AU SECOURS!!VIRTUMONDE.DLL

marie-douce12 Messages postés 100 Date d'inscription Statut Membre -
sKe69 Messages postés 21955 Statut Contributeur sécurité - 11 avr. 2008 à 21:14

Bonjour,
depuis 2 jours que je tentes par tous les moyens de me débarasser de ca jai scanné avec avg virus+spyware,ya rien qui marche!!!:(spybot le détecte encore je ne sais plus quoi faire!voici un rapport hijack this:Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:54:54, on 2008-04-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
C:\WINDOWS\system32\V0230Mon.exe
C:\Program Files\Creative\Shared Files\CTSched.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\H.exe
C:\PROGRA~1\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://get2.adobe.com/reader/otherversions/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12BA2B80-C8BA-49B0-BCB0-830A7D3A9155} - C:\WINDOWS\system32\geede.dll
O2 - BHO: (no name) - {163CAA89-EEA9-43AD-91FE-10AA407A2E84} - (no file)
O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
O2 - BHO: (no name) - {3CD09E5C-5DCF-4BE6-BE4F-BB9405310D29} - (no file)
O2 - BHO: {a2e4c6c2-aa0b-c1c9-ad84-915ce2d42645} - {54624d2e-c519-48da-9c1c-b0aa2c6c4e2a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B6D8F2BD-8C5B-4A91-A889-2983736B1D7F} - (no file)
O2 - BHO: (no name) - {B716CC00-43D4-4ED3-AF69-B00BBD8ACC16} - (no file)
O2 - BHO: (no name) - {D318119E-CB62-4039-AE9B-CF9575BCAA7F} - (no file)
O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\system32\V0230Mon.exe
O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [BM9f5cab75] Rundll32.exe "C:\WINDOWS\system32\ggwjflpy.dll",s
O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
O20 - Winlogon Notify: yayvvsr - yayvvsr.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

--
End of file - 10973 bytes
merci de votre précieuse aide!!!marie-douce12

Configuration: Windows XP
Firefox 2.0.0.13

Afficher la suite

6 réponses

Réponse 1 / 6
sKe69 Messages postés 21955 Statut Contributeur sécurité 463

Salut,

Télécharger VirtumundoBegone sur le bureau:
http://secured2k.home.comcast.net/tools/VirtumundoBeGone.exe

Double cliquer sur VirtumundoBeGone.exe et suivre les instructions.
Une fois terminé, redémarrer le PC, le rapport VBG.TXT sera crée sur le bureau , postes le.
(Si un message Ecran bleu "Erreur fatale" apparaît, pas d’inquiétude car c'est normal et attendu).

puis ensuite, fait un autre scan Hijack et postes le aussi .
0
1. marie-douce12
  
  voila le probleme maintenant;quand je télécharge virtumundo.exe il bogue a 23%....:(
  
  0
  1. sKe69 Messages postés 21955 Statut Contributeur sécurité 463 > marie-douce12
    
    peut tu être plus précise ...
    
    0
  2. marie-douce12 > sKe69 Messages postés 21955 Statut Contributeur sécurité
    
    dans ma fenetre de téléchargement le fichier (virtumundo.exe)bloque a 23%meme si j'annule et que je recommence ca fait la meme chose
    
