Résultat Hijackthis suite à virus VundoTrojan

slt,

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked".

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: (no name) - {3F846292-1922-43B6-8A97-35367D4A8433} - C:\WINDOWS\system32\pmnlk.dll (file missing)
O2 - BHO: {904f62bd-ef52-0ee8-3294-e369233769a6} - {6a967332-963e-4923-8ee0-25fedb26f409} - C:\WINDOWS\system32\nyibobxg.dll (file missing)
O2 - BHO: SXG Advisor - {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} - C:\WINDOWS\dmdvpnslp.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [94695790] rundll32.exe "C:\WINDOWS\system32\pvbdfaca.dll",b
O4 - HKLM\..\RunOnce: [VundoFix] "C:\Documents and Settings\Vincent\Bureau\vundofix.exe"
O
O21 - SSODL: bdmanager - {784C03F7-BBBA-470B-833B-60D54E49685B} - C:\WINDOWS\bdmanager.dll
O21 - SSODL: admgcx - {F7E375DD-024C-452F-80A3-A52E12B1EFD2} - (no file)

__________________

Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

File::
C:\WINDOWS\system32\nyibobxg.dll
C:\WINDOWS\system32\pvbdfaca.dll
C:\WINDOWS\dmdvpnslp.dll
C:\WINDOWS\system32\pmnlk.dll
C:\WINDOWS\dmdvpnslp.dll
C:\WINDOWS\system32\jkklkhi.dll.vir

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F846292-1922-43B6-8A97-35367D4A8433}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6a967332-963e-4923-8ee0-25fedb26f409}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FFDE480-14C1-43FC-BEC1-CA97A2541FFD}]

Enregistre ce fichier sous le nom CFscript

Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis

Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

_________________

colle le rapport d'un scan en ligne
avec un des suivants:

bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

___________________
Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau.
Ensuite double clique sur navilog1.exe pour lancer l'installation.
Une fois l'installation terminée, le fix s'exécutera automatiquement.
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau).

Laisse-toi guider. Au menu principal, choisis 1 et valides.
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord)

Patiente jusqu'au message :
*** Analyse Termine le ..... ***
Appuie sur une touche comme demandé, le blocnote va s'ouvrir.
Copie-colle l'intégralité dans une réponse. Referme le blocnote.
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Merci de continuer sur un poste afin de ne pas mobiliser plusieurs personnes pour le même problème ! ;-)

slt,

scan avec vundofix (colle le rapport)

Téléchargez VundoFix -> http://www.atribune.org/ccount/click.php?id=4

Double cliquez VundoFix.exe pour l'exécuter.
Quand VundoFix s'ouvre, cliquez sur le bouton Scan for Vundo.
Une fois le scan fini, cliquez sur le bouton Remove Vundo.
Vous recevrez un avertissement vous demandant si vous voulez effacer ces
fichiers répondez en cliquant sur YES
Une fois que vous avez cliqué yes, votre bureau deviendra vide au moment où il
enlève Vundo.

Quand c'est fini, il vous sera demandé de redémarrer votre ordinateur, cliquez
OK.

______________
puis :

virtumondebegone (colle le rapport)

http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

_____________

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

_____________

recoplle un nouveau rapport hiajkchtis:

Je conseille de renomer Hijackthis, pour contrer l'infection que tu as

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

--------------

Bonsoir,

Dois je faire tout cela en mode san échec? Déconnecter d'Internet? Avec mon antivirus actuel désactivé?

Slts

de preference en mode sans echec, et deconnécté d'interent

Bonsoir,

Je suis passé par toutes les étapes telles que décrites.

Trouves ci-dessous le rapport de VundoFix. A titre d'info au dernier démarrage j'ai eu un pb avec une DLL manquante vu qu'elle a été effacée (pvbdfaca.dll)

Rapport:
C:\WINDOWS\system32\bvbkcehf.dll
C:\WINDOWS\system32\fqhxctme.dll
C:\WINDOWS\system32\hyomqlce.dll
C:\WINDOWS\system32\jdkcujfw.dll
C:\WINDOWS\system32\jkklkhi.dll
C:\WINDOWS\system32\klnmp.ini
C:\WINDOWS\system32\klnmp.ini2
C:\WINDOWS\system32\nyibobxg.dll
C:\WINDOWS\system32\pmnlk.dll
C:\WINDOWS\system32\pmnopno.dll
C:\WINDOWS\system32\pvbdfaca.dll
C:\WINDOWS\system32\qollsocv.dll
C:\WINDOWS\system32\rmrsofan.dll
C:\WINDOWS\system32\vthfohmu.dll
C:\WINDOWS\system32\wdhyrbed.dll

Suite à toutes les étapes, j'ai refait tourné le programme qui n'a plus trouvé de fichier infecté.

