virus sur win 32 Résolu

Question

Bonjour,
j'ai chopé un virus qui empeche toute installation de programme et qui a viré mon antivirus
j'ai essayé les scans en ligne mais meme ceux ci sont bloqués

quelqu'un peut il m'aider ??
merci

dou-l · Answer

t'aurais pas télécharger un crack dernierement ?

dou-l · Answer

ben t'es infecter par bagle vire ton crack avant toute chose !


Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.


-----------

Fais DEMARRER puis EXECUTER et tape mrt puis clique sur ok et suis la procedure

----------


* Téléchargez ELIBAGLA en bas de cette page http://www.zonavirus.com/datos/descargas/95/elibagla.asp
* Clique sur le bouton Descargar Elibagla cela va télécharger le fichier, placez le sur votre bureau.
* Double-cliquez dessus pour l'ouvrir
* Assurez-vous que dans le menu déroulant Unidad, vous avez bien C:\
* Vérifiquez aussi que l'option en bas de la fenêtre Eliminar Ficheros Automaticamente est bien cochée
* Cliquez sur le bouton Explorar pour lancer l'analyse
------------


colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

secuser en ligne :
http://www.secuser.com/outils/antivirus.htm

scan en ligne firefox

https://www.trendmicro.com/fr_fr/business.html

olivier75016 · Answer

merci dou je te tiens au courant

dou-l · Answer

ok

olivier75016 · Answer

dis moi dou
je dois lancer les programmes panda ou autre, ou bien y a t il un endroit précis sur ces sites ou je dois coller les rapports ?
merci vraiment pour ton aide

dou-l · Answer

panda??

Tu colles les rapport ici meme

olivier75016 · Answer

et voila avec elibagla merci, je reste en ligne


	  Fri Apr 04 20:46:37 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\FLEC006.EXE.Muestra EliBagle v11.21
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DE CLERCK\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
C:\DOCUMENTS AND SETTINGS\DE CLERCK\APPLICATION DATA\M\LIST.OCT --> Eliminado Bagle

	  Fri Apr 04 20:47:05 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.

	  Fri Apr 04 20:47:23 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
Por favor, envienos una muestra del fichero
C:\Muestras\FLEC006.EXE.Muestra EliBagle v11.21
 a "virus@satinfo.es".  Gracias.
C:\DOCUMENTS AND SETTINGS\DE CLERCK\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.

	  Fri Apr 04 21:13:53 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Fri Apr 04 21:13:58 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\Documents and Settings\de clerck\Application Data\holephonemedia\JUNKTONSDASH.EXE --> Eliminado Bagle.dldr
C:\RECYCLER\S-1-5-21-861567501-413027322-682003330-1003\Dc5\C\WINDOWS\system32\drivers\down\107203.EXE.VIR --> Eliminado Bagle
C:\RECYCLER\S-1-5-21-861567501-413027322-682003330-1003\Dc5\C\WINDOWS\system32\drivers\down\29149609.EXE.VIR --> Eliminado Bagle
C:\RECYCLER\S-1-5-21-861567501-413027322-682003330-1003\Dc5\C\WINDOWS\system32\drivers\down\89156.EXE.VIR --> Eliminado Bagle
C:\RECYCLER\S-1-5-21-861567501-413027322-682003330-1003\Dc5\C\WINDOWS\system32\drivers\down\980578.EXE.VIR --> Eliminado Bagle
C:\RECYCLER\S-1-5-21-861567501-413027322-682003330-1003\Dc5\C\WINDOWS\system32\drivers\down\99609.EXE.VIR --> Eliminado Bagle
C:\RECYCLER\S-1-5-21-861567501-413027322-682003330-1003\Dc5\C\WINDOWS\system32\drivers\down\99890.EXE.VIR --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP775\A0138876.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP776\A0139011.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139052.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139058.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139059.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139064.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139075.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139080.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139081.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139094.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139108.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139109.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139110.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139125.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139145.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139146.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139151.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139176.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139193.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139208.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139222.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139331.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139558.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139630.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139652.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139655.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139656.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139665.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139764.EXE --> Eliminado Bagle.dldr

Nº Total de Directorios:   6501
Nº Total de Ficheros:      97612
Nº de Ficheros Analizados: 13571
Nº de Ficheros Infectados: 36
Nº de Ficheros Limpiados:  36

	  Fri Apr 04 21:19:16 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad D:\

Nº Total de Directorios:   0
Nº Total de Ficheros:      0
Nº de Ficheros Analizados: 0
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