    0
  3. marie-douce12 > sKe69 Messages postés 21955 Statut Contributeur sécurité
    
    bon ok ca fonctionne!!!voici le rapport et ensuite je t'envoie le hijack this;)merci!
    [04/01/2008, 17:14:55] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Kat\Bureau\VirtumundoBeGone.exe" )
    [04/01/2008, 17:15:08] - Detected System Information:
    [04/01/2008, 17:15:08] - Windows Version: 5.1.2600, Service Pack 2
    [04/01/2008, 17:15:08] - Current Username: Kat (Admin)
    [04/01/2008, 17:15:08] - Windows is in NORMAL mode.
    [04/01/2008, 17:15:08] - Searching for Browser Helper Objects:
    [04/01/2008, 17:15:08] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
    [04/01/2008, 17:15:08] - BHO 2: {163CAA89-EEA9-43AD-91FE-10AA407A2E84} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - No filename found. Continuing.
    [04/01/2008, 17:15:08] - BHO 3: {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} (SWEETIE Class)
    [04/01/2008, 17:15:08] - BHO 4: {3CD09E5C-5DCF-4BE6-BE4F-BB9405310D29} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - No filename found. Continuing.
    [04/01/2008, 17:15:08] - BHO 5: {54624d2e-c519-48da-9c1c-b0aa2c6c4e2a} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - No filename found. Continuing.
    [04/01/2008, 17:15:08] - BHO 6: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
    [04/01/2008, 17:15:08] - BHO 7: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - No filename found. Continuing.
    [04/01/2008, 17:15:08] - BHO 8: {9030D464-4C02-4ABF-8ECC-5164760863C6} (Programme d'aide de l'Assistant de connexion Windows Live)
    [04/01/2008, 17:15:08] - BHO 9: {B6D8F2BD-8C5B-4A91-A889-2983736B1D7F} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - No filename found. Continuing.
    [04/01/2008, 17:15:08] - BHO 10: {B716CC00-43D4-4ED3-AF69-B00BBD8ACC16} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - No filename found. Continuing.
    [04/01/2008, 17:15:08] - BHO 11: {C1B9FAB8-7924-4A7B-AF49-F2925CF569CF} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - Checking for HKLM\...\Winlogon\Notify\geede
    [04/01/2008, 17:15:08] - Key not found: HKLM\...\Winlogon\Notify\geede, continuing.
    [04/01/2008, 17:15:08] - BHO 12: {D318119E-CB62-4039-AE9B-CF9575BCAA7F} ()
    [04/01/2008, 17:15:08] - WARNING: BHO has no default name. Checking for Winlogon reference.
    [04/01/2008, 17:15:08] - No filename found. Continuing.
    [04/01/2008, 17:15:08] - Finished Searching Browser Helper Objects
    [04/01/2008, 17:15:08] - Finishing up...
    [04/01/2008, 17:15:08] - Nothing found! Exiting...
    
    0
Réponse 2 / 6
sKe69 Messages postés 21955 Statut Contributeur sécurité 463

bon alors essaye ce-ci :

Télécharger Vundofix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4

Double-cliquer sur VundoFix.exe afin de le lancer.
Cliquer sur le bouton Scan for Vundo.

Lorsque le scan est complété, cliquer sur le bouton fix Vundo.

Une invite de commande demandera si l’on souhaite supprimer les fichiers, cliquer sur YES

Après avoir cliqué "YES", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Une nouvelle invite de commande annoncera que le PC devra s'éteindre ("shutdown"). Cliquer sur OK , puis laisser le redémarrer.

Le contenu du rapport est situé dans C:\vundofix.txt : postes ce rapport avec aussi un nouveau rapport Hijackthis pour annalyse .
0
1. marie-douce12
  
  et voici le hijack this
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 17:25:42, on 2008-04-01
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\system32\Ati2evxx.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  C:\WINDOWS\ATKKBService.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  C:\Program Files\Bonjour\mDNSResponder.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  C:\WINDOWS\system32\HPZipm12.exe
  C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
  C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
  C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
  C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
  C:\WINDOWS\system32\V0230Mon.exe
  C:\Program Files\Creative\Shared Files\CTSched.exe
  C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\WINDOWS\system32\Rundll32.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
  C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
  C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
  C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
  C:\Program Files\Windows Live\Messenger\usnsvc.exe
  C:\Program Files\Windows Live\Messenger\msnmsgr.exe
  C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  C:\Program Files\Trend Micro\HijackThis\H.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
  R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://get2.adobe.com/reader/otherversions/
  R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
  R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {163CAA89-EEA9-43AD-91FE-10AA407A2E84} - (no file)
  O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
  O2 - BHO: (no name) - {3CD09E5C-5DCF-4BE6-BE4F-BB9405310D29} - (no file)
  O2 - BHO: (no name) - {4392B48E-F3A2-407B-97E9-9BB6D4100FC5} - C:\WINDOWS\system32\geede.dll
  O2 - BHO: {a2e4c6c2-aa0b-c1c9-ad84-915ce2d42645} - {54624d2e-c519-48da-9c1c-b0aa2c6c4e2a} - (no file)
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
  O2 - BHO: (no name) - {B6D8F2BD-8C5B-4A91-A889-2983736B1D7F} - (no file)
  O2 - BHO: (no name) - {B716CC00-43D4-4ED3-AF69-B00BBD8ACC16} - (no file)
  O2 - BHO: (no name) - {D318119E-CB62-4039-AE9B-CF9575BCAA7F} - (no file)
  O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
  O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
  O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
  O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
  O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
  O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
  O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
  O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
  O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\system32\V0230Mon.exe
  O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
  O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
  O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
  O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [BM9f5cab75] Rundll32.exe "C:\WINDOWS\system32\ggwjflpy.dll",s
  O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
  O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
  O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
  O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
  O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
  O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
  O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
  O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
  O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
  O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
  O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
  O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
  O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
  O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
  O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
  O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
  O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
  O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
  O20 - Winlogon Notify: yayvvsr - yayvvsr.dll (file missing)
  O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
  O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
  O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
  O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
  O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
  O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
  O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
  O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
  O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
  O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
  
