Virus msn : album photo suisseRésolu/Fermé

Question

Bonjour,

J'ai chopé le virus msn, pouvez-vous m'aidez s'il vous plaît? J'ai déjà essayé msnfix mais ça n'a pas marché.
Il semble que le virus créé un dossier de sauvegarde dans C:\Documents and Settings mais je ne peux pas les supprimer même en mode sans échecs.

jlpjlp · Answer

slt



Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 
Déroule la liste des instructions ci-dessous : 
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum


_______________________


scan avec 
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 

_________________________


colle un rapport hijackthis 
 

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :
http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo. 

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste 

Ensuite avec Explorer créer un dossier c:\hijackthis 
Décompresser Hijackthis dans ce dossier. 
C'est important pour les sauvegardes."

Hilfy · Answer

Merci d'avoir répondu à mon message.

J'ai un problème c'est que MalwareByte's Anti-Malware ne veut pas s'installer -_-. A chaque installation de composant ca échoue.

Sinon, c'est normal que SDFix soit si long ? (plus de 20 min pour l'analyse)

jlpjlp · Answer

slt,

colle un rapport hijackthis


http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

manuel :
http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm
https://leblogdeclaude.blogspot.com/2006/10/informatique-section-hijackthis.html

Je conseille de renomer Hijackthis, pour contrer une éventuelle infection de Vundo.

ex:Renomme le fichier HijackThis.exe en eden.exe pour cela, fais un clic droit sur le fichier HijackThis.exe et choisis renommer dans la liste

Ensuite avec Explorer créer un dossier c:\hijackthis
Décompresser Hijackthis dans ce dossier.
C'est important pour les sauvegardes."

Hilfy · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:20:18, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" //mailurl:mailto:philippexelor@msn.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4732C995-567F-2BDA-0212-5900CCBCDDBA} - C:\WINDOWS\system32ade.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Flash Media] C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-21-634972920-1104125484-1075201669-1008\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Anna')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/JA-JP/a-UNO1/GAME_UNO1.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

jlpjlp · Answer

refais msnfix et colle le rapport

______________

Télécharge MsnCleaner.zip de ElPiedra et décompresse le sur ton bureau. (Clic droit sur le fichier .zip puis Extraire tout).
Copier l’adresse suivante dans ton lien :
https://forospyware.com
· Redémarre le PC en Mode sans échec et connecte toi sous ton nom d'utilisateur habituel.Pour démarrer en mode sans échec.
· Double-clique sur MsnCleaner.exe pour le lancer.
· Sous Language, clique sur la petite flèche et choisis French.
· Clique sur le bouton Analyse.
· A la fin du scan un rapport va être créé.
· Si l'outil trouve une infection, clique sur le bouton Supprimer.
· Redémarre en mode normal.
· Poste le rapport C:\MsnCleaner.txt dans ta prochaine réponse..


_____________

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.

Hilfy · Answer

En fait, j'ai 2 sessions (la mienne et celle de ma soeur) c'est surtout sur celle de ma soeur que je veux enlever, enfin... au pire je supprime toutes les sessions en je lui en recrée une ^^. Là, je vais poster le rapport MSNFix de mon compte utilisateur :

Hilfy · Answer

MSNFix 1.674  
 
C:\Documents and Settings\Administrateur\Mes documents\MSNFix 
Fix exécuté le 16/04/2008 - 19:53:17,25 By Philippe 
mode normal    
    
************************ Recherche les fichiers présents      
    
... C:\WINDOWS\system32\real.txt 
 
************************ Recherche les dossiers présents       
 
Aucun dossier trouvé 
 
 
 
 
************************ Suppression des fichiers       
    
.. OK ... C:\WINDOWS\system32\real.txt  
 
 
 
************************ Nettoyage du registre 
 
 
 
************************ Fichiers suspects 
 
/!\ ces fichiers nécessitent un avis expérimenté avant toute intervention 
 
[C:\SDFix.exe] C4C4F45777AB50305E5088373CC015A4 
[C:\mbam-setup.exe] CEEA7D2E2243E753D14A81617C525DAB 