dou-l · Answer

combofix maintenant stp

olivier75016 · Answer

et voila (encore merci)
ComboFix 08-04-03.5 - de clerck 2008-04-04 21:20:15.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.539 [GMT 2:00]
Endroit: C:\Documents and Settings\de clerck\Bureau\antibeagle.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\down
.
---- Previous Run -------
.
C:\Documents and Settings\de clerck\Application Data\m
C:\WINDOWS\system32\ban_list.txt
C:\WINDOWS\system32\drivers\down
C:\WINDOWS\system32\drivers\down\1001140.exe
C:\WINDOWS\system32\drivers\down\1002671.exe
C:\WINDOWS\system32\drivers\down\1007531.exe
C:\WINDOWS\system32\drivers\down\1009406.exe
C:\WINDOWS\system32\drivers\down\1012437.exe
C:\WINDOWS\system32\drivers\down\1015062.exe
C:\WINDOWS\system32\drivers\down\1022781.exe
C:\WINDOWS\system32\drivers\down\1025750.exe
C:\WINDOWS\system32\drivers\down\1028265.exe
C:\WINDOWS\system32\drivers\down\1031703.exe
C:\WINDOWS\system32\drivers\down\103281.exe
C:\WINDOWS\system32\drivers\down\1035062.exe
C:\WINDOWS\system32\drivers\down\103875.exe
C:\WINDOWS\system32\drivers\down\1043453.exe
C:\WINDOWS\system32\drivers\down\104531.exe
C:\WINDOWS\system32\drivers\down\105156.exe
C:\WINDOWS\system32\drivers\down\105203.exe
C:\WINDOWS\system32\drivers\down\106109.exe
C:\WINDOWS\system32\drivers\down\1070812.exe
C:\WINDOWS\system32\drivers\down\107203.exe
C:\WINDOWS\system32\drivers\down\1077125.exe
C:\WINDOWS\system32\drivers\down\1078328.exe
C:\WINDOWS\system32\drivers\down\108750.exe
C:\WINDOWS\system32\drivers\down\110265.exe
C:\WINDOWS\system32\drivers\down\110968.exe
C:\WINDOWS\system32\drivers\down\114859.exe
C:\WINDOWS\system32\drivers\down\115000.exe
C:\WINDOWS\system32\drivers\down\116765.exe
C:\WINDOWS\system32\drivers\down\121484.exe
C:\WINDOWS\system32\drivers\down\122656.exe
C:\WINDOWS\system32\drivers\down\123375.exe
C:\WINDOWS\system32\drivers\down\124046.exe
C:\WINDOWS\system32\drivers\down\124468.exe
C:\WINDOWS\system32\drivers\down\124531.exe
C:\WINDOWS\system32\drivers\down\125062.exe
C:\WINDOWS\system32\drivers\down\125265.exe
C:\WINDOWS\system32\drivers\down\125937.exe
C:\WINDOWS\system32\drivers\down\127046.exe
C:\WINDOWS\system32\drivers\down\127359.exe
C:\WINDOWS\system32\drivers\down\128468.exe
C:\WINDOWS\system32\drivers\down\129218.exe
C:\WINDOWS\system32\drivers\down\129718.exe
C:\WINDOWS\system32\drivers\down\130187.exe
C:\WINDOWS\system32\drivers\down\130281.exe
C:\WINDOWS\system32\drivers\down\131109.exe
C:\WINDOWS\system32\drivers\down\131718.exe
C:\WINDOWS\system32\drivers\down\131812.exe
C:\WINDOWS\system32\drivers\down\131859.exe
C:\WINDOWS\system32\drivers\down\132015.exe
C:\WINDOWS\system32\drivers\down\132484.exe
C:\WINDOWS\system32\drivers\down\132890.exe
C:\WINDOWS\system32\drivers\down\133078.exe
C:\WINDOWS\system32\drivers\down\133968.exe
C:\WINDOWS\system32\drivers\down\133984.exe
C:\WINDOWS\system32\drivers\down\134406.exe
C:\WINDOWS\system32\drivers\down\137734.exe
C:\WINDOWS\system32\drivers\down\138500.exe
C:\WINDOWS\system32\drivers\down\139015.exe
C:\WINDOWS\system32\drivers\down\139796.exe
C:\WINDOWS\system32\drivers\down\140312.exe
C:\WINDOWS\system32\drivers\down\140875.exe
C:\WINDOWS\system32\drivers\down\141000.exe
C:\WINDOWS\system32\drivers\down\141843.exe
C:\WINDOWS\system32\drivers\down\141859.exe
C:\WINDOWS\system32\drivers\down\142390.exe
C:\WINDOWS\system32\drivers\down\142703.exe
C:\WINDOWS\system32\drivers\down\143546.exe
C:\WINDOWS\system32\drivers\down\144937.exe
C:\WINDOWS\system32\drivers\down\145078.exe
C:\WINDOWS\system32\drivers\down\14616250.exe
C:\WINDOWS\system32\drivers\down\14616734.exe
C:\WINDOWS\system32\drivers\down\14619812.exe
C:\WINDOWS\system32\drivers\down\14620953.exe
C:\WINDOWS\system32\drivers\down\14625296.exe
C:\WINDOWS\system32\drivers\down\14625531.exe
C:\WINDOWS\system32\drivers\down\14626343.exe
C:\WINDOWS\system32\drivers\down\14634250.exe
C:\WINDOWS\system32\drivers\down\146343.exe
C:\WINDOWS\system32\drivers\down\14635468.exe
C:\WINDOWS\system32\drivers\down\14639937.exe
C:\WINDOWS\system32\drivers\down\14640578.exe
C:\WINDOWS\system32\drivers\down\14641843.exe
C:\WINDOWS\system32\drivers\down\14649734.exe
C:\WINDOWS\system32\drivers\down\14651718.exe
C:\WINDOWS\system32\drivers\down\14654250.exe
C:\WINDOWS\system32\drivers\down\14657500.exe
C:\WINDOWS\system32\drivers\down\14657937.exe
C:\WINDOWS\system32\drivers\down\14659390.exe
C:\WINDOWS\system32\drivers\down\14664437.exe
C:\WINDOWS\system32\drivers\down\14665546.exe
C:\WINDOWS\system32\drivers\down\14667859.exe
C:\WINDOWS\system32\drivers\down\14667890.exe
C:\WINDOWS\system32\drivers\down\14669843.exe
C:\WINDOWS\system32\drivers\down\14670218.exe
C:\WINDOWS\system32\drivers\down\14670468.exe
C:\WINDOWS\system32\drivers\down\14672562.exe
C:\WINDOWS\system32\drivers\down\14673187.exe
C:\WINDOWS\system32\drivers\down\14678593.exe
C:\WINDOWS\system32\drivers\down\14679125.exe
C:\WINDOWS\system32\drivers\down\14682921.exe
C:\WINDOWS\system32\drivers\down\14683765.exe
C:\WINDOWS\system32\drivers\down\14684375.exe
C:\WINDOWS\system32\drivers\down\14684906.exe
C:\WINDOWS\system32\drivers\down\14685515.exe
C:\WINDOWS\system32\drivers\down\14687765.exe
C:\WINDOWS\system32\drivers\down\14689953.exe
C:\WINDOWS\system32\drivers\down\14691453.exe
C:\WINDOWS\system32\drivers\down\14696390.exe
C:\WINDOWS\system32\drivers\down\14707234.exe
C:\WINDOWS\system32\drivers\down\14708453.exe
C:\WINDOWS\system32\drivers\down\14709546.exe
C:\WINDOWS\system32\drivers\down\14713531.exe
C:\WINDOWS\system32\drivers\down\14714625.exe
C:\WINDOWS\system32\drivers\down\14714734.exe
C:\WINDOWS\system32\drivers\down\14716390.exe
C:\WINDOWS\system32\drivers\down\14722093.exe
C:\WINDOWS\system32\drivers\down\14727406.exe
C:\WINDOWS\system32\drivers\down\14728609.exe
C:\WINDOWS\system32\drivers\down\14742015.exe
C:\WINDOWS\system32\drivers\down\14749656.exe
C:\WINDOWS\system32\drivers\down\14758140.exe
C:\WINDOWS\system32\drivers\down\14761296.exe
C:\WINDOWS\system32\drivers\down\14762656.exe
C:\WINDOWS\system32\drivers\down\14763078.exe
C:\WINDOWS\system32\drivers\down\14766406.exe
C:\WINDOWS\system32\drivers\down\14774046.exe
C:\WINDOWS\system32\drivers\down\14800171.exe
C:\WINDOWS\system32\drivers\down\14804187.exe
C:\WINDOWS\system32\drivers\down\14805375.exe
C:\WINDOWS\system32\drivers\down\148296.exe
C:\WINDOWS\system32\drivers\down\149937.exe
C:\WINDOWS\system32\drivers\down\150156.exe
C:\WINDOWS\system32\drivers\down\150203.exe
C:\WINDOWS\system32\drivers\down\150343.exe
C:\WINDOWS\system32\drivers\down\150750.exe
C:\WINDOWS\system32\drivers\down\151406.exe
C:\WINDOWS\system32\drivers\down\152125.exe
C:\WINDOWS\system32\drivers\down\153125.exe
C:\WINDOWS\system32\drivers\down\153859.exe
C:\WINDOWS\system32\drivers\down\154171.exe
C:\WINDOWS\system32\drivers\down\155281.exe
C:\WINDOWS\system32\drivers\down\155765.exe
C:\WINDOWS\system32\drivers\down\156156.exe
C:\WINDOWS\system32\drivers\down\158437.exe
C:\WINDOWS\system32\drivers\down\158671.exe
C:\WINDOWS\system32\drivers\down\159109.exe
C:\WINDOWS\system32\drivers\down\159140.exe
C:\WINDOWS\system32\drivers\down\159234.exe
C:\WINDOWS\system32\drivers\down\160859.exe
C:\WINDOWS\system32\drivers\down\161453.exe
C:\WINDOWS\system32\drivers\down\161562.exe
C:\WINDOWS\system32\drivers\down\162031.exe
C:\WINDOWS\system32\drivers\down\162359.exe
C:\WINDOWS\system32\drivers\down\162515.exe
C:\WINDOWS\system32\drivers\down\162734.exe
C:\WINDOWS\system32\drivers\down\163156.exe
C:\WINDOWS\system32\drivers\down\163546.exe
C:\WINDOWS\system32\drivers\down\163984.exe
C:\WINDOWS\system32\drivers\down\166078.exe
C:\WINDOWS\system32\drivers\down\166406.exe
C:\WINDOWS\system32\drivers\down\167359.exe
C:\WINDOWS\system32\drivers\down\168031.exe
C:\WINDOWS\system32\drivers\down\168312.exe
C:\WINDOWS\system32\drivers\down\168828.exe
C:\WINDOWS\system32\drivers\down\169328.exe
C:\WINDOWS\system32\drivers\down\169500.exe
C:\WINDOWS\system32\drivers\down\169531.exe
C:\WINDOWS\system32\drivers\down\171078.exe
C:\WINDOWS\system32\drivers\down\172031.exe