  0
2. marie-douce12
  
  as tu recu leue je t'ai posté???
  
  0
  1. sKe69 Messages postés 21955 Statut Contributeur sécurité 463 > marie-douce12
    
    oui c'est bon ! arretes toi la pour l'instant et attends la suite ;)
    
    0
Réponse 3 / 6
sKe69 Messages postés 21955 Statut Contributeur sécurité 463

Télécharger ComboFix (par sUBs) sur le Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Démarrer en mode sans echec :
Comment aller en Mode sans échec
1) Redémarre ton ordi
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip"
3) Tu verras un écran avec options de démarrage apparaître
4) Choisis la première option : Sans Échec, et valide avec "Entrée"
5) Choisis ton compte habituel, et non Administrateur (si besoin ... )

Double cliquer combofix.exe.

Appuyer sur la touche Y (Yes) pour démarrer le scan
Le rapport sera crée dans: C:\Combofix.txt

postes le rapport combo fix et un nouveau rapport hijackthis svp

Puis attends les instructions ...
0
1. marie-douce12
  
  ok merci je m'exécute immédiatement!;)
  
  0
  1. sKe69 Messages postés 21955 Statut Contributeur sécurité 463 > marie-douce12
    
    et au pas de course !!!! :p
    
    poste moi tout cela et on continuras demain si tu veux bien ... en attendant , ne touche pas (trop ) à ce PC ...
    
    0
  2. marie-douce12 > sKe69 Messages postés 21955 Statut Contributeur sécurité
    
    ok alors voila le combofix:
    ComboFix 08-04-01.2 - Kat 2008-04-01 18:23:13.1 - NTFSx86 MINIMAL
    Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.788 [GMT -5:00]
    Endroit: C:\Documents and Settings\Kat\Bureau\ComboFix.exe
    
    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
    .
    
    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    
    C:\WINDOWS\BM9f5cab75.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\cdheyxpw.dll
    C:\WINDOWS\system32\edeeg.ini
    C:\WINDOWS\system32\edeeg.ini2
    C:\WINDOWS\system32\geede.dll
    C:\WINDOWS\system32\ggwjflpy.dll
    C:\WINDOWS\system32\ijjlm.ini
    C:\WINDOWS\system32\ijjlm.ini2
    C:\WINDOWS\system32\kjkmp.ini
    C:\WINDOWS\system32\kjkmp.ini2
    C:\WINDOWS\system32\kmllm.ini
    C:\WINDOWS\system32\kmllm.ini2
    C:\WINDOWS\system32\orqss.ini
    C:\WINDOWS\system32\orqss.ini2
    C:\WINDOWS\system32\prutv.ini
    C:\WINDOWS\system32\prutv.ini2
    
    .
    ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-01 to 2008-04-01 ))))))))))))))))))))))))))))))))))))
    .
    
    2008-04-01 17:36 . 2008-04-01 17:36 <REP> d-------- C:\VundoFix Backups
    2008-03-31 14:11 . 2008-04-01 15:31 <REP> d-------- C:\Documents and Settings\Kat\Application Data\AVG7
    2008-03-31 14:10 . 2008-03-31 14:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\avg7
    2008-03-31 12:58 . 2008-03-31 12:58 <REP> d-------- C:\Documents and Settings\Kat\Application Data\Grisoft
    2008-03-31 12:52 . 2008-03-31 14:10 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-03-31 12:52 . 2007-05-30 07:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-03-31 11:25 . 2008-03-31 11:27 <REP> d-------- C:\Program Files\Windows Live
    2008-03-31 10:53 . 2008-03-31 10:53 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-03-31 10:52 . 2008-04-01 15:27 474 ---hs---- C:\WINDOWS\system32\tajnloyb.ini
    2008-03-31 09:24 . 2008-03-31 09:24 654 ---hs---- C:\WINDOWS\system32\kemdceqf.ini
    2008-03-31 09:16 . 2008-03-31 09:16 594 ---hs---- C:\WINDOWS\system32\qdjpvdgf.ini
    2008-03-31 07:37 . 2008-03-31 08:02 534 ---hs---- C:\WINDOWS\system32\qufelgmr.ini
    2008-03-30 18:29 . 2008-03-30 22:07 414 ---hs---- C:\WINDOWS\system32\dixhefte.ini
    2008-03-30 15:48 . 2008-03-30 15:48 294 ---hs---- C:\WINDOWS\system32\fnfhesfk.ini
    2008-03-30 14:01 . 2008-03-30 14:01 294 ---hs---- C:\WINDOWS\system32\lqejrpsy.ini
    2008-03-30 11:59 . 2008-03-31 10:33 891 --a------ C:\WINDOWS\wininit.ini
    2008-03-30 08:05 . 2008-03-30 08:05 294 ---hs---- C:\WINDOWS\system32\nhbefyuv.ini
    2008-03-30 05:37 . 2008-03-30 05:37 <REP> d-------- C:\Documents and Settings\Marco\Application Data\Nero
    2008-03-29 20:15 . 2004-03-09 16:36 140,488 -ra------ C:\WINDOWS\system32\comdlg32.ocx
    2008-03-29 20:15 . 2004-03-09 16:36 115,016 -ra------ C:\WINDOWS\system32\MSINET.OCX
    2008-03-29 20:15 . 2004-03-09 16:36 89,360 -ra------ C:\WINDOWS\system32\VB5DB.DLL
    2008-03-29 20:15 . 2004-03-09 16:36 69,632 -ra------ C:\WINDOWS\system32\xmltok.dll
    2008-03-29 20:15 . 2004-03-09 16:36 36,864 -ra------ C:\WINDOWS\system32\xmlparse.dll
    2008-03-29 20:15 . 2004-03-09 16:36 35,840 -ra------ C:\WINDOWS\system32\comdlg32.oca
    2008-03-29 20:15 . 2004-03-09 16:36 29,184 -ra------ C:\WINDOWS\system32\MSINET.oca
    2008-03-29 20:15 . 2004-03-09 16:36 26,096 -ra------ C:\WINDOWS\system32\xmlinst.exe
    2008-03-29 18:23 . 2008-03-29 18:23 <REP> d-------- C:\Documents and Settings\Kat\Application Data\Nero
    2008-03-29 18:18 . 2008-03-29 18:19 <REP> d-------- C:\Program Files\Fichiers communs\Nero
    2008-03-29 11:49 . 2008-03-29 11:49 <REP> d-------- C:\Program Files\Smart Projects
    2008-03-28 13:24 . 2004-08-04 00:45 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-03-28 13:24 . 2004-08-04 00:45 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-03-28 13:22 . 2008-03-28 13:22 <REP> d-------- C:\Program Files\Logitech
    2008-03-28 13:22 . 2008-03-28 13:22 <REP> d-------- C:\Program Files\Fichiers communs\Logitech
    2008-03-28 13:22 . 2005-04-12 19:21 45,504 --a------ C:\WINDOWS\system32\drivers\WmXlCore.sys
    2008-03-28 13:22 . 2005-04-12 19:21 22,240 --a------ C:\WINDOWS\system32\drivers\WmFilter.sys
    2008-03-28 13:22 . 2005-04-12 19:21 10,144 --a------ C:\WINDOWS\system32\drivers\WmBEnum.sys
    2008-03-28 13:22 . 2005-04-12 19:21 5,600 --a------ C:\WINDOWS\system32\drivers\WmVirHid.sys
    2008-03-28 13:06 . 2008-03-28 13:06 <REP> d-------- C:\WINDOWS\system32\AGEIA
    2008-03-28 13:06 . 2008-03-28 13:06 <REP> d-------- C:\Program Files\AGEIA Technologies
    2008-03-24 12:49 . 2008-03-24 12:49 <REP> d-------- C:\Program Files\programmesd
    2008-03-23 20:38 . 2008-03-23 20:38 <REP> d-------- C:\Documents and Settings\Marco\Application Data\Corel
    2008-03-21 22:27 . 2008-03-29 11:14 56 -r-hs---- C:\WINDOWS\system32\13D67817A2.sys
    2008-03-21 22:25 . 2008-03-21 22:25 <REP> d-------- C:\Documents and Settings\Kat\Application Data\Corel
    2008-03-21 22:25 . 2008-03-21 22:25 <REP> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
    2008-03-21 22:24 . 2008-03-21 22:25 <REP> d-------- C:\Program Files\Fichiers communs\Corel
    2008-03-21 22:19 . 2008-03-29 11:14 3,350 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2008-03-21 22:17 . 2008-03-21 22:24 <REP> d-------- C:\Program Files\Corel
    2008-03-21 18:27 . 2008-03-21 18:27 <REP> d-------- C:\Documents and Settings\Marco\Application Data\DivX
    2008-03-21 18:27 . 2008-03-21 18:27 38 --a------ C:\WINDOWS\avisplitter.INI
    2008-03-20 14:26 . 2008-03-20 14:27 <REP> d-------- C:\Program Files\Safari
    2008-03-20 12:26 . 2008-03-24 21:33 28 --a------ C:\WINDOWS\system32\kifile
