TRojan TR/Crypt.ULPM.Gen, j'en peux plus !!!

Question

Bonjour,


Suite à une infection msn "ta tof sur ce site", j'ai exécuté msn fix qui m'a détecté et supprimé des fichiers infectés. 
J'ai ensuite installé antivir qui me détecte un trojan TR/Crypt.ULPM.Gen 
Comment faire pour m'en débarrasser ? 

Voici le rapport hijackthis : 

Logfile of Trend Micro HijackThis v2.0.2 
Scan saved at 18:38:06, on 15/03/2008 
Platform: Windows XP SP2 (WinNT 5.01.2600) 
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) 
Boot mode: Normal 

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\SYSTEM32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\Ati2evxx.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\SYSTEM32\Ati2evxx.exe 
C:\WINDOWS\Explorer.EXE 
C:\WINDOWS\system32\spoolsv.exe 
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe 
C:\windows\system\hpsysdrv.exe 
C:\WINDOWS\system32\hphmon06.exe 
C:\HP\KBD\KBD.EXE 
C:\WINDOWS\system32\keyhook.exe 
C:\WINDOWS\AGRSMMSG.exe 
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
C:\WINDOWS\ALCXMNTR.EXE 
C:\Program Files\QuickTime\QTTask.exe 
C:\WINDOWS\ZSSnp211.exe 
C:\WINDOWS\Domino.exe 
C:\Program Files\iTunes\iTunesHelper.exe 
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe 
C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe 
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 
C:\Program Files\Bonjour\mDNSResponder.exe 
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe 
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 
C:\Program Files\Securitoo\av_fw\fswsclds.exe 
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe 
C:\WINDOWS\system32\drivers\KodakCCS.exe 
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe 
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\system32\wscntfy.exe 
C:\Program Files\iPod\bin\iPodService.exe 
C:\WINDOWS\system32\HPZipm12.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\system32\wuauclt.exe 
C:\WINDOWS\17PHolmes1423.exe 
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe 
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe 
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe 
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe 
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe 
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe 
C:\Program Files\Internet Explorer\iexplore.exe 
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/ 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/ 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://actus.sfr.fr 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/ 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/ 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) 
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\dbsejb.exe 
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll 
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file) 
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) 
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll 
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe 
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe 
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe 
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe 
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE 
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE 
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe 
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe 
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe 
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe 
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE 
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe 
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe" 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime 
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u 
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe 
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe 
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe 
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" 
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized 
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1423.exe 61A847B5BBF7281336993B466188719AB689201522886B092CBD44BD8689220221DD3257 
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min 
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe 
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - Startup: Registration Brothers In Arms.LNK = F:\Support\Register\RegistrationReminder.exe 
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe 
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe 
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe 
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe 
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe 
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE 
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html 
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll 
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe 
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe 
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe 
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe 
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe 
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe 
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe 
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing) 
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe 
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe 
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe 
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe 
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Pacsptisvr.exe 
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe 
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe 

End of file - 9621 bytes 


D'avance merci !!

ep44 · Answer

Bonjour lulabiii,


je te donne un peu de travail ;-)

Télécharge sur le bureau
http://sosvirus.changelog.fr/MSNFix.zip
= Clic-Droit sur MSNFix.zip
= Extraire ici ( ou extraire sans confirmation ou tout ou unzip)
= Double-Clic sur le dossier MSNfix qui vient de se créer
= Double-Clic MSNfix ==> Symbole roue dentée
= Choisir R
= Choisir ensuite N ( si infection)
= Enregistre le rapport
redémarre le PC et relancer MSN tu sauras ainsi si tout est supprimé


ensuite 
Télécharge Combofix sUBs : http://download.bleepingcomputer.com/sUBs/Combo-Fix.exe
et sauvegarde le sur ton bureau et pas ailleurs!

Double-clic sur combofix,
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
@+

lulabiii · Answer

MSNFix 1.684  
 
C:\Documents and Settings\HP_Propri‚taire\Bureau\MSNFix 
Fix exécuté le 15/03/2008 - 19:49:46,50 By HP_Propri‚taire 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\WINDOWS\mrofinu*.exe 
... C:\WINDOWS\system32\real.txt 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\winlogon.exe 
.. OK ... C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\services.exe 
.. OK ... C:\WINDOWS\system32\fsiocu.exe 
.. OK ... C:\WINDOWS\system32\vbsxkh.exe 
.. OK ... C:\WINDOWS\system32\kxgelc.exe  
.. OK ... C:\WINDOWS\system32\brxdoy.exe 
.. OK ... C:\WINDOWS\mrofinu*.exe  
/!\ ...  C:\WINDOWS\system32\real.txt    
 
 
 
************************ Nettoyage du registre 
 
 
 
Les fichiers encore présents seront supprimés au prochain redémarrage 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\WINDOWS\system32\real.txt  
 
 
 
************************ Fichiers suspects 
 
Aucun Fichier trouvé 
 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 15032008_19552003.zip
 
************************ HKLM\...\Winlogon\Userinit 
 
Userinit = C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\dbsejb.exe 


------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   --------------------------------------------- 
 
voila deja le rapport msn fix qui m'a demandé de redémarrer avant de réanalyser...je poursuis avec combofix

lulabiii · Answer

il me dit que ta cersion de combofix n'est pas à jour et abandonne...je fais quoi ?
ou est-ce que je peux trouver une version à jour ?
merci d'avance

ep44 · Answer

tu continu l'exécution

lulabiii · Answer

alors voila j'ai éxécuté combofix ...ça a l'air de s'etre exécuté ...je t'envoie le rapport

ComboFix 08-03-14.4 - HP_Propriétaire 2008-03-15 20:26:09.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.55 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-15 to 2008-03-15 ))))))))))))))))))))))))))))))))))))
.