C:\WINDOWS\system32\drivers\down\172312.exe
C:\WINDOWS\system32\drivers\down\172328.exe
C:\WINDOWS\system32\drivers\down\172765.exe
C:\WINDOWS\system32\drivers\down\172796.exe
C:\WINDOWS\system32\drivers\down\173281.exe
C:\WINDOWS\system32\drivers\down\173843.exe
C:\WINDOWS\system32\drivers\down\174062.exe
C:\WINDOWS\system32\drivers\down\174703.exe
C:\WINDOWS\system32\drivers\down\175343.exe
C:\WINDOWS\system32\drivers\down\175421.exe
C:\WINDOWS\system32\drivers\down\175609.exe
C:\WINDOWS\system32\drivers\down\175953.exe
C:\WINDOWS\system32\drivers\down\176000.exe
C:\WINDOWS\system32\drivers\down\176453.exe
C:\WINDOWS\system32\drivers\down\176890.exe
C:\WINDOWS\system32\drivers\down\177562.exe
C:\WINDOWS\system32\drivers\down\177609.exe
C:\WINDOWS\system32\drivers\down\179265.exe
C:\WINDOWS\system32\drivers\down\182687.exe
C:\WINDOWS\system32\drivers\down\182734.exe
C:\WINDOWS\system32\drivers\down\183078.exe
C:\WINDOWS\system32\drivers\down\184531.exe
C:\WINDOWS\system32\drivers\down\185843.exe
C:\WINDOWS\system32\drivers\down\186078.exe
C:\WINDOWS\system32\drivers\down\186593.exe
C:\WINDOWS\system32\drivers\down\187781.exe
C:\WINDOWS\system32\drivers\down\187828.exe
C:\WINDOWS\system32\drivers\down\190750.exe
C:\WINDOWS\system32\drivers\down\193281.exe
C:\WINDOWS\system32\drivers\down\198437.exe
C:\WINDOWS\system32\drivers\down\199890.exe
C:\WINDOWS\system32\drivers\down\200343.exe
C:\WINDOWS\system32\drivers\down\202453.exe
C:\WINDOWS\system32\drivers\down\203515.exe
C:\WINDOWS\system32\drivers\down\203609.exe
C:\WINDOWS\system32\drivers\down\204218.exe
C:\WINDOWS\system32\drivers\down\205609.exe
C:\WINDOWS\system32\drivers\down\205625.exe
C:\WINDOWS\system32\drivers\down\205921.exe
C:\WINDOWS\system32\drivers\down\207390.exe
C:\WINDOWS\system32\drivers\down\207875.exe
C:\WINDOWS\system32\drivers\down\208515.exe
C:\WINDOWS\system32\drivers\down\209156.exe
C:\WINDOWS\system32\drivers\down\209343.exe
C:\WINDOWS\system32\drivers\down\211281.exe
C:\WINDOWS\system32\drivers\down\211578.exe
C:\WINDOWS\system32\drivers\down\212500.exe
C:\WINDOWS\system32\drivers\down\212843.exe
C:\WINDOWS\system32\drivers\down\213609.exe
C:\WINDOWS\system32\drivers\down\214750.exe
C:\WINDOWS\system32\drivers\down\215578.exe
C:\WINDOWS\system32\drivers\down\215984.exe
C:\WINDOWS\system32\drivers\down\217843.exe
C:\WINDOWS\system32\drivers\down\218031.exe
C:\WINDOWS\system32\drivers\down\219218.exe
C:\WINDOWS\system32\drivers\down\219718.exe
C:\WINDOWS\system32\drivers\down\220531.exe
C:\WINDOWS\system32\drivers\down\221171.exe
C:\WINDOWS\system32\drivers\down\229093.exe
C:\WINDOWS\system32\drivers\down\231156.exe
C:\WINDOWS\system32\drivers\down\237312.exe
C:\WINDOWS\system32\drivers\down\238500.exe
C:\WINDOWS\system32\drivers\down\239375.exe
C:\WINDOWS\system32\drivers\down\255218.exe
C:\WINDOWS\system32\drivers\down\259421.exe
C:\WINDOWS\system32\drivers\down\260593.exe
C:\WINDOWS\system32\drivers\down\265062.exe
C:\WINDOWS\system32\drivers\down\269296.exe
C:\WINDOWS\system32\drivers\down\270515.exe
C:\WINDOWS\system32\drivers\down\29126390.exe
C:\WINDOWS\system32\drivers\down\29126859.exe
C:\WINDOWS\system32\drivers\down\29138125.exe
C:\WINDOWS\system32\drivers\down\29140546.exe
C:\WINDOWS\system32\drivers\down\29143484.exe
C:\WINDOWS\system32\drivers\down\29144609.exe
C:\WINDOWS\system32\drivers\down\29145625.exe
C:\WINDOWS\system32\drivers\down\29147015.exe
C:\WINDOWS\system32\drivers\down\29149609.exe
C:\WINDOWS\system32\drivers\down\29151406.exe
C:\WINDOWS\system32\drivers\down\29153406.exe
C:\WINDOWS\system32\drivers\down\29170406.exe
C:\WINDOWS\system32\drivers\down\29170468.exe
C:\WINDOWS\system32\drivers\down\29171718.exe
C:\WINDOWS\system32\drivers\down\29172359.exe
C:\WINDOWS\system32\drivers\down\29177250.exe
C:\WINDOWS\system32\drivers\down\29178406.exe
C:\WINDOWS\system32\drivers\down\29179828.exe
C:\WINDOWS\system32\drivers\down\29180296.exe
C:\WINDOWS\system32\drivers\down\29182218.exe
C:\WINDOWS\system32\drivers\down\29183890.exe
C:\WINDOWS\system32\drivers\down\29184812.exe
C:\WINDOWS\system32\drivers\down\29186828.exe
C:\WINDOWS\system32\drivers\down\29190921.exe
C:\WINDOWS\system32\drivers\down\29194171.exe
C:\WINDOWS\system32\drivers\down\29194765.exe
C:\WINDOWS\system32\drivers\down\29195468.exe
C:\WINDOWS\system32\drivers\down\29199437.exe
C:\WINDOWS\system32\drivers\down\29200234.exe
C:\WINDOWS\system32\drivers\down\29207906.exe
C:\WINDOWS\system32\drivers\down\29208671.exe
C:\WINDOWS\system32\drivers\down\29212031.exe
C:\WINDOWS\system32\drivers\down\29212375.exe
C:\WINDOWS\system32\drivers\down\29214703.exe
C:\WINDOWS\system32\drivers\down\29221843.exe
C:\WINDOWS\system32\drivers\down\29234359.exe
C:\WINDOWS\system32\drivers\down\29238546.exe
C:\WINDOWS\system32\drivers\down\29240000.exe
C:\WINDOWS\system32\drivers\down\29247390.exe
C:\WINDOWS\system32\drivers\down\29252796.exe
C:\WINDOWS\system32\drivers\down\29253984.exe
C:\WINDOWS\system32\drivers\down\43649265.exe
C:\WINDOWS\system32\drivers\down\43650750.exe
C:\WINDOWS\system32\drivers\down\43652734.exe
C:\WINDOWS\system32\drivers\down\43654015.exe
C:\WINDOWS\system32\drivers\down\43656750.exe
C:\WINDOWS\system32\drivers\down\43660750.exe
C:\WINDOWS\system32\drivers\down\43680062.exe
C:\WINDOWS\system32\drivers\down\43681281.exe
C:\WINDOWS\system32\drivers\down\43686968.exe
C:\WINDOWS\system32\drivers\down\43688875.exe
C:\WINDOWS\system32\drivers\down\43691031.exe
C:\WINDOWS\system32\drivers\down\43693765.exe
C:\WINDOWS\system32\drivers\down\43699015.exe
C:\WINDOWS\system32\drivers\down\43702546.exe
C:\WINDOWS\system32\drivers\down\43705093.exe
C:\WINDOWS\system32\drivers\down\43705468.exe
C:\WINDOWS\system32\drivers\down\43710453.exe
C:\WINDOWS\system32\drivers\down\43719375.exe
C:\WINDOWS\system32\drivers\down\43749109.exe
C:\WINDOWS\system32\drivers\down\43753093.exe
C:\WINDOWS\system32\drivers\down\43754718.exe
C:\WINDOWS\system32\drivers\down\78906.exe
C:\WINDOWS\system32\drivers\down\79687.exe
C:\WINDOWS\system32\drivers\down\79843.exe
C:\WINDOWS\system32\drivers\down\80343.exe
C:\WINDOWS\system32\drivers\down\81890.exe
C:\WINDOWS\system32\drivers\down\82515.exe
C:\WINDOWS\system32\drivers\down\83609.exe
C:\WINDOWS\system32\drivers\down\85203.exe
C:\WINDOWS\system32\drivers\down\85250.exe
C:\WINDOWS\system32\drivers\down\85750.exe
C:\WINDOWS\system32\drivers\down\85843.exe
C:\WINDOWS\system32\drivers\down\86468.exe
C:\WINDOWS\system32\drivers\down\86609.exe
C:\WINDOWS\system32\drivers\down\86953.exe
C:\WINDOWS\system32\drivers\down\87562.exe
C:\WINDOWS\system32\drivers\down\87593.exe
C:\WINDOWS\system32\drivers\down\88203.exe
C:\WINDOWS\system32\drivers\down\89109.exe
C:\WINDOWS\system32\drivers\down\89156.exe
C:\WINDOWS\system32\drivers\down\89203.exe
C:\WINDOWS\system32\drivers\down\89875.exe
C:\WINDOWS\system32\drivers\down\90171.exe
C:\WINDOWS\system32\drivers\down\91187.exe
C:\WINDOWS\system32\drivers\down\91359.exe
C:\WINDOWS\system32\drivers\down\91437.exe
C:\WINDOWS\system32\drivers\down\91828.exe
C:\WINDOWS\system32\drivers\down\91875.exe
C:\WINDOWS\system32\drivers\down\92593.exe
C:\WINDOWS\system32\drivers\down\92718.exe
C:\WINDOWS\system32\drivers\down\92968.exe
C:\WINDOWS\system32\drivers\down\94265.exe
C:\WINDOWS\system32\drivers\down\94625.exe
C:\WINDOWS\system32\drivers\down\95328.exe
C:\WINDOWS\system32\drivers\down\95671.exe
C:\WINDOWS\system32\drivers\down\95796.exe
C:\WINDOWS\system32\drivers\down\96093.exe
C:\WINDOWS\system32\drivers\down\96953.exe
C:\WINDOWS\system32\drivers\down\973296.exe
C:\WINDOWS\system32\drivers\down\975875.exe
C:\WINDOWS\system32\drivers\down\977093.exe
C:\WINDOWS\system32\drivers\down\980578.exe
C:\WINDOWS\system32\drivers\down\98203.exe
C:\WINDOWS\system32\drivers\down\983093.exe
C:\WINDOWS\system32\drivers\down\99609.exe
C:\WINDOWS\system32\drivers\down\99890.exe
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\system32\wintems.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-03-04 to 2008-04-04 ))))))))))))))))))))))))))))))))))))
.