[color=#FF0000][b]==>[/b][/color] SVP merci d'envoyer le fichier  [b] C:\DOCUME~1\PHILIP~1.000\Bureau\Upload_Me.zip [/b] sur http://upload.changelog.fr

 
  
Les fichiers et clés de registre supprimés ont été sauvegardés dans le fichier 16042008_19553687.zip
 


------------------------------------------------------------------------  
Auteur : !aur3n7                     Contact: https://www.ionos.fr/     
------------------------------------------------------------------------   
 
---------------------------------------------   END   ---------------------------------------------

Hilfy · Answer

Le seul problème de msnfix c'est qu'il n'enlève le virus que sur la session actuel, ca fait que souvent je dois le faire 3 fois (session Admin, celle de ma soeur et la mienne).

Je vais redémarrer mon ordinateur en mode sans echec.

Merci de ton aide ^^.

Je posterai le rapport msncleaner dans mon prochain message.

Hilfy · Answer

pport MSNCleaner 1.6.2 by www.forospyware.com - Rapport créé: 16/04/2008 on 20:08:29 - Système d'exploitation: Windows XP - Mode de démarrage: Mode sans échec _________________________________________ Fichiers détectés: 0 Fichiers supprimés: 0 Fichiers non supprimés: 0 <<<<<<< Pas de fichiers trouvés >>>>>>>

jlpjlp · Answer

analyse ce fichier sur virus total et si infécté tu le vire:  https://www.virustotal.com/gui/

C:\mbam-setup.exe

_____________

Télécharge Combofix de sUBs : Renomme le avant toute installation, par exemple, nomme le "KillBagle". aide ici : https://forum.pcastuces.com/sujet.asp?f=25&s=37315

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Sauvegarde le sur ton bureau et pas ailleurs !

Aide à l’utilisation de combofix ici: https://bibou0007.forumpro.fr/login?redirect=%2Ft121-topic

Double-clic sur combofix, Il va te poser une question, réponds par la touche 1 et entrée pour valider, laisse toi guider.
Attends que combofix ait terminé, un rapport sera créé. Poste le rapport.
_________
recolle un hijackhtis