Ci-dessous rapport de virtumondebegone:

[02/24/2008, 21:50:45] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Vincent\Bureau\VirtumundoBeGone.exe" )
[02/24/2008, 21:50:52] - Detected System Information:
[02/24/2008, 21:50:52] - Windows Version: 5.1.2600, Service Pack 2
[02/24/2008, 21:50:52] - Current Username: Vincent (Admin)
[02/24/2008, 21:50:52] - Windows is in SAFE mode with Networking.
[02/24/2008, 21:50:52] - Searching for Browser Helper Objects:
[02/24/2008, 21:50:52] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:50:52] - BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] - Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:50:52] - Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:50:52] - BHO 3: {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] - Checking for HKLM\...\Winlogon\Notify\jkklkhi
[02/24/2008, 21:50:52] - Found: HKLM\...\Winlogon\Notify\jkklkhi - This is probably Virtumundo.
[02/24/2008, 21:50:52] - Assigning {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA} MSEvents Object
[02/24/2008, 21:50:52] - BHO list has been changed! Starting over...
[02/24/2008, 21:50:52] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:50:52] - BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] - Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:50:52] - Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:50:52] - BHO 3: {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA} (MSEvents Object)
[02/24/2008, 21:50:52] - ALERT: Found MSEvents Object!
[02/24/2008, 21:50:52] - BHO 4: {3F846292-1922-43B6-8A97-35367D4A8433} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] - Checking for HKLM\...\Winlogon\Notify\pmnlk
[02/24/2008, 21:50:52] - Key not found: HKLM\...\Winlogon\Notify\pmnlk, continuing.
[02/24/2008, 21:50:52] - BHO 5: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[02/24/2008, 21:50:52] - BHO 6: {6a967332-963e-4923-8ee0-25fedb26f409} ()
[02/24/2008, 21:50:52] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:52] - Checking for HKLM\...\Winlogon\Notify\nyibobxg
[02/24/2008, 21:50:52] - Key not found: HKLM\...\Winlogon\Notify\nyibobxg, continuing.
[02/24/2008, 21:50:52] - BHO 7: {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} (SXG Advisor)
[02/24/2008, 21:50:52] - BHO 8: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/24/2008, 21:50:52] - BHO 9: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} (scriptproxy)
[02/24/2008, 21:50:52] - BHO 10: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/24/2008, 21:50:52] - BHO 11: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/24/2008, 21:50:52] - Finished Searching Browser Helper Objects
[02/24/2008, 21:50:52] - *** Detected MSEvents Object
[02/24/2008, 21:50:52] - Trying to remove MSEvents Object...
[02/24/2008, 21:50:53] - Terminating Process: IEXPLORE.EXE
[02/24/2008, 21:50:54] - Terminating Process: RUNDLL32.EXE
[02/24/2008, 21:50:54] - Disabling Automatic Shell Restart
[02/24/2008, 21:50:54] - Terminating Process: EXPLORER.EXE
[02/24/2008, 21:50:54] - Suspending the NT Session Manager System Service
[02/24/2008, 21:50:54] - Terminating Windows NT Logon/Logoff Manager
[02/24/2008, 21:50:54] - Re-enabling Automatic Shell Restart
[02/24/2008, 21:50:54] - File to disable: C:\WINDOWS\system32\jkklkhi.dll
[02/24/2008, 21:50:54] - Renaming C:\WINDOWS\system32\jkklkhi.dll -> C:\WINDOWS\system32\jkklkhi.dll.vir
[02/24/2008, 21:50:54] - File successfully renamed!
[02/24/2008, 21:50:54] - Removing HKLM\...\Browser Helper Objects\{3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA}
[02/24/2008, 21:50:54] - Removing HKCR\CLSID\{3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA}
[02/24/2008, 21:50:54] - Adding Kill Bit for ActiveX for GUID: {3A2FF3C5-EDFF-46CE-BBA0-7A68B2499DBA}
[02/24/2008, 21:50:54] - Deleting ATLEvents/MSEvents Registry entries
[02/24/2008, 21:50:54] - Removing HKLM\...\Winlogon\Notify\jkklkhi
[02/24/2008, 21:50:54] - Searching for Browser Helper Objects:
[02/24/2008, 21:50:54] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:50:54] - BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:50:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:54] - Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:50:54] - Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:50:54] - BHO 3: {3F846292-1922-43B6-8A97-35367D4A8433} ()
[02/24/2008, 21:50:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:54] - Checking for HKLM\...\Winlogon\Notify\pmnlk
[02/24/2008, 21:50:54] - Key not found: HKLM\...\Winlogon\Notify\pmnlk, continuing.
[02/24/2008, 21:50:54] - BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[02/24/2008, 21:50:54] - BHO 5: {6a967332-963e-4923-8ee0-25fedb26f409} ()
[02/24/2008, 21:50:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:50:54] - Checking for HKLM\...\Winlogon\Notify\nyibobxg
[02/24/2008, 21:50:54] - Key not found: HKLM\...\Winlogon\Notify\nyibobxg, continuing.
[02/24/2008, 21:50:54] - BHO 6: {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} (SXG Advisor)
[02/24/2008, 21:50:54] - BHO 7: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/24/2008, 21:50:54] - BHO 8: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} (scriptproxy)
[02/24/2008, 21:50:54] - BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/24/2008, 21:50:54] - BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/24/2008, 21:50:54] - Finished Searching Browser Helper Objects
[02/24/2008, 21:50:54] - Finishing up...
[02/24/2008, 21:50:54] - A restart is needed.
[02/24/2008, 21:51:09] - Attempting to Restart via STOP error (Blue Screen!)