2008-04-04 20:46 . 2008-04-04 20:46 <REP> d----c--- C:\Muestras
2008-04-04 19:59 . 2005-04-13 03:48 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-04-04 19:58 . 2008-04-04 19:58 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-04-04 19:37 . 2008-04-04 19:37 <REP> d----c--- C:\fsaua.data
2008-04-04 18:57 . 2008-04-04 18:57 <REP> d-------- C:\Program Files\Trend Micro
2008-04-04 18:16 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-04 18:16 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-04 18:16 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-04 18:16 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-04 18:16 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-04 18:16 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-04 18:15 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-04 18:15 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-03-30 19:59 . 2008-03-30 19:59 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-30 19:59 . 2008-03-30 19:59 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-29 21:10 . 2008-03-29 21:10 <REP> d-------- C:\Program Files\Alwil Software
2008-03-29 21:10 . 2008-03-29 21:10 <REP> d----c--- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-26 22:38 . 2008-03-26 22:39 1 --a------ C:\WINDOWS\system32\client.sid
2008-03-26 22:35 . 2008-03-26 22:35 <REP> d-------- C:\WINDOWS\MaxTV
2008-03-26 22:35 . 2008-03-26 22:36 <REP> d-------- C:\Program Files\DMV
2008-03-26 22:02 . 2008-03-26 22:47 <REP> d-------- C:\Program Files\adslTV
2008-03-19 23:08 . 2008-03-19 23:08 <REP> d-------- C:\Program Files\PhotoFiltre
2008-03-19 22:58 . 2008-03-19 23:03 <REP> d-------- C:\Program Files\PhotoFiltre Studio
2008-03-19 22:58 . 2008-03-19 22:58 45 ---h----- C:\WINDOWS\dsez0734.dat