Hilfy · Answer

ComboFix 08-04-15.8 - Philippe 2008-04-16 20:39:54.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.543 [GMT 2:00] Endroit: C:\Documents and Settings\Philippe.ANDRE.000\Bureau\KillBagle.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrateur eal.txt C:\Documents and Settings\Anna eal.txt C:\Documents and Settings\Philippe.ANDRE.000 eal.txt C:\Program Files vcoi C:\Program Files vcoi\mst.stt C:\Program Files vcoi vcoi.exe C:\Program Files\outerinfo C:\WINDOWS\Downloaded Program Files\setup.inf C:\WINDOWS\system32\_000006_.tmp.dll . ((((((((((((((((((((((((((((( Fichiers créés 2008-03-16 to 2008-04-16 )))))))))))))))))))))))))))))))))))) . 2008-04-16 20:19 . 2008-04-16 20:19 d--hs---- C:\FOUND.007 2008-04-16 20:08 . 2008-04-16 20:08 d-------- C:\MSNCleaner 2008-04-16 19:35 . 2008-04-16 19:35 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\HP 2008-04-13 22:55 . 2008-04-13 22:55 d-------- C:\WINDOWS\ERUNT 2008-04-13 22:48 . 2008-04-13 22:48 1,546,928 --a------ C:\mbam-setup.exe 2008-04-13 22:45 . 2008-04-12 19:17 d-------- C:\SDFix 2008-04-13 22:43 . 2008-04-13 22:43 1,419,043 --a------ C:\SDFix.exe 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Program Files\QuickTime 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Program Files\Apple Software Update 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-04-12 11:05 . 2008-04-12 11:05 668 --a------ C:\Annulation du rendez-vous (Rise).rtf 2008-04-11 21:05 . 2008-04-11 21:05 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Lavasoft 2008-04-11 10:52 . 2008-04-11 10:52 d--hs---- C:\FOUND.006 2008-04-10 17:03 . 2008-04-10 17:03 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Thunderbird 2008-04-10 15:58 . 2008-04-10 15:58 d-------- C:\Program Files\Mozilla Thunderbird 2008-04-10 15:58 . 2008-04-10 15:58 d-------- C:\Documents and Settings\Anna\Application Data\Thunderbird 2008-04-10 13:10 . 2008-04-10 13:10 d-------- C:\Documents and Settings\Administrateur\Application Data\Talkback 2008-04-09 19:48 . 2008-04-09 19:48 d--hs---- C:\FOUND.005 2008-03-29 11:18 . 2008-03-29 11:18 9,296 --a------ C:\WINDOWS\system32\cvfhvn.exe 2008-03-29 10:45 . 2008-03-29 10:45 d--hs---- C:\FOUND.004 2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx 2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts 2008-03-24 10:22 . 2008-03-24 10:23 9,296 --a------ C:\WINDOWS\system32\urbhkk.exe 2008-03-23 22:39 . 2008-03-23 22:39 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Talkback 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Voisinage réseau 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Voisinage d'impression 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Modèles 2008-03-23 22:21 . 2008-03-23 22:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Mes documents 2008-03-23 22:21 . 2006-05-23 16:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Menu Démarrer 2008-03-23 22:21 . 2008-03-23 22:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Favoris 2008-03-23 22:21 . 2006-05-23 16:22 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Bureau 2008-03-23 22:21 . 2006-05-23 16:43 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\ATI 2008-03-23 22:21 . 2008-03-23 22:21 d-------- C:\Documents and Settings\Philippe.ANDRE.000 2008-03-22 20:42 . 2008-03-22 20:42 d--hs---- C:\FOUND.003 2008-03-21 23:59 . 2008-03-21 23:59 9,296 --a------ C:\WINDOWS\system32\bryefp.exe 2008-03-19 20:52 . 2008-03-19 20:52 9,296 --a------ C:\Documents and Settings\Anna\ggvvea.exe 2008-03-17 20:20 . 2008-03-17 20:20 9,296 --a------ C:\Documents and Settings\Anna\wzxkvv.exe 2008-03-16 12:00 . 2008-03-16 12:00 9,296 --a------ C:\WINDOWS\system32\syieii.exe 2008-03-16 11:47 . 2008-03-16 11:47 9,296 --a------ C:\Documents and Settings\Anna\pmhbdy.exe 2008-03-16 11:41 . 2008-03-16 11:41 9,296 --a------ C:\Documents and Settings\Anna\spwkly.exe 2008-03-16 10:16 . 2008-03-16 10:16 9,296 --a------ C:\Documents and Settings\Anna\hcwtrp.