[02/24/2008, 21:52:40] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Vincent\Bureau\VirtumundoBeGone.exe" )
[02/24/2008, 21:52:49] - Detected System Information:
[02/24/2008, 21:52:49] - Windows Version: 5.1.2600, Service Pack 2
[02/24/2008, 21:52:49] - Current Username: Vincent (Admin)
[02/24/2008, 21:52:49] - Windows is in SAFE mode with Networking.
[02/24/2008, 21:52:49] - Searching for Browser Helper Objects:
[02/24/2008, 21:52:49] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Aide pour le lien d'Adobe PDF Reader)
[02/24/2008, 21:52:49] - BHO 2: {089FD14D-132B-48FC-8861-0048AE113215} ()
[02/24/2008, 21:52:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:52:49] - Checking for HKLM\...\Winlogon\Notify\SiteAdv
[02/24/2008, 21:52:49] - Key not found: HKLM\...\Winlogon\Notify\SiteAdv, continuing.
[02/24/2008, 21:52:49] - BHO 3: {3F846292-1922-43B6-8A97-35367D4A8433} ()
[02/24/2008, 21:52:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:52:49] - Checking for HKLM\...\Winlogon\Notify\pmnlk
[02/24/2008, 21:52:49] - Key not found: HKLM\...\Winlogon\Notify\pmnlk, continuing.
[02/24/2008, 21:52:49] - BHO 4: {5CA3D70E-1895-11CF-8E15-001234567890} (DriveLetterAccess)
[02/24/2008, 21:52:49] - BHO 5: {6a967332-963e-4923-8ee0-25fedb26f409} ()
[02/24/2008, 21:52:49] - WARNING: BHO has no default name. Checking for Winlogon reference.
[02/24/2008, 21:52:49] - Checking for HKLM\...\Winlogon\Notify\nyibobxg
[02/24/2008, 21:52:49] - Key not found: HKLM\...\Winlogon\Notify\nyibobxg, continuing.
[02/24/2008, 21:52:49] - BHO 6: {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} (SXG Advisor)
[02/24/2008, 21:52:49] - BHO 7: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[02/24/2008, 21:52:49] - BHO 8: {7DB2D5A0-7241-4E79-B68D-6309F01C5231} (scriptproxy)
[02/24/2008, 21:52:49] - BHO 9: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[02/24/2008, 21:52:49] - BHO 10: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} (Google Toolbar Notifier BHO)
[02/24/2008, 21:52:49] - Finished Searching Browser Helper Objects
[02/24/2008, 21:52:49] - Finishing up...
[02/24/2008, 21:52:49] - Nothing found! Exiting...

Autre rapport dans message à suivre.

Slts

Salut,

Le fenêtres pop sont toujours là:

Ci-dessous le rapport de ComboFix:

ComboFix 08-02-24.4 - Vincent 2008-02-24 21:56:32.1 - NTFSx86 MINIMAL
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.812 [GMT 1:00]
Endroit: C:\Documents and Settings\Vincent\Bureau\KillBagle.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\Vincent\Application Data\inst.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\dat.txt
C:\WINDOWS\search_res.txt
C:\WINDOWS\system32\acafdbvp.ini
C:\WINDOWS\system32\antpcomj.ini
C:\WINDOWS\system32\aofkiriu.ini
C:\WINDOWS\system32\avfqhymh.ini
C:\WINDOWS\system32\debryhdw.ini
C:\WINDOWS\system32\kmuvfjkx.ini
C:\WINDOWS\system32\myvjhnov.ini
C:\WINDOWS\system32\nialwyue.ini
C:\WINDOWS\system32\uholcxix.ini

----- BITS: Possible sites infect‚s -----

hxxp://softworldnetwork.com
hxxp://onsafepro.com
.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-24 to 2008-02-24 ))))))))))))))))))))))))))))))))))))
.