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-04 19:13 --------- dc----w C:\Documents and Settings\de clerck\Application Data\holephonemedia
2008-04-04 18:53 --------- dc----w C:\Documents and Settings\de clerck\Application Data\OpenOffice.org2
2008-04-04 17:59 --------- d-----w C:\Program Files\Java
2008-03-30 18:00 --------- dc----w C:\Documents and Settings\de clerck\Application Data\Corel
2008-03-30 17:54 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-03-29 18:36 --------- d-----w C:\Program Files\Kaspersky Lab
2008-03-29 18:27 --------- dc----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-03-29 17:48 625,440 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-03-29 17:48 27,666,720 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-27 19:58 59,444 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-03-27 19:58 370,268 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-26 21:19 --------- dc----w C:\Documents and Settings\de clerck\Application Data\uTorrent
2008-03-26 20:02 --------- dc----w C:\Documents and Settings\de clerck\Application Data\vlc
2008-02-10 09:04 --------- dc----w C:\Documents and Settings\de clerck\Application Data\InstallShield
2008-02-10 09:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-10 09:04 --------- d-----w C:\Program Files\Realtek
2008-01-06 18:18 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-01-06 18:18 22,328 -c--a-w C:\Documents and Settings\de clerck\Application Data\PnkBstrK.sys
2008-01-06 18:18 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-01-23 16:22 31 -c--a-w C:\Documents and Settings\de clerck\getfile.dat
2007-10-13 16:40 88 --sh--r C:\WINDOWS\system32\7FB4010071.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-04_20.54.14.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-03-30 17:26:51 40,972 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-04 18:56:44 40,972 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-30 17:26:51 49,734 ----a-w C:\WINDOWS\system32\perfc00C.dat
+ 2008-04-04 18:56:44 49,734 ----a-w C:\WINDOWS\system32\perfc00C.dat
- 2008-03-30 17:26:51 314,644 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-04 18:56:44 314,644 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-03-30 17:26:51 370,832 ----a-w C:\WINDOWS\system32\perfh00C.dat
+ 2008-04-04 18:56:44 370,832 ----a-w C:\WINDOWS\system32\perfh00C.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{100EB1FD-D03E-47FD-81F3-EE91287F9465}]
C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2004-10-08 13:06 196608]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [ ]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 15:53 307200]
"One readme"="C:\DOCUME~1\DECLER~1\APPLIC~1\HOLEPH~1\JUNKTONSDASH.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 18:24 1694208]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [ ]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-12-21 18:51 3481600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 16:10 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-09-10 19:29 77824 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-09-15 12:20 2557952 C:\WINDOWS\ALCWZRD.EXE]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 12:52 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2004-10-08 13:31 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2004-10-08 13:24 217088]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2005-05-23 19:09 127118]
"StandardInstall"="" []
"RemoteControl"="C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe" [2006-02-14 14:09 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58 282624]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2002-12-28 13:14 77824]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe" [2006-08-04 12:00 462336]
"Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [ ]
"BJCFD"="C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2003-01-27 18:16 376912]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-04-04 20:49 79224]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48 36975]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-20 01:09 15360]

C:\Documents and Settings\de clerck\Menu D‚marrer\Programmes\D‚marrage\
Club Internet.lnk - C:\Program Files\Club-Internet\Lanceur\lanceur.exe [2007-12-26 15:17:06 5484544]
OpenOffice.org 2.2.lnk - C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe [2007-02-02 16:54:56 393216]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Docteur Club Internet.lnk - C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe [2006-04-24 13:42:28 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll,,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= L3codecp.acm
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
"vidc.XVID"= xvid.dll
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"MSVideo"= vfwwdm32.dll
"MSVideo8"= VfWWDM32.dll
"msacm.avis"= ff_acm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\CyberLink\\PowerCinema\\PowerCinema.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\de clerck\\Mes documents\\drivers\\utorrent.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=

R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-11 20:36]
R3 st3bus28;st3bus28;C:\WINDOWS\system32\DRIVERS\st3bus28.sys [2002-12-28 13:16]
R3 st3mp28;st3mp28;C:\WINDOWS\system32\DRIVERS\st3mp28.sys [2002-12-28 13:16]
S3 Boonty Games;Boonty Games;"C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe" [2007-01-14 14:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2041aa23-724f-11db-abbb-001485436900}]
\Shell\AutoRun\command - Installez_Universalis_V10.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4eef6d08-7284-11db-abc1-001485436900}]
\Shell\AutoRun\command - J:\autorun\autorun.exe

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-08-22 04:21:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-04 21:21:11
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-04-04 21:23:04
ComboFix-quarantined-files.txt 2008-04-04 19:23:02
Pre-Run: 130,617,630,720 octets libres
Post-Run: 130,418,053,120 octets libres
.
2008-03-14 20:01:15 --- E O F ---

dou-l · Answer

ok tu vas redemrarer en mode sans échec  

puis tu fait tourner elibagla trois ou quatre fois faut pas hesitez. Et tu poste LES rapports. Je reste jusqu'a 23h30.

Bonne chance

olivier75016 · Answer

au fait, tu m'a demandé de virer le crack, mais comment je fais pour savoir ou il se trouve ?

dou-l · Answer

Ben si y'as emule tu vas dans incoming et tu vire ton fichier que tu as téléchargé 

Fait ce qui est demandé au post 11

olivier75016 · Answer

voici un premier test
malheureusement, ma femme se couche et le pc et dans a chambre
est ce que je peux t'envoyer demain les 3 autres rapports ??


	  Fri Apr 04 22:32:45 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Fri Apr 04 22:32:47 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   6219
Nº Total de Ficheros:      91970
Nº de Ficheros Analizados: 13026
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

dou-l · Answer

Oui tu peux c'est les vacances lol .


à demain et bonne nuit .

olivier75016 · Answer

encore merci et bonne nuit
a demain

olivier75016 · Answer

salut dou

t'es là?
j'avais entamé une autre discussion hier mais personne ne m'aidait et j'ai donc lancé une nouvelle question et je t'ai trouvé
donc je continue avec toi

dou-l · Answer

D'accord 

Fait ca et redemare bien en sans echec !

ok tu vas redemrarer mode sans échec  


puis tu fait tourner elibagla trois ou quatre fois faut pas hesitez. Et tu poste LES rapports. .

olivier75016 · Answer

ok à tout à l'heure

dou-l · Answer

a+.

olivier75016 · Answer

salut me revoila

trouves comme demandé les 4 rapports

rapport 1

	  Sat Apr 05 10:39:34 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sat Apr 05 10:39:46 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   6215
Nº Total de Ficheros:      92083
Nº de Ficheros Analizados: 13026
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0


rapport 2

	  Sat Apr 05 11:41:06 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sat Apr 05 11:41:16 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   6215
Nº Total de Ficheros:      92084
Nº de Ficheros Analizados: 13026
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

rapport 3


	  Sat Apr 05 11:42:49 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sat Apr 05 11:42:52 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   6215
Nº Total de Ficheros:      92085
Nº de Ficheros Analizados: 13026
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0

rapport 4


	  Sat Apr 05 11:44:11 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Acción Directa):

	  Sat Apr 05 11:44:13 2008
EliBagle v11.21  (c)2008 S.G.H. / Satinfo S.L.
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

Nº Total de Directorios:   6215
Nº Total de Ficheros:      92086
Nº de Ficheros Analizados: 13026
Nº de Ficheros Infectados: 0
Nº de Ficheros Limpiados:  0


et voilaaaa

merci et je reste en ligne

dou-l · Answer

T'es sur qu'il sont complet tes rapports ???

Encore des soucis essaye un antivirus (antivir)

olivier75016 · Answer

je viens de télécharger antivir et je fais l'analyse et t'envoie le rapport
a tout à l'heure

dou-l · Answer

Ok

donc ta résussi a installer un antivirus ?

olivier75016 · Answer

ouais celui là tourne
j'attends la fin et je reviens avec le rapport

dou-l · Answer

ok je pense que bagle a était détruit.

olivier75016 · Answer

le scan est en route, il a déjà trouvé deux virus dont le dernier est bagle.gen.b
je l'ai delete
ai je bien fait ou faut il le mettre en quarantaine ???

(pour info j'en suis à 90% de vérifié)

dou-l · Answer

T'as bien fait ;);)

olivier75016 · Answer

voici le rapport de antivir



AntiVir PersonalEdition Classic
Report file date: samedi 5 avril 2008  12:24

Scanning for 1181183 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    DE-CLERCK

Version information:
BUILD.DAT    : 270           15603 Bytes  19/09/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes  23/08/2007 12:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes  16/08/2007 11:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes  14/08/2007 14:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes  21/08/2007 11:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes  18/07/2007 13:27:15
ANTIVIR1.VDF : 7.0.3.2     5447168 Bytes  07/03/2008 10:23:02
ANTIVIR2.VDF : 7.0.3.85     434176 Bytes  27/03/2008 10:23:02
ANTIVIR3.VDF : 7.0.3.121    189952 Bytes  04/04/2008 10:23:02
AVEWIN32.DLL : 7.6.0.81    3424768 Bytes  05/04/2008 10:23:03
AVWINLL.DLL  : 1.0.0.7       14376 Bytes  26/02/2007 09:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes  18/07/2007 06:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes  16/04/2007 12:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes  05/04/2008 10:23:03
AVREG.DLL    : 7.0.1.6       30760 Bytes  18/07/2007 06:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes  28/08/2007 11:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes  18/07/2007 06:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes  08/03/2007 10:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes  07/08/2007 11:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes  21/08/2007 11:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes  23/07/2007 08:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:, 
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: samedi 5 avril 2008  12:24