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-16 18:06 90,112 ----a-w C:\WINDOWS\DUMP82c0.tmp 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-15 18:48 --------- d-----w C:\Documents and Settings\Anna\Application Data\Lavasoft 2008-03-14 22:12 9,296 ----a-w C:\WINDOWS\system32\vrneki.exe 2008-03-14 21:58 --------- d-----w C:\Program Files\Fichiers communs\i4j_jres 2008-03-14 21:58 --------- d-----w C:\Program Files\Ankama Games 2008-03-14 21:25 --------- d-----w C:\Documents and Settings\Anna\Application Data\Talkback 2008-03-14 20:47 9,296 ----a-w C:\WINDOWS\system32\dtdpmy.exe 2008-03-14 20:25 9,296 ----a-w C:\WINDOWS\system32\bpecne.exe 2008-03-14 20:15 --------- d-----w C:\Documents and Settings\Anna\Application Data\Grisoft 2008-03-14 20:02 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Lavasoft 2008-03-03 21:20 9,296 ----a-w C:\WINDOWS\system32\pyvjka.exe 2008-03-03 18:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-03 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-03 18:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-03 18:36 --------- d-----w C:\Program Files\Trend Micro 2008-03-02 19:55 9,296 ----a-w C:\WINDOWS\system32\wzvyei.exe 2008-02-29 19:30 --------- d-sh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-02-29 19:29 --------- d-----w C:\Program Files\Windows Live 2008-02-29 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\SET72.tmp 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\SET91.tmp 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\SET78.tmp 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\SET40.tmp 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\SET8C.tmp 2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\SET73.tmp 2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\SET41.tmp 2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\SET8D.tmp 2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\SET74.tmp . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4732C995-567F-2BDA-0212-5900CCBCDDBA}] C:\WINDOWS\system32 ade.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="" [] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 22:35 53248] "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7 tiMUI.exe" [2005-05-11 17:15 45056] "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 16:39 204800] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00 208952] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00 59392] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168] "RTHDCPL"="RTHDCPL.EXE" [2006-06-27 23:54 16248320 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe] "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 12:11 421888] "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946] "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-06-23 06:59 602112] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056] "BisonBar"="C:\WINDOWS\BUtilityBar\BisonBar.exe" [2006-09-08 11:49 245760] "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40 413696] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2006-05-10 13:01 233512] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader eader_sl.exe [2004-12-14 04:44:06 29696] Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-03-27 11:37:58 45056] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe"= "C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Ankama Games\DofusArenaBeta2\DofusArena.exe"= "C:\Program Files\Fichiers communs\i4j_jres\1.6.0\bin\java.exe"= "C:\Program Files\Messenger\MSMSGS.EXE"= "C:\WINDOWS\system32\sessmgr.exe"= "C:\Program Files\Acer\Acer Arcade\PCMService.exe"= "C:\PVSW\Bin\w3dbsmgr.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"= S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys [] S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys [] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 05:00] *Newly Created Service* - CATCHME . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-04-12 09:13:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-16 20:42:00 Windows 5.1.2600 Service Pack 2 FAT NTAPI Balayage processus cachés ... C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe [244] 0x81DE8DA0 Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-04-16 20:42:41 ComboFix-quarantined-files.txt 2008-04-16 18:42:38 Pre-Run: 23,167,500,288 octets libres Post-Run: 23,209,082,880 octets libres . 2008-04-16 17:36:44 --- E O F ---