    2008-03-20 12:26 . 2008-03-24 21:33 19 --a------ C:\WINDOWS\system32\nifile
    2008-03-20 12:25 . 2008-03-20 12:25 <REP> d--hs---- C:\WINDOWS\ftpcache
    2008-03-20 12:25 . 2008-03-20 12:25 <REP> d-------- C:\Program Files\Tribal
    2008-03-17 12:50 . 2008-03-17 12:50 <REP> d-------- C:\Documents and Settings\Kat\Application Data\skypePM
    2008-03-17 12:50 . 2008-03-17 12:50 32 --a------ C:\Documents and Settings\All Users\Application Data\ezsid.dat
    2008-03-17 12:48 . 2008-03-17 12:57 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Skype
    2008-03-16 18:34 . 2008-03-16 18:34 <REP> d-------- C:\Documents and Settings\Amely\Application Data\Apple Computer
    2008-03-15 10:17 . 2008-03-15 10:17 <REP> d-------- C:\Program Files\uTorrent
    2008-03-15 10:17 . 2008-03-31 08:00 <REP> d-------- C:\Documents and Settings\Marco\Application Data\uTorrent
    2008-03-14 18:23 . 2008-03-14 18:23 20,699 --a------ C:\WINDOWS\system32\TuneUpDefragService_20080314-232340.dmp
    2008-03-13 23:15 . 2008-03-13 23:15 <REP> d-------- C:\WINDOWS\Sun
    2008-03-13 23:14 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-03-13 23:13 . 2008-03-13 23:14 <REP> d-------- C:\Program Files\Java
    2008-03-13 23:13 . 2008-03-13 23:13 <REP> d-------- C:\Program Files\Fichiers communs\Java
    2008-03-13 20:24 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2008-03-13 19:53 . 2008-03-13 19:53 <REP> d-------- C:\Documents and Settings\Marco\Application Data\Ahead
    2008-03-13 09:20 . 2008-03-13 09:20 <REP> d--h----- C:\WINDOWS\PIF
    2008-03-11 12:32 . 2008-03-11 12:32 <REP> d-------- C:\Program Files\Trend Micro
    2008-03-11 12:22 . 2008-03-11 12:22 <REP> d-------- C:\Documents and Settings\Kat\Application Data\Media Player Classic
    2008-03-11 10:41 . 2008-03-11 10:41 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
    2008-03-11 10:37 . 2008-03-29 20:15 <REP> d-------- C:\Program Files\Ubisoft
    2008-03-10 22:23 . 2008-03-29 22:05 <REP> d--h----- C:\WINDOWS\Icons
    2008-03-10 22:22 . 2008-03-29 22:07 2,277,888 --a------ C:\WINDOWS\system32\TUKernel.exe
    2008-03-10 18:07 . 2008-03-10 18:07 <REP> d-------- C:\Documents and Settings\Amely\Application Data\DivX
    2008-03-10 16:32 . 2008-03-10 16:33 <REP> d-------- C:\Program Files\Fichiers communs\muvee Technologies
    2008-03-10 15:59 . 2008-03-10 15:59 <REP> d-------- C:\Documents and Settings\Amely\Application Data\Creative
    2008-03-10 15:05 . 2008-03-10 15:40 <REP> d-------- C:\Program Files\Photo Story 3 for Windows
    2008-03-10 10:17 . 2008-03-10 10:17 <REP> d---s---- C:\Documents and Settings\Amely\UserData
    2008-03-09 18:53 . 2008-03-09 18:53 <REP> d-------- C:\Documents and Settings\Amely\Application Data\TuneUp Software
    2008-03-09 09:14 . 2008-03-09 15:22 <REP> d-------- C:\Documents and Settings\Marco\Application Data\Azureus
    2008-03-08 17:58 . 2008-03-19 14:54 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
    2008-03-07 12:58 . 2008-03-09 13:48 <REP> d-------- C:\Documents and Settings\Kat\Application Data\Apple Computer
    2008-03-06 20:15 . 2008-03-06 20:15 <REP> d-------- C:\Documents and Settings\Marco\Application Data\TuneUp Software
    2008-03-06 16:51 . 2008-03-06 16:51 <REP> d-------- C:\Program Files\iPod
    2008-03-06 16:51 . 2008-03-06 16:51 <REP> d-------- C:\Documents and Settings\Marco\Application Data\Apple Computer
    2008-03-06 16:51 . 2008-04-01 18:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-03-06 16:51 . 2008-03-06 16:51 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-03-06 16:50 . 2008-03-06 16:50 <REP> d-------- C:\Program Files\QuickTime
    2008-03-06 16:50 . 2008-03-06 16:51 <REP> d-------- C:\Program Files\iTunes
    2008-03-06 16:50 . 2008-03-06 16:50 <REP> d-------- C:\Program Files\Bonjour
    2008-03-06 16:50 . 2008-03-06 16:50 <REP> d-------- C:\Program Files\Apple Software Update
    2008-03-06 16:50 . 2008-03-06 16:50 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-03-06 16:49 . 2008-03-06 16:49 <REP> d-------- C:\Program Files\Fichiers communs\Apple
    2008-03-06 16:49 . 2008-03-06 16:49 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-03-06 13:42 . 2004-08-04 00:54 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
    2008-03-06 13:42 . 2001-08-23 17:47 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
    2008-03-05 20:19 . 2008-03-05 20:19 <REP> d---s---- C:\Documents and Settings\Marco\UserData
    2008-03-05 14:06 . 2008-03-05 16:17 <REP> d-------- C:\Documents and Settings\Kat\Application Data\gtk-2.0
    2008-03-05 14:05 . 2008-03-05 14:05 <REP> d-------- C:\Documents and Settings\Kat\.thumbnails
    