2008-02-24 21:16 . 2008-02-24 21:16 <REP> d-------- C:\VundoFix Backups
2008-02-24 21:06 . 2008-02-24 21:06 <REP> d-------- C:\HijackThis
2008-02-24 15:04 . 2008-02-24 16:30 <REP> d-------- C:\Program Files\Navilog1
2008-02-23 17:37 . 2008-02-23 17:37 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-02-23 16:52 . 2008-02-24 17:19 <REP> d-------- C:\Program Files\RegCure
2008-02-23 14:07 . 2008-02-23 14:20 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\RegClean
2008-02-23 11:25 . 2008-02-23 11:26 <REP> d-------- C:\Documents and Settings\Vincent\Shared
2008-02-23 11:24 . 2008-02-23 11:26 <REP> d-------- C:\Documents and Settings\Vincent\Incomplete
2008-02-23 11:24 . 2008-02-23 11:27 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\LimeWire
2008-02-22 16:44 . 2008-02-22 16:44 37,888 --a------ C:\WINDOWS\system32\jkklkhi.dll.vir
2008-02-22 14:40 . 2008-02-22 15:42 <REP> d-------- C:\Program Files\XoftSpySE
2008-02-21 19:14 . 2008-02-20 23:56 315,392 --a------ C:\WINDOWS\dmdvpnslp.dll
2008-02-21 19:14 . 2008-02-20 23:56 282,624 --a------ C:\WINDOWS\bdmanager.dll
2008-02-21 19:14 . 2008-02-20 23:56 90,112 --a------ C:\WINDOWS\fsxloqf.exe
2008-01-30 14:30 . 2008-01-30 14:30 <REP> d--h----- C:\WINDOWS\PIF
2008-01-28 23:34 . 2008-01-28 23:34 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\Samsung
2008-01-28 23:25 . 2008-01-28 23:25 <REP> d-------- C:\Program Files\Samsung
2008-01-27 21:50 . 2008-01-27 21:50 <REP> d-------- C:\Program Files\Virtools

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 10:21 --------- d-----w C:\Program Files\McAfee
2008-02-23 16:50 --------- d-----w C:\Documents and Settings\Vincent\Application Data\SiteAdvisor
2008-02-23 13:00 --------- d-----w C:\Program Files\BeClean
2008-02-22 15:12 --------- d-----w C:\Program Files\eMule
2008-02-22 14:42 --------- d-----w C:\Program Files\eMedia Codec
2008-01-28 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-22 16:38 --------- d-----w C:\Documents and Settings\Justine\Application Data\SiteAdvisor
2008-01-12 01:05 --------- d-----w C:\Program Files\IZArc
2008-01-12 00:59 --------- d-----w C:\Program Files\Mio Technology
2008-01-05 18:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\InternetFax
2008-01-05 18:33 --------- d-----w C:\Program Files\Alliance MCA
2008-01-05 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\tpfmon
2008-01-03 11:11 --------- d-----w C:\Program Files\Webshots
2007-11-20 20:45 47,360 ----a-w C:\Documents and Settings\Vincent\Application Data\pcouffin.sys
2006-08-02 06:37 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-06-12 20:56 251 -c--a-w C:\Program Files\wt3d.ini
2006-04-27 12:07 88 -csh--r C:\WINDOWS\system32\BC85CFD0CB.sys
2006-04-27 11:58 104 -csh--r C:\WINDOWS\system32\CBD0CF85BC.sys
2006-04-27 12:07 5,852 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F846292-1922-43B6-8A97-35367D4A8433}]
C:\WINDOWS\system32\pmnlk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6a967332-963e-4923-8ee0-25fedb26f409}]
C:\WINDOWS\system32\nyibobxg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6FFDE480-14C1-43FC-BEC1-CA97A2541FFD}]
2008-02-20 23:56 315392 --a------ C:\WINDOWS\dmdvpnslp.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 18:40 24576 C:\WINDOWS\MIDIDEF.EXE]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-01-23 08:06 204843]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-19 09:36 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 03:04 59392]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 08:56 139264]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064]
"MBMon"="CTMBHA.DLL" [2005-05-19 09:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 08:42 1159168]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20 122940]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600]
"Creative WebCam Tray"="C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE" [1999-04-27 02:00 18944]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920]
"ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-04-11 00:44 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-12-25 11:53 185896]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 17:30 152144]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-05 20:10 36904]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 16:57 81408]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 01:20 339968 C:\WINDOWS\stsystra.exe]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 08:47 57344]
"94695790"="C:\WINDOWS\system32\pvbdfaca.dll" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"VundoFix"="C:\Documents and Settings\Vincent\Bureau\vundofix.exe" [2008-02-24 20:59 132608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bdmanager"= {784C03F7-BBBA-470B-833B-60D54E49685B} - C:\WINDOWS\bdmanager.dll [2008-02-20 23:56 282624]