Hilfy · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:44:48, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Eden.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" //mailurl:mailto:philippexelor@msn.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4732C995-567F-2BDA-0212-5900CCBCDDBA} - C:\WINDOWS\system32ade.dll (file missing)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/JA-JP/a-UNO1/GAME_UNO1.cab
O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Hilfy · Answer

C:\mbam-setup.exe 

c'était un antimalware que j'avais téléchargé mais il n'avait pas fonctionné (bug dans l'installation)

Hilfy · Answer

Le fichier a déjà été analysé:
MD5: 	ceea7d2e2243e753d14a81617c525dab
Date 	2008.04.11 12:08:48 (CET) [>5D]
Résultats 	1/32
Permalink: 	analisis/da0d26bd46b10a7e409bc66f76f334d9


Fichier mbam-setup.exe reçu le 2008.04.11 11:57:42 (CET)
Situation actuelle: terminé
Résultat: 1/32 (3.12%)



Antivirus 	Version 	Dernière mise à jour 	Résultat
AhnLab-V3 	2008.4.10.2 	2008.04.11 	-
AntiVir 	7.6.0.84 	2008.04.11 	-
Authentium 	4.93.8 	2008.04.10 	-
Avast 	4.8.1169.0 	2008.04.11 	-
AVG 	7.5.0.516 	2008.04.10 	-
BitDefender 	7.2 	2008.04.11 	-
CAT-QuickHeal 	9.50 	2008.04.10 	-
ClamAV 	0.92.1 	2008.04.11 	-
DrWeb 	4.44.0.09170 	2008.04.11 	-
eSafe 	7.0.15.0 	2008.04.09 	-
eTrust-Vet 	31.3.5687 	2008.04.10 	-
Ewido 	4.0 	2008.04.10 	-
F-Prot 	4.4.2.54 	2008.04.10 	-
F-Secure 	6.70.13260.0 	2008.04.11 	-
FileAdvisor 	1 	2008.04.11 	-
Fortinet 	3.14.0.0 	2008.04.10 	-
Ikarus 	T3.1.1.26 	2008.04.11 	-
Kaspersky 	7.0.0.125 	2008.04.11 	-
McAfee 	5271 	2008.04.10 	-
Microsoft 	1.3408 	2008.04.11 	-
NOD32v2 	3018 	2008.04.11 	-
Norman 	5.80.02 	2008.04.10 	-
Panda 	9.0.0.4 	2008.04.10 	-
Prevx1 	V2 	2008.04.11 	Heuristic: Suspicious Self Modifying File
Rising 	20.39.32.00 	2008.04.10 	-
Sophos 	4.28.0 	2008.04.11 	-
Sunbelt 	3.0.1032.0 	2008.04.08 	-
Symantec 	10 	2008.04.11 	-
TheHacker 	6.2.92.273 	2008.04.11 	-
VBA32 	3.12.6.4 	2008.04.06 	-
VirusBuster 	4.3.26:9 	2008.04.10 	-
Webwasher-Gateway 	6.6.2 	2008.04.11 	-
Information additionnelle
File size: 1546928 bytes
MD5...: ceea7d2e2243e753d14a81617c525dab
SHA1..: 158f57c5f607eddc3ae816e6378c035751c2af75
SHA256: d51e752509ca1d6ec279f690389a3226254b4373d047628815b45729c31e245f
SHA512: 74f246fe4598790b3a754c211f9aacf2f07356b782c79ec5885fe573861865ec
fdc0758ac5dc79cfb0df2bec65db8067d41313ecde872e7e3576f97a0da1c8a8
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x409a58
timedatestamp.....: 0x2a425e19 (Fri Jun 19 22:22:17 1992)
machinetype.......: 0x14c (I386)

( 8 sections )
name viradd virsiz rawdsiz ntrpy md5
CODE 0x1000 0x9174 0x9200 6.57 ea92e1415bc80e2738e334267ebbb921
DATA 0xb000 0x24c 0x400 2.74 f96da19d2571a42bdff1b9e8bd62ec99
BSS 0xc000 0xe48 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.idata 0xd000 0x950 0xa00 4.43 bb5485bf968b970e5ea81292af2acdba
.tls 0xe000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rdata 0xf000 0x18 0x200 0.20 9ba824905bf9c7922b6fc87a38b74366
.reloc 0x10000 0x8b4 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
.rsrc 0x11000 0x2a00 0x2a00 4.51 b4d37b25cea7b70e718159efb25aa534

( 8 imports )
> kernel32.dll: DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, WideCharToMultiByte, TlsSetValue, TlsGetValue, MultiByteToWideChar, GetModuleHandleA, GetLastError, GetCommandLineA, WriteFile, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetSystemTime, GetFileType, ExitProcess, CreateFileA, CloseHandle
> user32.dll: MessageBoxA
> oleaut32.dll: VariantChangeTypeEx, VariantCopyInd, VariantClear, SysStringLen, SysAllocStringLen
> advapi32.dll: RegQueryValueExA, RegOpenKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA
> kernel32.dll: WriteFile, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, Sleep, SizeofResource, SetLastError, SetFilePointer, SetErrorMode, SetEndOfFile, RemoveDirectoryA, ReadFile, LockResource, LoadResource, LoadLibraryA, IsDBCSLeadByte, GetWindowsDirectoryA, GetVersionExA, GetUserDefaultLangID, GetSystemInfo, GetSystemDefaultLCID, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeProcess, GetEnvironmentVariableA, GetCurrentProcess, GetCommandLineA, GetACP, InterlockedExchange, FormatMessageA, FindResourceA, DeleteFileA, CreateProcessA, CreateFileA, CreateDirectoryA, CloseHandle
> user32.dll: TranslateMessage, SetWindowLongA, PeekMessageA, MsgWaitForMultipleObjects, MessageBoxA, LoadStringA, ExitWindowsEx, DispatchMessageA, DestroyWindow, CreateWindowExA, CallWindowProcA, CharPrevA
> comctl32.dll: InitCommonControls
> advapi32.dll: AdjustTokenPrivileges