    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-29 22:44 196,608 ----a-w C:\WINDOWS\system32\drivers\aStandard.bin
    2008-03-03 04:09 --------- d-----w C:\Documents and Settings\Marco\Application Data\Vidéotron
    2008-03-03 04:09 --------- d-----w C:\Documents and Settings\Kat\Application Data\Vidéotron
    2008-03-03 04:09 --------- d-----w C:\Documents and Settings\Amely\Application Data\Vidéotron
    2008-03-03 04:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Vidéotron
    2008-03-02 02:54 --------- d-----w C:\Program Files\Fichiers communs\Adobe
    2008-03-02 02:39 --------- d-----w C:\Program Files\microsoft frontpage
    2008-03-02 02:38 --------- d-----w C:\Program Files\Services en ligne
    2008-02-21 02:05 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
    2008-02-21 02:05 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
    2008-02-21 02:05 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
    2007-08-28 18:54 237,568 ----a-w C:\Program Files\mozilla firefox\plugins\CrazyTalk4Native.dll
    2007-05-17 22:45 208,991 ----a-w C:\Program Files\mozilla firefox\plugins\ctdomemhelper.dll
    2007-05-17 22:45 450,657 ----a-w C:\Program Files\mozilla firefox\plugins\ctplayerobject.dll
    2002-06-03 21:46 454,656 ----a-w C:\Program Files\mozilla firefox\plugins\imagickrt.dll
    2005-11-09 16:10 204,800 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicPacker.dll
    2005-11-09 16:42 106,496 ----a-w C:\Program Files\mozilla firefox\plugins\RLMusicUnpacker.dll
    .
    
    ------- Sigcheck -------
    
    2007-12-06 19:47 670208 c057d734b1951393fd07e2607513d4d9 C:\WINDOWS\$hf_mig$\KB944533\SP2QFE\wininet.dll
    2004-08-03 23:54 660480 58fe94ef42e074f4cad8bf02e70e6478 C:\WINDOWS\$NtUninstallKB944533$\wininet.dll
    2007-12-06 20:07 697856 de04a7293a48d92fddd6ec067a225562 C:\WINDOWS\system32\wininet.dll
    2007-12-06 20:07 697856 de04a7293a48d92fddd6ec067a225562 C:\WINDOWS\system32\dllcache\wininet.dll
    
    2007-06-13 08:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\explorer.exe
    2007-06-13 08:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
    2004-08-03 23:54 1036288 4c33e5b9a6197b6ed215f6cfba0a2daa C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
    2007-06-13 08:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\system32\dllcache\explorer.exe
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    REGEDIT4
    *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
    
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 20:15 103712]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
    "ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-02-20 09:15 816368]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
    "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2006-05-31 16:00 143360]
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RTHDCPL"="RTHDCPL.EXE" [2006-06-13 07:05 16239616 C:\WINDOWS\RTHDCPL.exe]
    "SkyTel"="SkyTel.EXE" [2006-05-16 05:04 2879488 C:\WINDOWS\SkyTel.exe]
    "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49 49152]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 15:10 56928]
    "LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 22:55 54832]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "SweetIM"="C:\Program Files\Macrogaming\SweetIM\SweetIM.exe" [2008-01-02 20:15 103712]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
    "AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-06-09 01:11 24576]
    "V0230Mon.exe"="C:\WINDOWS\system32\V0230Mon.exe" [2006-07-19 12:00 36961]
    "CreativeTaskScheduler"="C:\Program Files\Creative\Shared Files\CTSched.exe" [2006-01-08 21:43 53340]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 14:57 153136]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-12-03 14:21 2213160]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-31 14:10 579072]
    
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 23:54 15360]
    "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-31 14:11 219136]
    
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayvvsr]
    yayvvsr.dll
    
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Azureus\\Azureus.exe"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\MSN Gaming Zone\\Windows\\bckgzm.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "C:\\Documents and Settings\\Marco\\Bureau\\msnmsgr.exe"=
    "C:\\Program Files\\Nero\\Nero8\\Nero Home\\NeroHome.exe"=
    "C:\\Program Files\\Fichiers communs\\Nero\\Nero Web\\SetupX.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
    
    R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:55]
    R3 V0230Vfx;V0230Vfx;C:\WINDOWS\system32\DRIVERS\V0230Vfx.sys [2006-03-23 12:00]
    R3 V0230VID;Live! Cam Video IM Pro;C:\WINDOWS\system32\DRIVERS\V0230VID.sys [2006-07-24 12:00]
    R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys [2006-09-29 10:06]
    R4 atidgllk;atidgllk;C:\WINDOWS\atidgllk.sys [2005-10-20 10:29]
    S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-03-05 12:56]
    
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp
    
    .
    Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
    "2008-03-27 19:21:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-04-01 23:32:30 C:\WINDOWS\Tasks\Maintenance en 1 clic.job"
    - C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe
    .
    **************************************************************************
    
    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-01 18:32:48
    Windows 5.1.2600 Service Pack 2 NTFS
    
    Balayage processus cach‚s ...
    
    Balayage cach‚ autostart entries ...
    
    Balayage des fichiers cach‚s ...
    