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'CLSched.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'lanceur.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrB.exe' - '1' Module(s) have been scanned
Scan process 'PnkBstrA.exe' - '1' Module(s) have been scanned
Scan process 'CLMLService.exe' - '1' Module(s) have been scanned
Scan process 'CLMLServer.exe' - '1' Module(s) have been scanned
Scan process 'CLCapSvc.exe' - '1' Module(s) have been scanned
Scan process 'mpbtn.exe' - '1' Module(s) have been scanned
Scan process 'FxSvr2.exe' - '1' Module(s) have been scanned
Scan process 'VeohClient.exe' - '1' Module(s) have been scanned
Scan process 'msmsgs.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'CFD.exe' - '1' Module(s) have been scanned
Scan process 'Corel Photo Downloader.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'qttask.exe' - '1' Module(s) have been scanned
Scan process 'RemoteControlAppl.exe' - '1' Module(s) have been scanned
Scan process 'PCMService.exe' - '1' Module(s) have been scanned
Scan process 'LogiTray.exe' - '1' Module(s) have been scanned
Scan process 'LVCOMSX.EXE' - '1' Module(s) have been scanned
Scan process 'ALCWZRD.EXE' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
48 processes with 48 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '36' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
      [WARNING]   The file could not be opened!
C:\Documents and Settings\de clerck\Mes documents\drivers\jeux\HL2\Steam.dll.bak
      [DETECTION] Contains detection pattern of a probably damaged sample CC/Agent.EU
      [INFO]      The file was deleted!
C:\Muestras\FLEC006.EXE.Muestra EliBagle v11.21
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\Program Files\Panda Security\ActiveScan 2.0\pskavs.dll
      [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738
      [INFO]      The file was deleted!
C:\Program Files\Panda Security\NanoScan\Engine\psnflg.dll
      [DETECTION] Is the Trojan horse TR/Agent.bux.1
      [INFO]      The file was deleted!
C:\Program Files\Satsuki Decoder Pack\wmv\WMVPostpross.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP743\A0110041.exe
      [DETECTION] Contains detection pattern of the dropper DR/MartShop.2
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP776\A0139009.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139050.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139194.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139209.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP777\A0139223.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139329.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139382.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139387.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139551.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139553.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139592.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139614.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139615.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139617.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139623.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139624.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139626.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139631.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139632.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139633.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139635.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139636.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139638.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139640.exe
      [DETECTION] Contains detection pattern of the worm WORM/Bagle.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139646.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139743.exe
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139745.exe
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139746.exe
      [DETECTION] Is the Trojan horse TR/Trash.Gen
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP779\A0139752.exe
      [DETECTION] Is the Trojan horse TR/Bagle.Gen.B
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP780\A0139887.dll
      [DETECTION] Contains detection pattern of the Windows virus W95/Blumblebee.1738
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP780\A0139888.dll
      [DETECTION] Is the Trojan horse TR/Agent.bux.1
      [INFO]      The file was deleted!
C:\System Volume Information\_restore{DCE914EB-FDF3-4F50-80C4-34B2125F4B59}\RP780\A0139889.exe
      [DETECTION] Is the Trojan horse TR/Crypt.CFI.Gen
      [INFO]      The file was deleted!
C:\WINDOWS\system32\drivers\atapi.sys
      [WARNING]   The file could not be opened!
C:\WINDOWS\system32\drivers\sptd.sys
      [WARNING]   The file could not be opened!


End of the scan: samedi 5 avril 2008  13:32
Used time:  1:08:34 min

The scan has been done completely.

   6520 Scanning directories
 336307 Files were scanned
     38 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
     38 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      3 Files cannot be scanned
 336269 Files not concerned
   1920 Archives were scanned
      3 Warnings
     58 Notes

ainsi que le non des virus trouvés
No.   Name   Type Danger Added on   
1.    TR/Agent.249856.B   Trojan   01 Apr 2008     
2.    SPR/AutoIt.Gen   Security Privacy Risk   28 Mar 2008     
3.    TR/BHO.Gen   Trojan   28 Mar 2008     
4.    TR/Dldr.Small.hzj   Trojan   28 Mar 2008     
5.    JS/Dldr.Remora.WB   Malware   28 Mar 2008     
6.    JS/Dldr.Remora.WA   Malware   28 Mar 2008     
7.    Hamburger Sparkasse 1   Phishing   25 Mar 2008     
8.    Worm/Agent.ax   Worm   19 Mar 2008     
9.    EXP/Office.Dropper.Gen   Exploit   19 Mar 2008     
10.    EXP/Excel.CVE-2008-0081   Exploit   19 Mar 2008     
11.    TR/Killav.OE   Trojan   18 Mar 2008     
12.    TR/Dldr.Delf.OKR   Trojan   14 Mar 2008     
13.    DR/Delf.HME   Dropper   14 Mar 2008     
14.    TR/Spy.Delf.BEW   Trojan   14 Mar 2008     
15.    Worm/Hakaglan.B   Worm   14 Mar 2008     
16.    TR/Dldr.Delphi.Gen   Trojan   14 Mar 2008     
17.    Halifax 24   Phishing   08 Mar 2008     
18.    TR/Spy.ZBot.nm   Trojan   04 Mar 2008     
19.    GAME/Dldr.Fenomen.Gen   Malware   03 Mar 2008     
20.    TR/Crypt.TPM.Gen   Trojan   03 Mar 2008     
21.    DR/Agent.HA   Dropper   03 Mar 2008     
22.    Ebay 90   Phishing   02 Mar 2008     
23.    BDS/TOn.A   Backdoor Server   29 Feb 2008     
24.    TR/Click.HTML.IFrame.FP   Trojan   26 Feb 2008     
25.    DR/OneStep.A   Dropper   25 Feb 2008     
26.    SPR/Serv-U.Gen   Security Privacy Risk   15 Feb 2008     
27.    APPL/Serv-U.Gen   Malware   15 Feb 2008     
28.    TR/Agent.90112.G   Trojan   12 Feb 2008     
29.    Chase Bank 64   Phishing   05 Feb 2008     
30.    Chase Bank 63   Phishing   05 Feb 2008     
31.    TR/Dldr.Zlob.KA   Trojan   05 Feb 2008     
32.    TR/Vundo.DWK   Trojan   31 Jan 2008     
33.    TR/VB.AQT   Trojan   29 Jan 2008     
34.    TR/Dldr.Small.JS.1   Trojan   29 Jan 2008     
35.    DR/QuickBatch.Gen   Dropper   25 Jan 2008     
36.    TR/Crypt.MWPM.Gen   Trojan   25 Jan 2008     
37.    Commerce Bank 1   Phishing   24 Jan 2008     
38.    TR/Dldr.Zlob.AATN   Trojan   24 Jan 2008     
39.    TR/Agent.TT   Trojan   24 Jan 2008     
40.    The Royal Bank of Scotland 2   Phishing   09 Jan 2008

dou-l · Answer

Télécharge sur le bureau hijackthis


Fait un clic droit sur l'icone hijackthis.


/!\Renome hijackthis en skim.exe ( a le place de hijacktihs.exe) c'est important!!/!\

*Après avoir fais ca double-clic dessus.

*Clic sur Do a system scan and save the log

*A la fin de l'analyse un rapport va etre générer colle le ici.