2008-03-15 19:53 . 2008-03-15 19:53 244 --ah----- C:\sqmnoopt02.sqm
2008-03-15 19:53 . 2008-03-15 19:53 232 --ah----- C:\sqmdata02.sqm
2008-03-15 19:39 . 2008-03-15 19:39 244 --ah----- C:\sqmnoopt01.sqm
2008-03-15 19:39 . 2008-03-15 19:39 232 --ah----- C:\sqmdata01.sqm
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Program Files\Avira
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-03-15 17:37 . 2008-03-15 17:37 37,376 --a------ C:\WINDOWS\mrofinu1423.MSNFix
2008-03-15 17:33 . 2008-03-15 17:33 244 --ah----- C:\sqmnoopt00.sqm
2008-03-15 17:33 . 2008-03-15 17:33 232 --ah----- C:\sqmdata00.sqm
2008-03-15 14:13 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-03-15 14:13 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\118294.78
2008-03-15 14:13 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-03-15 13:47 . 2008-03-15 13:47 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Grisoft
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-15 12:32 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-15 12:25 . 2008-03-15 12:25 <REP> d-------- C:\Program Files\Trend Micro
2008-03-15 12:04 . 2008-03-15 12:04 <REP> d-------- C:\Program Files\CCleaner
2008-03-15 11:14 . 2008-03-15 11:14 64,156 --a------ C:\WINDOWS\system32\dbsejb.exe
2008-03-07 09:22 . 2008-03-07 09:22 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\vlc
2008-03-07 09:11 . 2008-03-07 09:11 <REP> d-------- C:\Program Files\VideoLAN
2008-03-06 14:44 . 2008-03-14 22:01 <REP> d-------- C:\Program Files\eMule
2008-03-02 17:06 . 2008-03-02 17:06 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Steinberg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 15:39 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-15 15:38 --------- d-----w C:\Program Files\Yahoo!
2008-03-15 15:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 09:42 --------- d-----w C:\Program Files\Windows Live
2008-03-02 16:04 8,652 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2008-03-02 16:04 --------- d-----w C:\Program Files\Bonjour
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-28 15:15 --------- d-----w C:\Program Files\iTunes
2008-01-28 15:14 --------- d-----w C:\Program Files\iPod
2008-01-28 15:12 --------- d-----w C:\Program Files\QuickTime
2008-01-28 15:11 --------- d-----w C:\Program Files\Apple Software Update
2008-01-28 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-28 15:10 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-01-28 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-25 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-01-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-21 12:11 --------- d-----w C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM
2008-01-21 08:12 --------- d-----w C:\Program Files\Alwil Software
2007-03-08 22:12 67,304 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
2007-02-20 17:40 32,768 ----a-w C:\Documents and Settings\UserData\index.dat
2005-08-02 14:24 1,096,495 ----a-w C:\Documents and Settings\chloé.gosset\wrar330fr.exe
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-18 21:35 2,995,547 ----a-w C:\Documents and Settings\chloé.gosset\everesthome200.exe
2005-07-18 21:31 301,406 ----a-w C:\Documents and Settings\chloé.gosset\Siren_170.zip
2005-07-18 21:28 1,288,065 ----a-w C:\Documents and Settings\chloé.gosset\EClea2_0.zip
2005-07-15 13:46 2,819,737 ----a-w C:\Documents and Settings\chloé.gosset\[ PC GAME ] Super Mario World (pc)(win 98-Me-XP) Full(1).zip
2005-07-15 13:11 1,217,479 ----a-w C:\Program Files\Win Rar 3.42 + crack (français).zip
2005-06-15 18:05 2,560,240 ----a-w C:\Documents and Settings\chloé.gosset\spywareblastersetup34.exe
2005-05-21 16:30 123,712 ----a-w C:\Documents and Settings\chloé.gosset\Exp_djellabah.zip
2005-05-18 12:16 1,787,597 ----a-w C:\Documents and Settings\chloé.gosset\bitcomet.exe
2005-01-15 15:05 130 ----a-w C:\Documents and Settings\CHLOE\Application Data\wklnhst.dat
2004-12-08 09:07 439 ----a-w C:\Documents and Settings\Fichiers bureau\Enregistrement auprès de HP.zip
2004-11-19 08:01 3,927,880 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_freeware_4.4_anglais_13331.exe
2004-11-19 08:01 1,366,522 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_traduction_francaise_francais_13331.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe" [2004-01-02 00:55 159744]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-01 22:07 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 23:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-08 01:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-08 01:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-12 03:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-15 03:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 16:47 249856]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-25 03:10 339968]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 09:21 50176 C:\WINDOWS\ALCXMNTR.EXE]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 23:57 81920]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-12-18 06:31 118784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 17:49 50688]
"ZSSnp211"="C:\WINDOWS\ZSSnp211.exe" [2006-08-19 11:37 49152]
"Domino"="C:\WINDOWS\Domino.exe" [2006-08-18 16:58 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-15 17:54 249896]
"Flash Media"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-21 13:23:32 110592]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-04-28 11:00:07 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-29 12:31:38 241664]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Logiciel Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe [2005-03-10 09:40:30 757760]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\dbsejb.exe"=

R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2005-05-03 11:51]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
R3 ZSMC211;USB PC Camera (ZS0211);C:\WINDOWS\system32\Drivers\ZS211.sys [2006-10-18 09:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9bd40ff-774b-11db-acbf-00112f9f6d8f}]
\Shell\AutoRun\command - L:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5887066-35cb-11da-ac2e-4d6564696130}]
\Shell\AutoRun\command - K:\setupSNK.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-13 18:39:25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 20:32:12
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

? [1864]

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-15 20:35:30
ComboFix-quarantined-files.txt 2008-03-15 19:35:25
.
2008-03-13 02:03:49 --- E O F ---

ça veut dire quoi ?
merci

lulabiii · Answer

alors voila j'ai éxécuté combofix ...ça a l'air de s'etre exécuté ...je t'envoie le rapport

ComboFix 08-03-14.4 - HP_Propriétaire 2008-03-15 20:26:09.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.55 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-15 to 2008-03-15 ))))))))))))))))))))))))))))))))))))
.