    Scan termin‚ avec succŠs
    Les fichiers cach‚s: 0
    
    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\ATKKBService.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    .
    **************************************************************************
    .
    Temps d'accomplissement: 2008-04-01 18:35:44 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-01 23:35:40
    Pre-Run: 20,712,640,512 octets libres
    Post-Run: 21,123,792,896 octets libres
    .
    2008-03-12 18:01:29 --- E O F ---
    
    et voici le hijack this:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:47:54, on 2008-04-01
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal
    
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\ATKKBService.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
    C:\WINDOWS\system32\V0230Mon.exe
    C:\Program Files\Creative\Shared Files\CTSched.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
    C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
    C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\H.exe
    
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://get2.adobe.com/reader/otherversions/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [AVFX Engine] C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe
    O4 - HKLM\..\Run: [V0230Mon.exe] C:\WINDOWS\system32\V0230Mon.exe
    O4 - HKLM\..\Run: [CreativeTaskScheduler] "C:\Program Files\Creative\Shared Files\CTSched.exe" /logon
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [SweetIM] C:\Program Files\Macrogaming\SweetIM\SweetIM.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
    O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
    O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
    O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
    O4 - Global Startup: Démarrage rapide du logiciel HP Image Zone.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15035/CTPID.cab
    O20 - Winlogon Notify: yayvvsr - yayvvsr.dll (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
    O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
    
    0
Réponse 4 / 6
sKe69 Messages postés 21955 Statut Contributeur sécurité 463

Impec ...

Fermes toutes tes appliques et déconnectes toi

Relance Hijackthis mais click sur " Do a scan only "
Tu vois donc apparaitre le résultat du scan : une multitudes de lignes ,chacunes précédées d'un carré vide .
Tu vas clické sur les carré des lignes suivantes :

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O20 - Winlogon Notify: yayvvsr - yayvvsr.dll (file missing)

Tu cliques en bas sur le bouton FIX CHECKED et valides .

ensuite ce-ci :
Télécharge : - CCleaner
https://www.pcastuces.com/logitheque/ccleaner.htm
Ce logiciel va permettre de supprimer tous les fichiers temporaires. Avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires". Ensuite, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.
Un tuto
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm

vas dans nettoyeur : fait annalyse puis nettoyage
et vas dans registre : fait chercher les erreurs et réparer ( plusieur fois jusqu'a ce qu'il n'y est plus d'erreur )

redémarre ton PC et dit moi ce que ça donne ... plus de prb ?
0
1. marie-douce12
  
  hey!!!merci je comprends mieux maintenent comment ca fonctionne tous ces....virus...j'ai fais ce que tu m'as dis et redémarrer et mon ordi va BEAUCOUP plus vite alors la je scan au maximum (spybot et ccleaner)pour voir si tout va bien;)tu m'as été d'une précieuse aide crois moi!MERCI marie-douce12
  
  0
Vous n’avez pas trouvé la réponse que vous recherchez ?
Posez votre question
Réponse 5 / 6
sKe69 Messages postés 21955 Statut Contributeur sécurité 463

j'aimerai que tu fasses ce-ci pour finir :

Télécharge ToolsCleaner (de A.Rothstein) sur ton Bureau.
http://a-rothstein.changelog.fr/TC/ToolsCleaner2.exe
Clique sur Recherche et laisse le scan se terminer.
Clique sur Suppression pour finaliser.
tu peux, si tu le souhaites, te servir des Options facultatives

se petit soft va te nettoyer tout les trucs dont on c'est servi pour la désinfection ( tu n'en as plus besion ! )
(supprimes le une fois terminé)

et si tu es une "MSN Way of life" , jettes un oiel ici :
(MSN c'est bien mais c"est aussi à double tranchant ) .

http://pageperso.aol.fr/loraline60/MSN.htm

Content d'avoir pu te rendre service ;)

A+

---sKe---
0
Réponse 6 / 6
sKe69 Messages postés 21955 Statut Contributeur sécurité 463

...
0
1. mariedouce12
  
  salut je viens de recevoir un message de toi me disant qu'il y a effectinement de la résistance mais il me semble que la tout va bien depuis que tu m'a aider la semaine derniere a régler mon probleme...crois tu que je devrais faire un autre rapport quand meme pour etre certaine?
  
  0
  1. sKe69 Messages postés 21955 Statut Contributeur sécurité 463 > mariedouce12
    
    pas de panique , je me suis juste trompé de destinataire =)
    Excuse moi pour le coup sang ...
    
    A+
    
    0

AU SECOURS!!VIRTUMONDE.DLL

6 réponses

Discussions similaires

Newsletters