[HKLM\~\startupfolder\C:^Documents and Settings^Vincent^Menu Démarrer^Programmes^Démarrage^Registration-Studio 8.lnk]
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S3 CTL511Plus;Video Blaster WebCam 3/WebCam Plus (WDM);C:\WINDOWS\system32\DRIVERS\webc3vid.sys [2000-09-14 13:00]
S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-10-14 23:24:39 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2007-09-01 07:16:24 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2008-02-23 13:49:39 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean
"2008-02-24 16:00:01 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-02-23 15:52:16 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-02-24 16:00:04 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-02-23 09:38:13 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 22:01:13
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-24 22:04:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-24 21:04:20
.
2008-02-13 07:15:57 --- E O F ---

et le rapport de Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:07:23, on 24/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\WINDOWS\explorer.exe
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: (no name) - {3F846292-1922-43B6-8A97-35367D4A8433} - C:\WINDOWS\system32\pmnlk.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: {904f62bd-ef52-0ee8-3294-e369233769a6} - {6a967332-963e-4923-8ee0-25fedb26f409} - C:\WINDOWS\system32\nyibobxg.dll (file missing)
O2 - BHO: SXG Advisor - {6FFDE480-14C1-43FC-BEC1-CA97A2541FFD} - C:\WINDOWS\dmdvpnslp.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [94695790] rundll32.exe "C:\WINDOWS\system32\pvbdfaca.dll",b
O4 - HKLM\..\RunOnce: [VundoFix] "C:\Documents and Settings\Vincent\Bureau\vundofix.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O21 - SSODL: bdmanager - {784C03F7-BBBA-470B-833B-60D54E49685B} - C:\WINDOWS\bdmanager.dll
O21 - SSODL: admgcx - {F7E375DD-024C-452F-80A3-A52E12B1EFD2} - (no file)
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

Salut,

L'analyse Bit Defender est en cours.
Trouves ci-dessous les rapports Combo fix (en premier) et ensuite Hijackthis:

ComboFix 08-02-24.4 - Vincent 2008-02-24 23:26:25.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.557 [GMT 1:00]
Endroit: C:\Documents and Settings\Vincent\Bureau\KillBagle.exe
Command switches used :: C:\Documents and Settings\Vincent\Bureau\CFscript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\WINDOWS\dmdvpnslp.dll
C:\WINDOWS\system32\jkklkhi.dll.vir
C:\WINDOWS\system32\nyibobxg.dll
C:\WINDOWS\system32\pmnlk.dll
C:\WINDOWS\system32\pvbdfaca.dll
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\dat.txt
C:\WINDOWS\search_res.txt
C:\WINDOWS\system32\jkklkhi.dll.vir

----- BITS: Possible sites infectés -----

hxxp://softworldnetwork.com
.
((((((((((((((((((((((((((((( Fichiers créés 2008-01-24 to 2008-02-24 ))))))))))))))))))))))))))))))))))))
.

2008-02-24 22:15 . 2008-02-24 22:15 <REP> d-------- C:\Documents and Settings\NetworkService\Menu Démarrer
2008-02-24 22:15 . 2008-02-24 22:15 <REP> d-------- C:\Documents and Settings\LocalService\Menu Démarrer
2008-02-24 21:16 . 2008-02-24 22:15 <REP> d-------- C:\VundoFix Backups
2008-02-24 21:06 . 2008-02-24 23:22 <REP> d-------- C:\HijackThis
2008-02-24 15:04 . 2008-02-24 16:30 <REP> d-------- C:\Program Files\Navilog1
2008-02-23 17:37 . 2008-02-23 17:37 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-02-23 16:52 . 2008-02-24 17:19 <REP> d-------- C:\Program Files\RegCure
2008-02-23 14:07 . 2008-02-23 14:20 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\RegClean
2008-02-23 11:25 . 2008-02-23 11:26 <REP> d-------- C:\Documents and Settings\Vincent\Shared
2008-02-23 11:24 . 2008-02-23 11:26 <REP> d-------- C:\Documents and Settings\Vincent\Incomplete
2008-02-23 11:24 . 2008-02-23 11:27 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\LimeWire
2008-02-22 14:40 . 2008-02-22 15:42 <REP> d-------- C:\Program Files\XoftSpySE
2008-02-21 19:14 . 2008-02-20 23:56 282,624 --a------ C:\WINDOWS\bdmanager.dll
2008-02-21 19:14 . 2008-02-20 23:56 90,112 --a------ C:\WINDOWS\fsxloqf.exe
2008-02-03 10:00 . 2008-02-03 10:00 <REP> d-------- C:\Documents and Settings\Valérie\Application Data\Samsung
2008-01-30 14:30 . 2008-01-30 14:30 <REP> d--h----- C:\WINDOWS\PIF
2008-01-28 23:34 . 2008-01-28 23:34 <REP> d-------- C:\Documents and Settings\Vincent\Application Data\Samsung
2008-01-28 23:25 . 2008-01-28 23:25 <REP> d-------- C:\Program Files\Samsung
2008-01-27 21:50 . 2008-01-27 21:50 <REP> d-------- C:\Program Files\Virtools