2008-03-15 19:53 . 2008-03-15 19:53 244 --ah----- C:\sqmnoopt02.sqm
2008-03-15 19:53 . 2008-03-15 19:53 232 --ah----- C:\sqmdata02.sqm
2008-03-15 19:39 . 2008-03-15 19:39 244 --ah----- C:\sqmnoopt01.sqm
2008-03-15 19:39 . 2008-03-15 19:39 232 --ah----- C:\sqmdata01.sqm
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Program Files\Avira
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-03-15 17:37 . 2008-03-15 17:37 37,376 --a------ C:\WINDOWS\mrofinu1423.MSNFix
2008-03-15 17:33 . 2008-03-15 17:33 244 --ah----- C:\sqmnoopt00.sqm
2008-03-15 17:33 . 2008-03-15 17:33 232 --ah----- C:\sqmdata00.sqm
2008-03-15 14:13 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-03-15 14:13 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\118294.78
2008-03-15 14:13 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-03-15 13:47 . 2008-03-15 13:47 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Grisoft
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-15 12:32 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-15 12:25 . 2008-03-15 12:25 <REP> d-------- C:\Program Files\Trend Micro
2008-03-15 12:04 . 2008-03-15 12:04 <REP> d-------- C:\Program Files\CCleaner
2008-03-15 11:14 . 2008-03-15 11:14 64,156 --a------ C:\WINDOWS\system32\dbsejb.exe
2008-03-07 09:22 . 2008-03-07 09:22 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\vlc
2008-03-07 09:11 . 2008-03-07 09:11 <REP> d-------- C:\Program Files\VideoLAN
2008-03-06 14:44 . 2008-03-14 22:01 <REP> d-------- C:\Program Files\eMule
2008-03-02 17:06 . 2008-03-02 17:06 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Steinberg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 15:39 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-15 15:38 --------- d-----w C:\Program Files\Yahoo!
2008-03-15 15:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 09:42 --------- d-----w C:\Program Files\Windows Live
2008-03-02 16:04 8,652 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2008-03-02 16:04 --------- d-----w C:\Program Files\Bonjour
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-28 15:15 --------- d-----w C:\Program Files\iTunes
2008-01-28 15:14 --------- d-----w C:\Program Files\iPod
2008-01-28 15:12 --------- d-----w C:\Program Files\QuickTime
2008-01-28 15:11 --------- d-----w C:\Program Files\Apple Software Update
2008-01-28 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-28 15:10 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-01-28 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-25 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-01-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-21 12:11 --------- d-----w C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM
2008-01-21 08:12 --------- d-----w C:\Program Files\Alwil Software
2007-03-08 22:12 67,304 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
2007-02-20 17:40 32,768 ----a-w C:\Documents and Settings\UserData\index.dat
2005-08-02 14:24 1,096,495 ----a-w C:\Documents and Settings\chloé.gosset\wrar330fr.exe
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-18 21:35 2,995,547 ----a-w C:\Documents and Settings\chloé.gosset\everesthome200.exe
2005-07-18 21:31 301,406 ----a-w C:\Documents and Settings\chloé.gosset\Siren_170.zip
2005-07-18 21:28 1,288,065 ----a-w C:\Documents and Settings\chloé.gosset\EClea2_0.zip
2005-07-15 13:46 2,819,737 ----a-w C:\Documents and Settings\chloé.gosset\[ PC GAME ] Super Mario World (pc)(win 98-Me-XP) Full(1).zip
2005-07-15 13:11 1,217,479 ----a-w C:\Program Files\Win Rar 3.42 + crack (français).zip
2005-06-15 18:05 2,560,240 ----a-w C:\Documents and Settings\chloé.gosset\spywareblastersetup34.exe
2005-05-21 16:30 123,712 ----a-w C:\Documents and Settings\chloé.gosset\Exp_djellabah.zip
2005-05-18 12:16 1,787,597 ----a-w C:\Documents and Settings\chloé.gosset\bitcomet.exe
2005-01-15 15:05 130 ----a-w C:\Documents and Settings\CHLOE\Application Data\wklnhst.dat
2004-12-08 09:07 439 ----a-w C:\Documents and Settings\Fichiers bureau\Enregistrement auprès de HP.zip
2004-11-19 08:01 3,927,880 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_freeware_4.4_anglais_13331.exe
2004-11-19 08:01 1,366,522 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_traduction_francaise_francais_13331.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe" [2004-01-02 00:55 159744]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-01 22:07 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 23:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-08 01:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-08 01:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-12 03:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-15 03:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 16:47 249856]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-25 03:10 339968]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 09:21 50176 C:\WINDOWS\ALCXMNTR.EXE]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 23:57 81920]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-12-18 06:31 118784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 17:49 50688]
"ZSSnp211"="C:\WINDOWS\ZSSnp211.exe" [2006-08-19 11:37 49152]
"Domino"="C:\WINDOWS\Domino.exe" [2006-08-18 16:58 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-15 17:54 249896]
"Flash Media"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-21 13:23:32 110592]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-04-28 11:00:07 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-29 12:31:38 241664]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Logiciel Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe [2005-03-10 09:40:30 757760]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\dbsejb.exe"=

R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2005-05-03 11:51]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
R3 ZSMC211;USB PC Camera (ZS0211);C:\WINDOWS\system32\Drivers\ZS211.sys [2006-10-18 09:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9bd40ff-774b-11db-acbf-00112f9f6d8f}]
\Shell\AutoRun\command - L:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5887066-35cb-11da-ac2e-4d6564696130}]
\Shell\AutoRun\command - K:\setupSNK.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-13 18:39:25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 20:32:12
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

? [1864]

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-15 20:35:30
ComboFix-quarantined-files.txt 2008-03-15 19:35:25
.
2008-03-13 02:03:49 --- E O F ---

ça veut dire quoi ?
merci

ep44 · Answer

selectionne ceci

registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]



File::

C:\WINDOWS\mrofinu1423.MSNFix 
C:\WINDOWS\system32\real.MSNFix
C:\WINDOWS\system32\dbsejb.exe 


 


* Copie le texte sélectionné (CTRL+C).
* Ouvre le bloc-notes (programme>Accessoires >bloc-notes).
* Colle le texte copié dans ce bloc-notes (CTRL+V).
* Sauvegarde ce fichier sous le nom de CFScript.txt
* Fais un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe
* Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.
* Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal!
Ne touche à rien tant que le scan n'est pas terminé.
* Une fois le scan achevé, un rapport va s'afficher : Poste son contenu.
* Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt

afideg · Answer

Salut ep44

Effectivement, et pour ton info, les mises à jour de la version renommée de Combofix sUBs : http://download.bleepingcomputer.com/sUBs/Combo-Fix.exe 
ne sont pas assurées.

Bonne chance
Al.

ep44 · Answer

Bonsoir afideg,
merci ;-)
@+

lulabiii · Answer

Donc voici la suite des evennements :

ComboFix 08-03-14.4 - HP_Propriétaire 2008-03-15 21:43:42.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.40 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_PropriÚtaire\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-15 to 2008-03-15 ))))))))))))))))))))))))))))))))))))
.

2008-03-15 21:14 . 2008-03-15 21:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-15 21:14 . 2008-03-15 21:14 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-15 20:32 . 2008-03-15 20:32 244 --ah----- C:\sqmnoopt03.sqm
2008-03-15 20:32 . 2008-03-15 20:32 232 --ah----- C:\sqmdata03.sqm
2008-03-15 19:53 . 2008-03-15 19:53 244 --ah----- C:\sqmnoopt02.sqm
2008-03-15 19:53 . 2008-03-15 19:53 232 --ah----- C:\sqmdata02.sqm
2008-03-15 19:39 . 2008-03-15 19:39 244 --ah----- C:\sqmnoopt01.sqm
2008-03-15 19:39 . 2008-03-15 19:39 232 --ah----- C:\sqmdata01.sqm
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Program Files\Avira
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-03-15 17:37 . 2008-03-15 17:37 37,376 --a------ C:\WINDOWS\mrofinu1423.MSNFix
2008-03-15 17:33 . 2008-03-15 17:33 244 --ah----- C:\sqmnoopt00.sqm
2008-03-15 17:33 . 2008-03-15 17:33 232 --ah----- C:\sqmdata00.sqm
2008-03-15 14:13 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-03-15 14:13 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\118294.78
2008-03-15 14:13 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-03-15 13:47 . 2008-03-15 13:47 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Grisoft
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-15 12:32 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-15 12:25 . 2008-03-15 12:25 <REP> d-------- C:\Program Files\Trend Micro
2008-03-15 12:04 . 2008-03-15 12:04 <REP> d-------- C:\Program Files\CCleaner
2008-03-15 11:14 . 2008-03-15 11:14 64,156 --a------ C:\WINDOWS\system32\dbsejb.exe
2008-03-07 09:22 . 2008-03-07 09:22 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\vlc
2008-03-07 09:11 . 2008-03-07 09:11 <REP> d-------- C:\Program Files\VideoLAN
2008-03-06 14:44 . 2008-03-14 22:01 <REP> d-------- C:\Program Files\eMule
2008-03-02 17:06 . 2008-03-02 17:06 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Steinberg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 15:39 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-15 15:38 --------- d-----w C:\Program Files\Yahoo!
2008-03-15 15:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 09:42 --------- d-----w C:\Program Files\Windows Live
2008-03-02 16:04 8,652 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2008-03-02 16:04 --------- d-----w C:\Program Files\Bonjour
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-28 15:15 --------- d-----w C:\Program Files\iTunes
2008-01-28 15:14 --------- d-----w C:\Program Files\iPod
2008-01-28 15:12 --------- d-----w C:\Program Files\QuickTime
2008-01-28 15:11 --------- d-----w C:\Program Files\Apple Software Update
2008-01-28 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-28 15:10 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-01-28 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-25 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-01-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-21 12:11 --------- d-----w C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM
2008-01-21 08:12 --------- d-----w C:\Program Files\Alwil Software
2007-03-08 22:12 67,304 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
2007-02-20 17:40 32,768 ----a-w C:\Documents and Settings\UserData\index.dat
2005-08-02 14:24 1,096,495 ----a-w C:\Documents and Settings\chloé.gosset\wrar330fr.exe
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-18 21:35 2,995,547 ----a-w C:\Documents and Settings\chloé.gosset\everesthome200.exe
2005-07-18 21:31 301,406 ----a-w C:\Documents and Settings\chloé.gosset\Siren_170.zip
2005-07-18 21:28 1,288,065 ----a-w C:\Documents and Settings\chloé.gosset\EClea2_0.zip
2005-07-15 13:46 2,819,737 ----a-w C:\Documents and Settings\chloé.gosset\[ PC GAME ] Super Mario World (pc)(win 98-Me-XP) Full(1).zip
2005-07-15 13:11 1,217,479 ----a-w C:\Program Files\Win Rar 3.42 + crack (français).zip
2005-06-15 18:05 2,560,240 ----a-w C:\Documents and Settings\chloé.gosset\spywareblastersetup34.exe
2005-05-21 16:30 123,712 ----a-w C:\Documents and Settings\chloé.gosset\Exp_djellabah.zip
2005-05-18 12:16 1,787,597 ----a-w C:\Documents and Settings\chloé.gosset\bitcomet.exe
2005-01-15 15:05 130 ----a-w C:\Documents and Settings\CHLOE\Application Data\wklnhst.dat
2004-12-08 09:07 439 ----a-w C:\Documents and Settings\Fichiers bureau\Enregistrement auprès de HP.zip
2004-11-19 08:01 3,927,880 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_freeware_4.4_anglais_13331.exe
2004-11-19 08:01 1,366,522 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_traduction_francaise_francais_13331.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-15_20.34.59.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-15 18:53:13 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-03-15 20:49:52 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-15 18:53:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-03-15 20:49:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-03-15 18:53:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-15 20:49:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-15 20:49:46 9,296 ----a-w C:\WINDOWS\system32\qxminr.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe" [2004-01-02 00:55 159744]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-01 22:07 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 23:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-08 01:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-08 01:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-12 03:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-15 03:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 16:47 249856]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-25 03:10 339968]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 09:21 50176 C:\WINDOWS\ALCXMNTR.EXE]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 23:57 81920]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-12-18 06:31 118784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 17:49 50688]
"ZSSnp211"="C:\WINDOWS\ZSSnp211.exe" [2006-08-19 11:37 49152]
"Domino"="C:\WINDOWS\Domino.exe" [2006-08-18 16:58 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-15 17:54 249896]
"Flash Media"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-21 13:23:32 110592]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-04-28 11:00:07 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-29 12:31:38 241664]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Logiciel Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe [2005-03-10 09:40:30 757760]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\dbsejb.exe"=

R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2005-05-03 11:51]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
R3 ZSMC211;USB PC Camera (ZS0211);C:\WINDOWS\system32\Drivers\ZS211.sys [2006-10-18 09:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9bd40ff-774b-11db-acbf-00112f9f6d8f}]
\Shell\AutoRun\command - L:\setupSNK.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f5887066-35cb-11da-ac2e-4d6564696130}]
\Shell\AutoRun\command - K:\setupSNK.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-03-13 18:39:25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 21:49:44
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

? [1864]

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-15 21:53:40
ComboFix-quarantined-files.txt 2008-03-15 20:53:33
ComboFix2.txt 2008-03-15 19:35:31
.
2008-03-13 02:03:49 --- E O F ---

Y a t il un peu d'amélioration ?
Merci ep44 de t'attarder sur mon sort...c'est sympa !

ep44 · Answer

tu n'as pas du faire labonne manip 
as tu bien fait glisser le fichier CFScript.txt  sur l'icone de combofix

lulabiii · Answer

ComboFix 08-03-14.4 - HP_Propriétaire 2008-03-15 22:37:04.4 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.40 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_PropriÚtaire\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-15 to 2008-03-15 ))))))))))))))))))))))))))))))))))))
.

2008-03-15 22:42 . 2008-03-15 22:42 9,296 --a------ C:\WINDOWS\system32\azqcmr.exe
2008-03-15 21:50 . 2008-03-15 21:50 244 --ah----- C:\sqmnoopt04.sqm
2008-03-15 21:50 . 2008-03-15 21:50 232 --ah----- C:\sqmdata04.sqm
2008-03-15 21:14 . 2008-03-15 21:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-15 21:14 . 2008-03-15 21:14 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-15 20:32 . 2008-03-15 20:32 244 --ah----- C:\sqmnoopt03.sqm
2008-03-15 20:32 . 2008-03-15 20:32 232 --ah----- C:\sqmdata03.sqm
2008-03-15 19:53 . 2008-03-15 19:53 244 --ah----- C:\sqmnoopt02.sqm
2008-03-15 19:53 . 2008-03-15 19:53 232 --ah----- C:\sqmdata02.sqm
2008-03-15 19:39 . 2008-03-15 19:39 244 --ah----- C:\sqmnoopt01.sqm
2008-03-15 19:39 . 2008-03-15 19:39 232 --ah----- C:\sqmdata01.sqm
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Program Files\Avira
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-03-15 17:37 . 2008-03-15 17:37 37,376 --a------ C:\WINDOWS\mrofinu1423.MSNFix
2008-03-15 17:33 . 2008-03-15 17:33 244 --ah----- C:\sqmnoopt00.sqm
2008-03-15 17:33 . 2008-03-15 17:33 232 --ah----- C:\sqmdata00.sqm
2008-03-15 14:13 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-03-15 14:13 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\118294.78
2008-03-15 14:13 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-03-15 13:47 . 2008-03-15 13:47 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Grisoft
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-15 12:32 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-15 12:25 . 2008-03-15 12:25 <REP> d-------- C:\Program Files\Trend Micro
2008-03-15 12:04 . 2008-03-15 12:04 <REP> d-------- C:\Program Files\CCleaner
2008-03-15 11:14 . 2008-03-15 11:14 64,156 --a------ C:\WINDOWS\system32\dbsejb.exe
2008-03-07 09:22 . 2008-03-07 09:22 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\vlc
2008-03-07 09:11 . 2008-03-07 09:11 <REP> d-------- C:\Program Files\VideoLAN
2008-03-06 14:44 . 2008-03-14 22:01 <REP> d-------- C:\Program Files\eMule
2008-03-02 17:06 . 2008-03-02 17:06 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Steinberg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 15:39 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-15 15:38 --------- d-----w C:\Program Files\Yahoo!
2008-03-15 15:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 09:42 --------- d-----w C:\Program Files\Windows Live
2008-03-02 16:04 8,652 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2008-03-02 16:04 --------- d-----w C:\Program Files\Bonjour
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-28 15:15 --------- d-----w C:\Program Files\iTunes
2008-01-28 15:14 --------- d-----w C:\Program Files\iPod
2008-01-28 15:12 --------- d-----w C:\Program Files\QuickTime
2008-01-28 15:11 --------- d-----w C:\Program Files\Apple Software Update
2008-01-28 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-28 15:10 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-01-28 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-25 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-01-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-21 12:11 --------- d-----w C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM
2008-01-21 08:12 --------- d-----w C:\Program Files\Alwil Software
2007-03-08 22:12 67,304 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
2007-02-20 17:40 32,768 ----a-w C:\Documents and Settings\UserData\index.dat
2005-08-02 14:24 1,096,495 ----a-w C:\Documents and Settings\chloé.gosset\wrar330fr.exe
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-18 21:35 2,995,547 ----a-w C:\Documents and Settings\chloé.gosset\everesthome200.exe
2005-07-18 21:31 301,406 ----a-w C:\Documents and Settings\chloé.gosset\Siren_170.zip
2005-07-18 21:28 1,288,065 ----a-w C:\Documents and Settings\chloé.gosset\EClea2_0.zip
2005-07-15 13:46 2,819,737 ----a-w C:\Documents and Settings\chloé.gosset\[ PC GAME ] Super Mario World (pc)(win 98-Me-XP) Full(1).zip
2005-07-15 13:11 1,217,479 ----a-w C:\Program Files\Win Rar 3.42 + crack (français).zip
2005-06-15 18:05 2,560,240 ----a-w C:\Documents and Settings\chloé.gosset\spywareblastersetup34.exe
2005-05-21 16:30 123,712 ----a-w C:\Documents and Settings\chloé.gosset\Exp_djellabah.zip
2005-05-18 12:16 1,787,597 ----a-w C:\Documents and Settings\chloé.gosset\bitcomet.exe
2005-01-15 15:05 130 ----a-w C:\Documents and Settings\CHLOE\Application Data\wklnhst.dat
2004-12-08 09:07 439 ----a-w C:\Documents and Settings\Fichiers bureau\Enregistrement auprès de HP.zip
2004-11-19 08:01 3,927,880 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_freeware_4.4_anglais_13331.exe
2004-11-19 08:01 1,366,522 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_traduction_francaise_francais_13331.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-15_20.34.59.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-15 18:53:13 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-03-15 21:43:12 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-15 18:53:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-03-15 21:43:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-03-15 18:53:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-15 21:43:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe" [2004-01-02 00:55 159744]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-01 22:07 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 23:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-08 01:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-08 01:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-12 03:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-15 03:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 16:47 249856]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-25 03:10 339968]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 09:21 50176 C:\WINDOWS\ALCXMNTR.EXE]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 23:57 81920]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-12-18 06:31 118784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 17:49 50688]
"ZSSnp211"="C:\WINDOWS\ZSSnp211.exe" [2006-08-19 11:37 49152]
"Domino"="C:\WINDOWS\Domino.exe" [2006-08-18 16:58 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-15 17:54 249896]
"Flash Media"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-21 13:23:32 110592]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-04-28 11:00:07 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-29 12:31:38 241664]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Logiciel Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe [2005-03-10 09:40:30 757760]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\dbsejb.exe"=

R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2005-05-03 11:51]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
R3 ZSMC211;USB PC Camera (ZS0211);C:\WINDOWS\system32\Drivers\ZS211.sys [2006-10-18 09:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9bd40ff-774b-11db-acbf-00112f9f6d8f}]
\Shell\AutoRun\command - L:\setupSNK.exe

Esque j'ai fait la bonne manip ?

lulabiii · Answer

ComboFix 08-03-14.4 - HP_Propriétaire 2008-03-15 22:37:04.4 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.40 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_PropriÚtaire\Bureau\CFScript.txt
* Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-15 to 2008-03-15 ))))))))))))))))))))))))))))))))))))
.

2008-03-15 22:42 . 2008-03-15 22:42 9,296 --a------ C:\WINDOWS\system32\azqcmr.exe
2008-03-15 21:50 . 2008-03-15 21:50 244 --ah----- C:\sqmnoopt04.sqm
2008-03-15 21:50 . 2008-03-15 21:50 232 --ah----- C:\sqmdata04.sqm
2008-03-15 21:14 . 2008-03-15 21:14 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-15 21:14 . 2008-03-15 21:14 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-15 20:32 . 2008-03-15 20:32 244 --ah----- C:\sqmnoopt03.sqm
2008-03-15 20:32 . 2008-03-15 20:32 232 --ah----- C:\sqmdata03.sqm
2008-03-15 19:53 . 2008-03-15 19:53 244 --ah----- C:\sqmnoopt02.sqm
2008-03-15 19:53 . 2008-03-15 19:53 232 --ah----- C:\sqmdata02.sqm
2008-03-15 19:39 . 2008-03-15 19:39 244 --ah----- C:\sqmnoopt01.sqm
2008-03-15 19:39 . 2008-03-15 19:39 232 --ah----- C:\sqmdata01.sqm
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Program Files\Avira
2008-03-15 17:51 . 2008-03-15 17:51 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-03-15 17:37 . 2008-03-15 17:37 37,376 --a------ C:\WINDOWS\mrofinu1423.MSNFix
2008-03-15 17:33 . 2008-03-15 17:33 244 --ah----- C:\sqmnoopt00.sqm
2008-03-15 17:33 . 2008-03-15 17:33 232 --ah----- C:\sqmdata00.sqm
2008-03-15 14:13 . 1996-08-20 20:37 15,840 --a------ C:\WINDOWS\system32\Machnm1.exe
2008-03-15 14:13 . 2005-09-25 16:37 5,632 --a------ C:\WINDOWS\system32\Machnm64.sys
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\system32\118290.54
2008-03-15 14:13 . 2008-03-15 14:13 3,120 --a------ C:\WINDOWS\118294.78
2008-03-15 14:13 . 2003-08-13 00:27 2,304 --a------ C:\WINDOWS\system32\Machnm32.sys
2008-03-15 13:47 . 2008-03-15 13:47 0 --a------ C:\WINDOWS\system32\real.MSNFix
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Grisoft
2008-03-15 12:32 . 2008-03-15 12:32 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-15 12:32 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-15 12:25 . 2008-03-15 12:25 <REP> d-------- C:\Program Files\Trend Micro
2008-03-15 12:04 . 2008-03-15 12:04 <REP> d-------- C:\Program Files\CCleaner
2008-03-15 11:14 . 2008-03-15 11:14 64,156 --a------ C:\WINDOWS\system32\dbsejb.exe
2008-03-07 09:22 . 2008-03-07 09:22 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\vlc
2008-03-07 09:11 . 2008-03-07 09:11 <REP> d-------- C:\Program Files\VideoLAN
2008-03-06 14:44 . 2008-03-14 22:01 <REP> d-------- C:\Program Files\eMule
2008-03-02 17:06 . 2008-03-02 17:06 <REP> d-------- C:\Documents and Settings\HP_Propriétaire\Application Data\Steinberg

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 15:39 --------- d-----w C:\Program Files\Windows Live Toolbar
2008-03-15 15:38 --------- d-----w C:\Program Files\Yahoo!
2008-03-15 15:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-03 09:42 --------- d-----w C:\Program Files\Windows Live
2008-03-02 16:04 8,652 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2008-03-02 16:04 --------- d-----w C:\Program Files\Bonjour
2008-02-01 10:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-28 15:15 --------- d-----w C:\Program Files\iTunes
2008-01-28 15:14 --------- d-----w C:\Program Files\iPod
2008-01-28 15:12 --------- d-----w C:\Program Files\QuickTime
2008-01-28 15:11 --------- d-----w C:\Program Files\Apple Software Update
2008-01-28 15:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-28 15:10 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-01-28 15:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-25 20:15 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-01-25 20:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-21 12:11 --------- d-----w C:\Documents and Settings\HP_Propriétaire\Application Data\AdobeUM
2008-01-21 08:12 --------- d-----w C:\Program Files\Alwil Software
2007-03-08 22:12 67,304 ----a-w C:\Documents and Settings\HP_Propriétaire\Application Data\GDIPFONTCACHEV1.DAT
2007-02-20 17:40 32,768 ----a-w C:\Documents and Settings\UserData\index.dat
2005-08-02 14:24 1,096,495 ----a-w C:\Documents and Settings\chloé.gosset\wrar330fr.exe
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-21 13:05 25,814 ----a-w C:\Documents and Settings\HP_Propriétaire\TB2Categories000.dat
2005-07-18 21:35 2,995,547 ----a-w C:\Documents and Settings\chloé.gosset\everesthome200.exe
2005-07-18 21:31 301,406 ----a-w C:\Documents and Settings\chloé.gosset\Siren_170.zip
2005-07-18 21:28 1,288,065 ----a-w C:\Documents and Settings\chloé.gosset\EClea2_0.zip
2005-07-15 13:46 2,819,737 ----a-w C:\Documents and Settings\chloé.gosset\[ PC GAME ] Super Mario World (pc)(win 98-Me-XP) Full(1).zip
2005-07-15 13:11 1,217,479 ----a-w C:\Program Files\Win Rar 3.42 + crack (français).zip
2005-06-15 18:05 2,560,240 ----a-w C:\Documents and Settings\chloé.gosset\spywareblastersetup34.exe
2005-05-21 16:30 123,712 ----a-w C:\Documents and Settings\chloé.gosset\Exp_djellabah.zip
2005-05-18 12:16 1,787,597 ----a-w C:\Documents and Settings\chloé.gosset\bitcomet.exe
2005-01-15 15:05 130 ----a-w C:\Documents and Settings\CHLOE\Application Data\wklnhst.dat
2004-12-08 09:07 439 ----a-w C:\Documents and Settings\Fichiers bureau\Enregistrement auprès de HP.zip
2004-11-19 08:01 3,927,880 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_freeware_4.4_anglais_13331.exe
2004-11-19 08:01 1,366,522 ----a-w C:\Documents and Settings\cam2pc\cam2pc_cam2pc_traduction_francaise_francais_13331.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-15_20.34.59.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-15 18:53:13 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-03-15 21:43:12 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-03-15 18:53:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
+ 2008-03-15 21:43:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
- 2008-03-15 18:53:13 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-03-15 21:43:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{549B5CA7-4A86-11D7-A4DF-000874180BB3}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Acme.PCHButton"="C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe" [2004-01-02 00:55 159744]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-01 22:07 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 23:04 52736]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-08 01:53 49152]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-08 01:43 659456]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-12 03:02 61440]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-15 03:43 233472]
"VTTimer"="VTTimer.exe" []
"SiS Windows KeyHook"="C:\WINDOWS\system32\keyhook.exe" [2004-05-20 16:47 249856]
"AGRSMMSG"="AGRSMMSG.exe" [2005-03-04 11:01 88209 C:\WINDOWS\AGRSMMSG.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-25 03:10 339968]
"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-04 09:21 50176 C:\WINDOWS\ALCXMNTR.EXE]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2002-10-16 23:57 81920]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-12-18 06:31 118784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"Microsoft Works Update Detection"="C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-10 17:49 50688]
"ZSSnp211"="C:\WINDOWS\ZSSnp211.exe" [2006-08-19 11:37 49152]
"Domino"="C:\WINDOWS\Domino.exe" [2006-08-18 16:58 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-03-15 17:54 249896]
"Flash Media"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-21 13:23:32 110592]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2005-04-28 11:00:07 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-29 12:31:38 241664]
Kodak software updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Logiciel Kodak EasyShare.lnk - C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe [2005-03-10 09:40:30 757760]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 09:15:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\dbsejb.exe"=