( 0 exports )
packers: PE_Patch
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=14A6205AB04CA6059A65177FD347C700C696E8DF

jlpjlp · Answer

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe" //mailurl:mailto:philippexelor@msn.com
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe
O2 - BHO: (no name) - {4732C995-567F-2BDA-0212-5900CCBCDDBA} - C:\WINDOWS\system32ade.dll (file missing)

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/win/ActiveXPlugin.cab


___________________

pour fusionner:

http://img.photobucket.com/albums/v666/sUBs/CFScript.gif


____________________
Ferme tout tes navigateurs (donc copie ou imprime les instructions avant)

Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :






File::
C:\WINDOWS\system32ade.dll
C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe


Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4732C995-567F-2BDA-0212-5900CCBCDDBA}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplicat­ions\List]
"C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe"=-






Enregistre ce fichier sous le nom CFscript


Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

Remets aussi un rapport Hijackthis


Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt


_______________


Fais un clic droit sur ce lien : (IL-MAFIOSO)
http://perso.orange.fr/il.mafioso/Navifix/Navilog1.exe 
Enregistrer la cible (du lien) sous... et enregistre-le sur ton bureau. 
Ensuite double clique sur navilog1.exe pour lancer l'installation. 
Une fois l'installation terminée, le fix s'exécutera automatiquement. 
(Si ce n'est pas le cas, double-clique sur le raccourci Navilog1 présent sur le bureau). 

Laisse-toi guider. Au menu principal, choisis 1 et valides. 
(ne fais pas le choix 2,3 ou 4 sans notre avis/accord) 

Patiente jusqu'au message : 
*** Analyse Termine le ..... *** 
Appuie sur une touche comme demandé, le blocnote va s'ouvrir. 
Copie-colle l'intégralité dans une réponse. Referme le blocnote. 
Le rapport est en outre sauvegardé à la racine du disque (fixnavi.txt)

jlpjlp · Answer

faire le message 15

Hilfy · Answer

ComboFix 08-04-15.8 - Philippe 2008-04-16 21:25:45.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.574 [GMT 2:00] Endroit: C:\Documents and Settings\Philippe.ANDRE.000\Bureau\KillBagle.exe Command switches used :: C:\Documents and Settings\Philippe.ANDRE.000\Bureau\CFScript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe C:\WINDOWS\system32 ade.dll . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\DOCUME~1\Philippe\LOCALS~1\Temp\services.exe C:\Documents and Settings\Philippe.ANDRE.000 eal.txt . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-16 to 2008-04-16 )))))))))))))))))))))))))))))))))))) . 2008-04-16 20:19 . 2008-04-16 20:19 d--hs---- C:\FOUND.007 2008-04-16 20:08 . 2008-04-16 20:08 d-------- C:\MSNCleaner 2008-04-16 19:35 . 2008-04-16 19:35 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\HP 2008-04-13 22:55 . 2008-04-13 22:55 d-------- C:\WINDOWS\ERUNT 2008-04-13 22:48 . 2008-04-13 22:48 1,546,928 --a------ C:\mbam-setup.exe 2008-04-13 22:45 . 2008-04-12 19:17 d-------- C:\SDFix 2008-04-13 22:43 . 2008-04-13 22:43 1,419,043 --a------ C:\SDFix.exe 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Program Files\QuickTime 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Program Files\Apple Software Update 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-04-12 11:05 . 2008-04-12 11:05 668 --a------ C:\Annulation du rendez-vous (Rise).rtf 2008-04-11 21:05 . 2008-04-11 21:05 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Lavasoft 2008-04-11 10:52 . 2008-04-11 10:52 d--hs---- C:\FOUND.006 2008-04-10 17:03 . 2008-04-10 17:03 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Thunderbird 2008-04-10 15:58 . 2008-04-10 15:58 d-------- C:\Program Files\Mozilla Thunderbird 2008-04-10 15:58 . 2008-04-10 15:58 d-------- C:\Documents and Settings\Anna\Application Data\Thunderbird 2008-04-10 13:10 . 2008-04-10 13:10 d-------- C:\Documents and Settings\Administrateur\Application Data\Talkback 2008-04-09 19:48 . 2008-04-09 19:48 d--hs---- C:\FOUND.005 2008-03-29 11:18 . 2008-03-29 11:18 9,296 --a------ C:\WINDOWS\system32\cvfhvn.exe 2008-03-29 10:45 . 2008-03-29 10:45 d--hs---- C:\FOUND.004 2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx 2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts 2008-03-24 10:22 . 2008-03-24 10:23 9,296 --a------ C:\WINDOWS\system32\urbhkk.exe 2008-03-23 22:39 . 2008-03-23 22:39 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Talkback 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Voisinage r‚seau 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Voisinage d'impression 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\ModŠles 2008-03-23 22:21 . 2008-03-23 22:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Mes documents 2008-03-23 22:21 . 2006-05-23 16:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Menu D‚marrer 2008-03-23 22:21 . 2008-03-23 22:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Favoris 2008-03-23 22:21 . 2006-05-23 16:22 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Bureau 2008-03-23 22:21 . 2006-05-23 16:43 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\ATI 2008-03-23 22:21 . 2008-03-23 22:21 d-------- C:\Documents and Settings\Philippe.ANDRE.000 2008-03-22 20:42 . 2008-03-22 20:42 d--hs---- C:\FOUND.003 2008-03-21 23:59 . 2008-03-21 23:59 9,296 --a------ C:\WINDOWS\system32\bryefp.exe 2008-03-19 20:52 . 2008-03-19 20:52 9,296 --a------ C:\Documents and Settings\Anna\ggvvea.exe 2008-03-17 20:20 . 2008-03-17 20:20 9,296 --a------ C:\Documents and Settings\Anna\wzxkvv.exe 2008-03-16 12:00 . 2008-03-16 12:00 9,296 --a------ C:\WINDOWS\system32\syieii.exe 2008-03-16 11:47 . 2008-03-16 11:47 9,296 --a------ C:\Documents and Settings\Anna\pmhbdy.exe 2008-03-16 11:41 . 2008-03-16 11:41 9,296 --a------ C:\Documents and Settings\Anna\spwkly.exe 2008-03-16 10:16 . 2008-03-16 10:16 9,296 --a------ C:\Documents and Settings\Anna\hcwtrp.exe . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-16 18:06 90,112 ----a-w C:\WINDOWS\DUMP82c0.tmp 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-15 18:48 --------- d-----w C:\Documents and Settings\Anna\Application Data\Lavasoft 2008-03-14 22:12 9,296 ----a-w C:\WINDOWS\system32\vrneki.exe 2008-03-14 21:58 --------- d-----w C:\Program Files\Fichiers communs\i4j_jres 2008-03-14 21:58 --------- d-----w C:\Program Files\Ankama Games 2008-03-14 21:25 --------- d-----w C:\Documents and Settings\Anna\Application Data\Talkback 2008-03-14 20:47 9,296 ----a-w C:\WINDOWS\system32\dtdpmy.exe 2008-03-14 20:25 9,296 ----a-w C:\WINDOWS\system32\bpecne.exe 2008-03-14 20:15 --------- d-----w C:\Documents and Settings\Anna\Application Data\Grisoft 2008-03-14 20:02 