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-24 10:21 --------- d-----w C:\Program Files\McAfee
2008-02-23 16:50 --------- d-----w C:\Documents and Settings\Vincent\Application Data\SiteAdvisor
2008-02-23 13:00 --------- d-----w C:\Program Files\BeClean
2008-02-22 15:12 --------- d-----w C:\Program Files\eMule
2008-02-22 14:42 --------- d-----w C:\Program Files\eMedia Codec
2008-01-29 12:16 --------- d-----w C:\Documents and Settings\Valérie\Application Data\SiteAdvisor
2008-01-28 22:28 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-22 16:38 --------- d-----w C:\Documents and Settings\Justine\Application Data\SiteAdvisor
2008-01-12 01:05 --------- d-----w C:\Program Files\IZArc
2008-01-12 00:59 --------- d-----w C:\Program Files\Mio Technology
2008-01-05 18:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\InternetFax
2008-01-05 18:33 --------- d-----w C:\Program Files\Alliance MCA
2008-01-05 18:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\tpfmon
2008-01-03 11:11 --------- d-----w C:\Program Files\Webshots
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:41 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2007-11-20 20:45 47,360 ----a-w C:\Documents and Settings\Vincent\Application Data\pcouffin.sys
2006-08-02 06:37 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-06-12 20:56 251 -c--a-w C:\Program Files\wt3d.ini
2006-04-27 12:07 88 -csh--r C:\WINDOWS\system32\BC85CFD0CB.sys
2006-04-27 11:58 104 -csh--r C:\WINDOWS\system32\CBD0CF85BC.sys
2006-04-27 12:07 5,852 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 18:40 24576 C:\WINDOWS\MIDIDEF.EXE]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400]
"IncrediMail"="C:\Program Files\IncrediMail\bin\IncMail.exe" [2007-01-23 08:06 204843]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-19 09:36 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 03:04 59392]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 08:56 139264]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05 344064]
"MBMon"="CTMBHA.DLL" [2005-05-19 09:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 08:42 1159168]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 06:20 122940]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600]
"Creative WebCam Tray"="C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE" [1999-04-27 02:00 18944]
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44 81920]
"ISUSPM Startup"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44 249856]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 19:24 32768]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-12-25 11:53 185896]
"MskAgentexe"="C:\Program Files\McAfee\MSK\MskAgent.exe" [2007-01-17 17:30 152144]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6253\SiteAdv.exe" [2007-03-05 20:10 36904]
"AliceSAV"="C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe" [2005-12-16 16:57 81408]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 01:20 339968 C:\WINDOWS\stsystra.exe]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 08:47 57344]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 15:09 15360]

C:\Documents and Settings\Val‚rie\Menu D‚marrer\Programmes\D‚marrage\
Webshots.lnk - C:\Program Files\Webshots\WebshotsTray.exe [2007-12-02 11:51:17 192512]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
EPSON SMART PANEL for Scanner.lnk - C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe [2006-03-10 00:37:22 180224]
Lancement Application Fax.lnk - C:\Program Files\Alliance MCA\SafeFax\faxtray.exe [2008-01-05 19:33:23 823296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"bdmanager"= {A58D46CE-4F12-46E7-80D5-47414FD651E0} - C:\WINDOWS\bdmanager.dll [2008-02-20 23:56 282624]

[HKLM\~\startupfolder\C:^Documents and Settings^Vincent^Menu Démarrer^Programmes^Démarrage^Registration-Studio 8.lnk]
backup=C:\WINDOWS\pss\Registration-Studio 8.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"=
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"C:\\Program Files\\eMule\\emule.exe"=
"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S3 CTL511Plus;Video Blaster WebCam 3/WebCam Plus (WDM);C:\WINDOWS\system32\DRIVERS\webc3vid.sys [2000-09-14 13:00]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-10-14 23:24:39 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2007-09-01 07:16:24 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
"2008-02-23 13:49:39 C:\WINDOWS\Tasks\RegClean Scheduled Scan.job"
- C:\Program Files\RegClean\RegClean.ex
- C:\Program Files\RegClean
"2008-02-24 22:11:50 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-02-23 15:52:16 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-02-24 22:11:51 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-02-23 09:38:13 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-24 23:29:10
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-24 23:29:48
ComboFix-quarantined-files.txt 2008-02-24 22:29:46
ComboFix2.txt 2008-02-24 22:08:35
ComboFix3.txt 2008-02-24 21:04:23
.
2008-02-13 07:15:57 --- E O F ---

Rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:37:41, on 24/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://portail.free.fr/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O21 - SSODL: bdmanager - {A58D46CE-4F12-46E7-80D5-47414FD651E0} - C:\WINDOWS\bdmanager.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

Salut,

Rapport BitDefender:

Fichier analysé
Statut

C:\HijackThis\backups\backup-20080224-232239-293.dll
Détecté avec: Adware.NetAdware.EF

C:\HijackThis\backups\backup-20080224-232239-293.dll
Supprimé

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP10\A0000183.dll
Détecté avec: Adware.NetAdware.EF

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP10\A0000183.dll
Supprimé

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP11\A0000235.dll
Détecté avec: Adware.NetAdware.EF

C:\System Volume Information\_restore{C75D780B-5CD4-494E-AB96-5DA2A6677439}\RP11\A0000235.dll
Supprimé

Rapport Navilog1:

Search Navipromo version 3.4.7 commencé le 25/02/2008 à 0:08:59,50

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files\navilog1
Mise à jour le 23.02.2008 à 20h00 par IL-MAFIOSO

Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 7.0.5730.11
Système de fichiers : NTFS

Executé en mode normal

*** Recherche Programmes installés ***

*** Recherche dossiers dans C:\WINDOWS ***

*** Recherche dossiers dans C:\Program Files ***

*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\APPLIC~1 ***

*** Recherche dossiers dans "C:\Documents and Settings\Vincent\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Vincent\locals~1\applic~1" ***

*** Recherche dossiers dans "C:\Documents and Settings\Vincent\MENUDM~1\PROGRA~1" ***

*** Recherche dossiers dans C:\DOCUME~1\ALLUSE~1\MENUD?~1\PROGRA~1 ***

*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé

*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans C:\WINDOWS\system32 *

* Recherche dans "C:\Documents and Settings\Vincent\locals~1\applic~1" *

*** Recherche fichiers ***

*** Recherche clés spécifiques dans le Registre ***

*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :

2)Recherche Heuristique :

* Dans C:\WINDOWS\system32 :

* Dans "C:\Documents and Settings\Vincent\locals~1\applic~1" :

3)Recherche Certificats :

Certificat Egroup absent !

4)Recherche fichiers connus :

*** Analyse terminée le 25/02/2008 à 0:13:41,71 ***

J'espère que tout est OK maintenant.

Slts

ok

vire hijakchits de ton ordi

__________

desactive la restauration syteme pour purger les virus qui seraient dedans
puis redemarre ton ordi
puis reactive là (dans DEMARRER puis TOUS LES PROGRAMMES puis ACCESSOIRE puis OUTILS SYSTEME puis RESTAURATION SYSTEME puis parametre)

____________

encore des soucis?????

fait smitfraud fix

http://siri.urz.free.fr/Fix/ (colle le rapport

double clique sur smitfraudfix.cmd. puis selectionne 1 et appuyer sur entrée afin de créer le rapport des infection présentes.

Salut,

Je n'avais donc pas besoin d'écrire mon petit mot sur l'autre forum vu que vous avez déjà trouver cette discussion.

J'ai bien avancé avec l'aide de Jlpjlp. Je vais faire les dernières actions demandées et vous tiendrai au courant.

J'ai déjà noté la disparitio des fenêtres Pop, ce qui est déjà une bonne avancée.

Merci pour votre aide.

Salut, voir mon message suite à réponse de Green day.

Slts

Salut jlpjlp,

Mon intention n'était absolument de faire travailler 2 personnes en parallèle et encore de juger de la pertinence des réponses. Je n'ai pas les compétences nécessaires pour cela.
Tu remarqueras que les 2 discussions n'étaient pas vraiment en parallèle.

Dans tous les cas, j'ai été impressioné par le niveau des compétences et la clarté des réponses qui m'ont permis de résoudre mon problème.

Merci pour m'avoir permis de sauver mes données et d'éviter un formatage de ma machine.

Bonne continuation à tous. Je ne manquerai pas de faire connaître ce site.

Slts

re

on n'en doute pas ! mais ce n'est pas encore fini, on continue ici

Télécharge SDFix sur ton bureau

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.
Redémarre ton ordinateur en mode sans échec
Ouvre le dossier SDFix qui vient d'être créé sur le Bureau et double clique sur RunThis.bat pour lancer le script.
Appuie sur Y pour commencer le processus de nettoyage.
Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
Appuie sur une touche pour redémarrer le PC.
Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

++

Salut,

Est ce que je dois faire smitfraud fix avant car je n'ai pas fait cette partie pensant que mon pb était résolu.

Slts

oui, tu peux !