R2 Fswsclds;F-Secure Windows Security Center Legacy Detection Service;C:\Program Files\Securitoo\av_fw\fswsclds.exe [2005-05-03 11:51]
R3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 21:58]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
R3 ZSMC211;USB PC Camera (ZS0211);C:\WINDOWS\system32\Drivers\ZS211.sys [2006-10-18 09:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9bd40ff-774b-11db-acbf-00112f9f6d8f}]
\Shell\AutoRun\command - L:\setupSNK.exe

Esque j'ai fait la bonne manip ?

lulabiii · Answer

J'ai pas l'impression que ce rapport soit différent des autres...en meme temps, je n'ai pas eu à taper 1 ou 2 (pour "continue ou abort") donc je ne suis pas du tout sure de mon coup...j'ai pourtant bien fait glisser le fichier ce qui a fait démarrer Combofix...

ep44 · Answer

Non pas de différence 

on fait autrement 


relance hijack et coche ceci

Télécharge OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
clic double sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :
Paste List of Files/Folders to be moved.

C:\WINDOWS\mrofinu1423.MSNFix
C:\WINDOWS\system32eal.MSNFix
C:\WINDOWS\system32\dbsejb.exe 


clique sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.
clique sur Exit pour fermer.
poste le rapport situé dans C:\\_OTMoveIt\MovedFiles.

il te sera peut-être demandé de redémarrer le pc pour achever la suppression. 

ensuite refais hijack 
@+

lulabiii · Answer

bonjour !

désolée, épuisée par une journée entière de bataille acharnée contre ce trojan, je suis allée me coucher !!
me revoila donc, plus décidée que jamais à le zigouiller !!!
par contre j'ai relancé avg anti spyware qui apparament me trouve encore plus de dossiers infectés :-(

est-ce-que je dois reposter un rapport hijack ?
ou juste faire les manips qui m'ont été conseillées hier ?

d'avance merci

lulabiii · Answer

ep44, tu n'es pas la aujourd'hui ?

y a t il quelqu'un d'autre pour m'aider ?

helllllllllp !

suis vraiment embetée, trop besoin de mon pc et de msn (ma fille de 3 ans parle avec son papa tous les jours via webcam!)

lulabiii · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:45:07, on 16/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\ZSSnp211.exe
C:\WINDOWS\Domino.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Securitoo\av_fw\fswsclds.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\dbsejb.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Registration Brothers In Arms.LNK = F:\Support\Register\RegistrationReminder.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe

ep44 · Answer

Bonjour 

il faut le rapport de OTMoveIt
@+

lulabiii · Answer

Bonjour ep44 !!!

Contente de te revoir !!
Je commençais à desespérer !!!

voici le rapport OTMoveIt

C:\WINDOWS\mrofinu1423.MSNFix moved successfully.
C:\WINDOWS\system32\real.MSNFix moved successfully.
File move failed. C:\WINDOWS\system32\dbsejb.exe scheduled to be moved on reboot.
File/Folder  not found.
 
OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03162008_135051

Est-ce que c''est ça ?

ep44 · Answer

pas de soucis toujours présent 
mais pas toujours dispo ;-))

bon il y a celui-ci dbsejb.exe

pour vérif 

Télécharge OAD  http://sosvirus.changelog.fr/OAD.exe
- Enregistre le sur ton bureau


Double clique sur le OAD pour le lancer

- nom de fichier à rechercher tape ou fais un copier coller de :  dbsejb.exe
- Type de recherche : sélectionne l'option 6 puis valide [entree]

OAD va maintenant rechercher le fichier. Laisse le travailler jusqu'à ce qu'il en ai terminé.
Le rapport de recherche s'affichera automatiquement à dès qu'il en aura terminé.

- Fais un copier / coller de ce rapport dans ton prochain post.

lulabiii · Answer

C:\WINDOWS\mrofinu1423.MSNFix moved successfully.
C:\WINDOWS\system32\real.MSNFix moved successfully.
File move failed. C:\WINDOWS\system32\dbsejb.exe scheduled to be moved on reboot.
File/Folder  not found.
 
OTMoveIt2 by OldTimer - Version 1.0.21 log created on 03162008_135051


Contente de te revoir ep44 !!!

lulabiii · Answer

oups j'avais pas vu la page 2 et je croyais que je ne te l'avais pas posté dsée !!! ce trojan me rend chèvre ;-)

lulabiii · Answer

----------------------------------
§§§§§§ [dbsejb.exe ] §§§§§§
----------------------------------
[X] Registre
 
-------------- [  ] rapide
-- Fichier --- [  ] disque systeme
 ------------- [X] complete


********************
     [Registre] 
********************

Aucune entrée détectée

*******************
     [Fichier] 
*******************



Alors, il a l'air coriace non ?
ou alors il est parti ?
antivir me détecte 3 fois le trojan au redémarrage :(

ep44 · Answer

très bien maintenant  fait un scan en ligne

avec bitdefender et colle le rapport

https://www.bitdefender.com/toolbox/

un tuto
http://pageperso.aol.fr/rginformatique/mapage/defender.htm
ensuite refais un rapport hijack 
@+

lulabiii · Answer

BitDefender Online Scanner - Real Time Virus Report
  
  
 
Generated at: Sun, Mar 16, 2008 - 20:27:30
 

--------------------------------------------------------------------------------

 
  
  
 
Scan Info
  
  
 
Scanned Files
 283160
 
Infected Files
 1
 
  
  
 
 
  
  
 
Virus Detected
  
  
 
Adware.Gator.C
 1
 
  
  
 
 
  
  
 
 

--------------------------------------------------------------------------------
  
  
 
This summary of the scan process will be used by the BitDefender Antivirus Lab to create agregate statistics about virus activity around the world. 
  
 
voici le rapport bitdefender....j'éxécute le tuto...(je ne sais pas ce que c'est :))

ep44 · Answer

ton rapport n'est pas complet

lulabiii · Answer

ok le tuto c'était pour bit defender !!!!
j'ai appris ce que c'était qu'un tuto !!!

lulabiii · Answer

BitDefender Online Scanner
  
  
 
Scan report generated at: Sun, Mar 16, 2008 - 20:18:12
 
 
  
  
 
Scan path: C:\;D:\;E:\;F:\;G:\;H:\;I:\;J:\;
  
  
 
 
  
  
 
Statistics
 
Time
 01:35:06
 
Files
 275981
 
Folders
 7130
 
Boot Sectors
 5
 
Archives
 14717
 
Packed Files
 20914
 
  
  
 
Results
 
Identified Viruses 
 1
 
Infected Files 
 1
 
Suspect Files 
 0
 
Warnings
 0
 
Disinfected
 0
 
Deleted Files
 1
 
  
  
 
Engines Info
 
Virus Definitions
 1001077
 
Engine build
 AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)
 
Scan plugins
 16
 
Archive plugins
 41
 
Unpack plugins
 7
 
E-mail plugins
 6
 
System plugins
 5
 
  
  
 
Scan Settings
 
First Action
 Disinfect
 
Second Action
 Delete
 
Heuristics
 Yes
 
Enable Warnings
 Yes
 
Scanned Extensions
 *;
 
Exclude Extensions
  
 
Scan Emails
 Yes
 
Scan Archives
 Yes
 
Scan Packed
 Yes
 
Scan Files
 Yes
 
Scan Boot
 Yes
 
  
  
 
  Scanned File
  Status
 
C:\Program Files\K-Lite Codec Pack\fixdivx.exe=>(7z o)=>fixdivx-1.bin=>(Inno Module 0)
 Detected with: Adware.Gator.C
 
C:\Program Files\K-Lite Codec Pack\fixdivx.exe=>(7z o)=>fixdivx-1.bin=>(Inno Module 0)
 Deleted
 
C:\Program Files\K-Lite Codec Pack\fixdivx.exe=>(7z o)=>fixdivx-1.bin
 Update failed
 
  
 
 
  
  
 
 
  
  
 

 
je crois que c'est ça ?

ep44 · Answer

ok refais un hijack pour verif stp

lulabiii · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:03:24, on 16/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\ZSSnp211.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Securitoo\av_fw\fswsclds.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
F:\Driver\211_ov7648_R1_070508\Setup.exe
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\pft8.tmp\Disk1\setup.exe
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\pft8.tmp\Disk1\setup.exe
C:\Program Files\Vimicro\ZS211\Driver AutoInstall\Action Files\AfterCopy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\dbsejb.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Registration Brothers In Arms.LNK = F:\Support\Register\RegistrationReminder.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe

ep44 · Answer

relance hijack et coche ceci 
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
	O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
	O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
	O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
ensuite clic sur fix checked 

dit moi ensuite si tu as encore des soucis 
@+

lulabiii · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:22:02, on 16/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\keyhook.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\QuickTime\QTTask.exe
C:\WINDOWS\ZSSnp211.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Securitoo\av_fw\fswsclds.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
F:\Driver\211_ov7648_R1_070508\Setup.exe
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\pft8.tmp\Disk1\setup.exe
C:\DOCUME~1\HP_PRO~1\LOCALS~1\Temp\pft8.tmp\Disk1\setup.exe
C:\Program Files\Vimicro\ZS211\Driver AutoInstall\Action Files\AfterCopy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=FR_FR&c=Q404&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr?cobrand=hp-desktop.msn.com&ocid=HPDHP&pc=HPDTDF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\dbsejb.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O3 - Toolbar: Vue HP - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [SiS Windows KeyHook] C:\WINDOWS\system32\keyhook.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Fichiers communs\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ZSSnp211] C:\WINDOWS\ZSSnp211.exe
O4 - HKLM\..\Run: [Domino] C:\WINDOWS\Domino.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [Acme.PCHButton] C:\PROGRA~1\HELPAN~1\Pavilion\XPHWWBF4\plugin\bin\pchbutton.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: Registration Brothers In Arms.LNK = F:\Support\Register\RegistrationReminder.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Logiciel Kodak EasyShare.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin
pjpi142_03.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: F-Secure Windows Security Center Legacy Detection Service (Fswsclds) - F-Secure Corporation - C:\Program Files\Securitoo\av_fw\fswsclds.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: MD Simple Burner Service (NetMDSB) - Sony Corporation - C:\Program Files\Sony\MD Simple Burner\NetMDSB.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Pacsptisvr.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\Sptisrv.exe

ep44 · Answer

apparemment oui 
as tu encore des soucis ?

lulabiii · Answer

de plus...pour etre tranquille..???? J'ai comme logiciels de protection Antivir et AVG anti-spyware..
Ai-je besoin de'autres logiciels pour me prémunir ?
puis-je effacer les fichiers que Antivir m'a mis en quarantaine ?

à savoir : 

C:windows\system32\qxminr.exe
C:systemVolumenformation\restore{86E11626-S203-4B6B-99A3-889F6E4C5699}\RP709\A0119756.exe
                                                                                                                                  9755.exe
                                                                                                                                  8915.exe
                                                                                                                                  8914.exe
C:DocumentsandSettings\HP_Propriétaire\Bureau\MSNFix\15032008_17134770.zip
C:DocumentsandSettings\HP_Propriétaire\qbttar.exe
C:WINDOWS\mrofinu1423.exe

Merci d'avance !

lulabiii · Answer

Mon ordi rame deja beaucoup moins !! cool !!!
Donc, est-ce que je peux supprimer ces fichiers ?
Quand j'ai voulu redémarrer, j'ai eu un msg d'erreur me demandant d'insérer un disque dans le lecteur F: et fin du programme SHOULDN'T SEE ME est-ce normal ?
Est-ce encore ce virus ?
Merciiiiii

ep44 · Answer

Tu peux supprimer tous les logiciels que nous avons utilisés
va dans ajout/suppression de programes et dans programmes files
pour vérifier



ensuite fait ceci (IMPORTANT)

=démarrer
=panneau de configuration
=système
=onglet Restauration système
=coche la case (Désactiver la restauration système)
=redémarre l'ordinateur
=réactive la ensuite


et pour ton  message je ne sait pas trop 
as tu fait une manip avec un cd avant ??
rien de grave je pense 

@+

lulabiii · Answer

oui j'avais réinstallé le driver de ma webcam...c'est peut etre du à ça ...
j'ai éxécuté la manip que tu m'as conseillé...pas de souci
sinon crois-tu que je puisse supprmer mes fichiers en quarantaine ?

Merci

ep44 · Answer

Bonjour 

oui tu peux 

bonne continuation 

bye ;-)

TRojan TR/Crypt.ULPM.Gen, j'en peux plus !!!

39 réponses

Discussions similaires

Newsletters