Une démo d'hijackthis

olivier75016 · Answer

le voici (c'est rapide)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:05:20, on 05/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\winmine.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: torrent_search toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files	orrent_search	btorr.dll
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bSha1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll (file missing)
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bSha1.dll
O2 - BHO: torrent_search toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files	orrent_search	btorr.dll
O3 - Toolbar: torrent_search toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files	orrent_search	btorr.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Pluginseg\VeohToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [One readme] C:\DOCUME~1\DECLER~1\APPLIC~1\HOLEPH~1\JUNKTONSDASH.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin
pjpi150_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin
pjpi150_03.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h30155.www3.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll,,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

olivier75016 · Answer

dou-l,

je dois aller faire une course je suis de retour dans 1 heure

a tout

dou-l · Answer

Mets a jour JAVA : https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/

Mets a jout IE: https://support.microsoft.com/fr-fr/allproducts



Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 

O4 - HKCU\..\Run: [One readme] C:\DOCUME~1\DECLER~1\APPLIC~1\HOLEPH~1\JUNKTONSDASH.exe
O2 - BHO: ShoppingReport - {100EB1FD-D03E-47FD-81F3-EE91287F9465} - C:\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll (file missing)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {54BE6B6F-3056-470B-97E1-BB92E051B6C4} (DeviceEnum Class) - http://h30155.www3.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab


Installe un pare feu : zone alarm  https://www.malekal.com/tutoriel-zonealarm-firewall/

Reposte un hijackthis et dit tes soucis .

olivier75016 · Answer

re salut,

tu trouveras ci-dessous le rapport demandé
pour me connecter sur internet, j'ai du arreter zonealarm. est ce normal ?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:04:39, on 05/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
C:\Program Files\BroadJump\Client Foundation\CFD.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Club-Internet\Dr Club Internet\bin\mpbtn.exe
C:\Program Files\Club-Internet\Lanceur\lanceur.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.exe
C:\Program Files\OpenOffice.org 2.2\program\soffice.BIN
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://actus.sfr.fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: torrent_search toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files	orrent_search	btorr.dll
R3 - URLSearchHook: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bSha1.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Share Accelerator MM Toolbar - {4596013b-6c31-408b-a266-deae5c086dc2} - C:\Program Files\Share_Accelerator_MM	bSha1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: torrent_search toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files	orrent_search	btorr.dll
O3 - Toolbar: torrent_search toolbar - {f14b0ccd-aa41-4406-ab68-c5de9d85b4a3} - C:\Program Files	orrent_search	btorr.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Pluginseg\VeohToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Club Internet.lnk = C:\Program Files\Club-Internet\Lanceur\lanceur.exe
O4 - Startup: OpenOffice.org 2.2.lnk = C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe
O4 - Global Startup: Docteur Club Internet.lnk = C:\Program Files\Club-Internet\Dr Club Internet\bin\matcli.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\Palm\Hotsync.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.google.fr/?gws_rd=ssl
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - https://sdlc-esd.oracle.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?GroupName=JSC&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&BHost=javadl.sun.com&File=jinstall-6u5-windows-i586-jc.cab&AuthParam=1580944752_ad714b48b0d186f5adbe4ba05260ecbd&ext=.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - https://www.f-secure.com/en/home/support
O20 - AppInit_DLLs:  sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll sockspy.dll,,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

dou-l · Answer

Tu as autorisé l'acces a internet pour zone alarm t'avais un tuto !

Fais analyser ce fichier sur visrus total et colle le rapportr.

C:\WINDOWS\system32\PnkBstrB.exe 

https://www.virustotal.com/gui/

olivier75016 · Answer

désolé mais c'est quoi un tuto ?

dou-l · Answer

un tutoriel pour t'aider : https://www.malekal.com/tutoriel-zonealarm-firewall/

olivier75016 · Answer

c'est çà que tu veux ?

Fichier PnkBstrB.exe reçu le 2008.04.03 00:17:33 (CET)
Situation actuelle: terminé 

Résultat: 0/32 (0.00%)
 Formaté Impression des résultats  
Antivirus Version Dernière mise à jour Résultat 
AhnLab-V3 2008.4.1.2 2008.04.02 - 
AntiVir 7.6.0.80 2008.04.02 - 
Authentium 4.93.8 2008.04.02 - 
Avast 4.7.1098.0 2008.04.02 - 
AVG 7.5.0.516 2008.04.02 - 
BitDefender 7.2 2008.04.03 - 
CAT-QuickHeal 9.50 2008.04.02 - 
ClamAV 0.92.1 2008.04.02 - 
DrWeb 4.44.0.09170 2008.04.02 - 
eSafe 7.0.15.0 2008.04.01 - 
eTrust-Vet 31.3.5666 2008.04.02 - 
Ewido 4.0 2008.04.02 - 
F-Prot 4.4.2.54 2008.04.02 - 
F-Secure 6.70.13260.0 2008.04.02 - 
FileAdvisor 1 2008.04.03 - 
Fortinet 3.14.0.0 2008.04.02 - 
Ikarus T3.1.1.20 2008.04.02 - 
Kaspersky 7.0.0.125 2008.04.03 - 
McAfee 5265 2008.04.02 - 
Microsoft 1.3301 2008.04.01 - 
NOD32v2 2995 2008.04.02 - 
Norman 5.80.02 2008.04.02 - 
Panda 9.0.0.4 2008.04.02 - 
Prevx1 V2 2008.04.03 - 
Rising 20.38.22.00 2008.04.02 - 
Sophos 4.28.0 2008.04.02 - 
Sunbelt 3.0.978.0 2008.03.18 - 
Symantec 10 2008.04.03 - 
TheHacker 6.2.92.262 2008.04.02 - 
VBA32 3.12.6.3 2008.03.25 - 
VirusBuster 4.3.26:9 2008.04.02 - 
Webwasher-Gateway 6.6.2 2008.04.02 - 
Information additionnelle 
File size: 103736 bytes 
MD5: 1428e6cc1458a36cbfc1f2e304c7c42d 
SHA1: 93a5faaf2dafa3d03e80c54cf72891f30e89a997 
PEiD: -

dou-l · Answer

Oui c'est ca encore des problemes?. A l'avenir ne télécharge plus des crack !

COCHE RESOLUE STP C'EST IMPORTANT.

olivier75016 · Answer

ca y est c'est réglé ????

olivier75016 · Answer

genial çà marche

UN GRAND MERCI POUR TON AIDE

dou-l · Answer

du moment ou tu n'as plus de soucis c'est tout bon non ?

dou-l · Answer

pour verifier fait un scan online

bitdefender : ici qu sur internet

si ie fonctionne pas :

scan en ligne firefox : ici

Virus sur win 32

42 réponses

Discussions similaires

Newsletters