++

Salut,

Rapport smitfraud fix:

SmitFraudFix v2.296

Rapport fait à 22:28:01,62, 25/02/2008
Executé à partir de C:\Documents and Settings\Vincent\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001
C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

C:\WINDOWS\fsxloqf.exe PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\1024\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Vincent

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Vincent\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Vincent\Favoris

»»»»»»»»»»»»»»»»»»»»»»»» Bureau

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\eMedia Codec\ PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

[!] Suspicious: bdmanager.dll
SSODL: bdmanager - {A58D46CE-4F12-46E7-80D5-47414FD651E0}

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/1000 PL Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

ok, demarrer en mode sans echec et passe à l'option 2 !

++

Ci-dessous rapport suite à nettoyage. Dois je passer à SDFix?

SmitFraudFix v2.296

Rapport fait à 22:37:06,82, 25/02/2008
Executé à partir de C:\Documents and Settings\Vincent\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
C:\WINDOWS\bdmanager.dll deleted.

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\fsxloqf.exe supprimé
C:\WINDOWS\system32\1024\ supprimé
C:\Program Files\eMedia Codec\ supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3F196D94-7E5E-4C9C-8EEA-003C2255E536}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1

»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

Nettoyage terminé.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Fin

Ci-dessous rapports SDFix et Hijackthis:
Est ce que tout semble OK?

[b]SDFix: Version 1.147 [/b]

Run by Vincent on 25/02/2008 at 22:55

Microsoft Windows XP [version 5.1.2600]
Running From: C:\DOCUME~1\Vincent\Bureau\SDFAX\SDFix

[b]Checking Services [/b]:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat - Deleted
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 23:02:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"ScheduledInstallDate"="2008-02-25 22:00:00"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\IncrediMail\\bin\\IMApp.exe"="C:\\Program Files\\IncrediMail\\bin\\IMApp.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\IncMail.exe"="C:\\Program Files\\IncrediMail\\bin\\IncMail.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"="C:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe"="C:\\Program Files\\Fichiers communs\\McAfee\\MNA\\McNASvc.exe:*:Enabled:McAfee Network Agent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Wed 6 Dec 2006 276 A.SHR --- "C:\BOOT.BAK"
Fri 10 Mar 2006 56 A.SHR --- "C:\i386\CBD0CF85BC.sys"
Fri 10 Mar 2006 2,516 A.SH. --- "C:\i386\KGyGaAvL.sys"
Fri 12 Mar 2004 54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Fri 12 Mar 2004 156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Fri 12 Mar 2004 31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Thu 27 Apr 2006 88 ..SHR --- "C:\WINDOWS\system32\BC85CFD0CB.sys"
Thu 27 Apr 2006 104 ..SHR --- "C:\WINDOWS\system32\CBD0CF85BC.sys"
Thu 27 Apr 2006 5,852 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Thu 9 Mar 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 3 Jan 2008 71,168 ..SHR --- "C:\Program Files\Mio Technology\SpeedCAM Tool\Setup.exe"
Sat 9 Jul 2005 16,384 A.SHR --- "C:\Program Files\Mio Technology\SpeedCAM Tool\_Setup.dll"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT106.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT112.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT11B.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT124.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT12E.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT136.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT140.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT149.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT157.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT15F.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT168.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT174.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT17D.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT18C.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT19A.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT1A2.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT1AB.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT87.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BIT92.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITA3.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITB0.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITBC.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITC8.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITD4.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITE1.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITEC.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITF3.tmp"
Mon 25 Feb 2008 0 A..H. --- "C:\Documents and Settings\Val‚rie\Local Settings\temp\BITFD.tmp"

[b]Finished![/b]

Rapport Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:07:58, on 25/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Program Files\SiteAdvisor\6253\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\McAfee\MSK\MskAgent.exe
C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\DOCUME~1\Vincent\LOCALS~1\Temp\clclean.0001
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
C:\PROGRA~1\INCRED~1\bin\IMApp.exe
C:\PROGRA~1\INCRED~1\bin\IncMail.exe
C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://home.mcafee.com/StaticGenericPage.aspx?page=cookienotsupported&url=%2froot%2fcampaign.aspx%3fcid%3d16972%26culture%3dfr-FR%26ctst%3d1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [Creative WebCam Tray] C:\Program Files\Creative\Video Blaster WebCam Control\CAMTRAY.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe
O4 - HKLM\..\Run: [AliceSAV] C:\Program Files\TechCity Solutions\AliceSAV\AliceAgent.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: EPSON SMART PANEL for Scanner.lnk = C:\Program Files\EPSON\EPSON SMART PANEL for Scanner\ESPmain.exe
O4 - Global Startup: Lancement Application Fax.lnk = C:\Program Files\Alliance MCA\SafeFax\faxtray.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Fichiers communs\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\FICHIE~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Fichiers communs\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\fichiers communs\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\FICHIE~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Service SiteAdvisor (SiteAdvisor Service) - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe