bin\\MgImp.exe:*:Enabled:Magentic"
"C:\\Program Files\\Magentic\\bin\\Magentic.exe"="C:\\Program Files\\Magentic\\bin\\Magentic.exe:*:Enabled:Magentic"
"C:\\Program Files\\Magentic\\bin\\MgApp.exe"="C:\\Program Files\\Magentic\\bin\\MgApp.exe:*:Enabled:Magentic"
"C:\\WINDOWS\\system32\\mcoinstall.exe"="C:\\WINDOWS\\system32\\mcoinstall.exe:*:Disabled:mcoinstall"
"C:\\Program Files\\ooVoo\\ooVoo.exe"="C:\\Program Files\\ooVoo\\ooVoo.exe:*:Disabled:ooVoo"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Documents and Settings\\Annick Mo‡ozinho\\Local Settings\\Temporary Internet Files\\Content.IE5\\7E6UDKXP\\installer-38284-845-Open-Office-complet-en-francais-French[1].exe"="C:\\Documents and Settings\\Annick Mo‡ozinho\\Local Settings\\Temporary Internet Files\\Content.IE5\\7E6UDKXP\\installer-38284-845-Open-Office-complet-en-francais-French[1].exe:*:Disabled:installer-38284-845-Open-Office-complet-en-francais-French[1]"
"C:\\Program Files\\Microsoft Studio Files\\lsass.exe"="C:\\Program Files\\Microsoft Studio Files\\lsass.exe:*:Enabled:Session Win32"
"C:\\Program Files\\nsnimage\\nsvcrmx.exe"="C:\\Program Files\\nsnimage\\nsvcrmx.exe:*:Enabled:Session Win32"
"C:\\Program Files\\jsload32\\nsvcrmx.exe"="C:\\Program Files\\jsload32\\nsvcrmx.exe:*:Enabled:Session Win32"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Program Files\\Microsoft Studio Files\\lsass.exe"="C:\\Program Files\\Microsoft Studio Files\\lsass.exe:*:Enabled:Session Win32"
"C:\\Program Files\\nsnimage\\nsvcrmx.exe"="C:\\Program Files\\nsnimage\\nsvcrmx.exe:*:Enabled:Session Win32"
"C:\\Program Files\\jsload32\\nsvcrmx.exe"="C:\\Program Files\\jsload32\\nsvcrmx.exe:*:Enabled:Session Win32"

[b][u]Remaining Files[/u][/b]:



[b][u]Files with Hidden Attributes[/u][/b]:

Sat 15 Sep 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Wed 12 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"
Wed 17 Oct 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5c703fe0947475848e966b61999878d1\BIT2.tmp"

[b]Finished![/b]

j'attends d tes nouvelles! merci! ;)

salut jorginho!!

on y arrive! :D du moins, je ne reçoi plus les messages!

voila le log:


---> Fichiers/Dossiers trouvés

- C:\WINDOWS\system32\f3PSSavr.scr
- C:\Program Files\MyWebSearch\
- C:\Program Files\ShoppingReport\
- C:\Program Files\FunWebProducts\
- C:\Program Files\Internet Explorer\msimg32.dll
- C:\Program Files\MSN Messenger\RICHED20.dll
- C:\Documents and Settings\Annick Moçozinho\Application Data\ShoppingReport\

---> Analyse terminée

salut!!
et on y va :D

le log de BTfix (plein de cochonneries, il faut dire!):


---> Fichiers/dossiers supprimés (Première passe)

- Fichiers temporaires effacés
- C:\WINDOWS\system32\f3PSSavr.scr
- C:\Program Files\MyWebSearch\bar\1.bin\
- C:\Program Files\MyWebSearch\bar\Avatar\
- C:\Program Files\MyWebSearch\bar\Cache\
- C:\Program Files\MyWebSearch\bar\Game\
- C:\Program Files\MyWebSearch\bar\History\
- C:\Program Files\MyWebSearch\bar\icons\
- C:\Program Files\MyWebSearch\bar\Message\
- C:\Program Files\MyWebSearch\bar\Notifier\
- C:\Program Files\MyWebSearch\bar\Settings\
- C:\Program Files\MyWebSearch\bar\
- C:\Program Files\MyWebSearch\SrchAstt\1.bin\
- C:\Program Files\MyWebSearch\SrchAstt\
- C:\Program Files\MyWebSearch\
- C:\Program Files\ShoppingReport\Bin\2.0.24\
- C:\Program Files\ShoppingReport\Bin\
- C:\Program Files\ShoppingReport\cs\
- C:\Program Files\ShoppingReport\
- C:\Program Files\FunWebProducts\ScreenSaver\Images\
- C:\Program Files\FunWebProducts\ScreenSaver\
- C:\Program Files\FunWebProducts\Shared\Cache\
- C:\Program Files\FunWebProducts\Shared\
- C:\Program Files\FunWebProducts\
- C:\Program Files\Internet Explorer\msimg32.dll
- C:\Program Files\MSN Messenger\RICHED20.dll
- C:\Documents and Settings\Annick Moçozinho\Application Data\ShoppingReport\cs\db\
- C:\Documents and Settings\Annick Moçozinho\Application Data\ShoppingReport\cs\dwld\
- C:\Documents and Settings\Annick Moçozinho\Application Data\ShoppingReport\cs\report\
- C:\Documents and Settings\Annick Moçozinho\Application Data\ShoppingReport\cs\res2\
- C:\Documents and Settings\Annick Moçozinho\Application Data\ShoppingReport\cs\
- C:\Documents and Settings\Annick Moçozinho\Application Data\ShoppingReport\

---> Nettoyage terminé



et le log du hijackthis:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:20:52, on 19/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\ooVoo\ooVoo.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\sol.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll (file missing)
R3 - URLSearchHook: Absolutist Games Toolbar - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - C:\Program Files\Absolutist_Games\tbAbso.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Absolutist Games Toolbar - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - C:\Program Files\Absolutist_Games\tbAbso.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Absolutist Games Toolbar - {631ac2d4-57b3-42b0-a148-da33b462c1a3} - C:\Program Files\Absolutist_Games\tbAbso.dll
O4 - HKLM\..\Run: [EPSON Stylus Photo R200 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0H2.EXE /P30 "EPSON Stylus Photo R200 Series" /O6 "USB001" /M "Stylus Photo R200"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] ~"C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] ~"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [VoipDiscount] "C:\Program Files\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
O4 - HKCU\..\Run: [ooVoo.exe] C:\Program Files\ooVoo\ooVoo.exe /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{A6E1CFBF-6ED2-4609-8E74-1FA0348818DD}: NameServer = 212.55.154.174
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

coucou!

le fournisseur internet est portugais... et oui, au pays du soleil:D

quand au toolbars, je les deteste, moi aussi, mais elle les aimes...
je vais tenter d lui faire la tete pour les enlever, mais je ne promet rien :D
encor merci!



...::~ON A TUE LES SALES BESTIOLES~::...


..-*-.._..-^-.._..-*-.._..-^-.._..-*-.._..-^-.._..-*-..


:D