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Lavasoft 2008-03-03 21:20 9,296 ----a-w C:\WINDOWS\system32\pyvjka.exe 2008-03-03 18:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-03 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-03 18:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-03 18:36 --------- d-----w C:\Program Files\Trend Micro 2008-03-02 19:55 9,296 ----a-w C:\WINDOWS\system32\wzvyei.exe 2008-02-29 19:30 --------- d-sh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-02-29 19:29 --------- d-----w C:\Program Files\Windows Live 2008-02-29 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\SET72.tmp 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\SET91.tmp 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\SET78.tmp 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\SET40.tmp 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\SET8C.tmp 2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\SET73.tmp 2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\SET41.tmp 2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\SET8D.tmp 2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\SET74.tmp . ((((((((((((((((((((((((((((( snapshot@2008-04-16_20.42.18,43 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-16 18:28:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-16 19:29:40 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-16 19:29:44 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_598.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="" [] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 22:35 53248] "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7 tiMUI.exe" [2005-05-11 17:15 45056] "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 16:39 204800] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00 208952] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00 59392] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168] "RTHDCPL"="RTHDCPL.EXE" [2006-06-27 23:54 16248320 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe] "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 12:11 421888] "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946] "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-06-23 06:59 602112] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056] "BisonBar"="C:\WINDOWS\BUtilityBar\BisonBar.exe" [2006-09-08 11:49 245760] "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40 413696] "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2006-05-10 13:01 233512] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Ankama Games\DofusArenaBeta2\DofusArena.exe"= "C:\Program Files\Fichiers communs\i4j_jres\1.6.0\bin\java.exe"= "C:\Program Files\Messenger\MSMSGS.EXE"= "C:\WINDOWS\system32\sessmgr.exe"= "C:\Program Files\Acer\Acer Arcade\PCMService.exe"= "C:\PVSW\Bin\w3dbsmgr.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"= S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys [] S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys [] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 05:00] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' "2008-04-12 09:13:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-16 21:30:09 Windows 5.1.2600 Service Pack 2 FAT NTAPI Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE C:\ACER\EMPOWERING TECHNOLOGY\EPERFORMANCE\MEMCHECK.EXE C:\PROGRAM FILES\ANTIVIR PERSONALEDITION CLASSIC\SCHED.EXE C:\PROGRAM FILES\ANTIVIR PERSONALEDITION CLASSIC\AVGUARD.EXE C:\PROGRAM FILES\FICHIERS COMMUNS\LIGHTSCRIBE\LSSRVC.EXE C:\WINDOWS\SYSTEM32\HPZIPM12.EXE C:\PROGRAM FILES\CYBERLINK\SHARED FILES\RICHVIDEO.EXE C:\WINDOWS\SYSTEM32\ATI2EVXX.EXE C:\PROGRAM FILES\FICHIERS COMMUNS\ULEAD SYSTEMS\DVD\ULCDRSVR.EXE C:\WINDOWS\SYSTEM32\WSCNTFY.EXE C:\WINDOWS\SYSTEM32\WBEM\WMIAPSRV.EXE C:\PROGRAM FILES\LAUNCH MANAGER\LMANAGER.EXE C:\WINDOWS\SYSTEM32\WBEM\UNSECAPP.EXE C:\PROGRAM FILES\HP\DIGITAL IMAGING\BIN\HPQTRA08.EXE . ************************************************************************** . Temps d'accomplissement: 2008-04-16 21:32:20 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-16 19:32:12 ComboFix2.txt 2008-04-16 18:42:44 Pre-Run: 23,234,412,544 octets libres Post-Run: 23,215,243,264 octets libres . 2008-04-16 17:36:44 --- E O F ---

Hilfy · Answer

Je refais un rapport HiJackThis au cas où

Hilfy · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:35:30, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Eden.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/JA-JP/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Hilfy · Answer

Search Navipromo version 3.5.4 commencé le 16/04/2008 à 21:39:31,64

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Philippe" 

Mise à jour le 15.04.2008 à 18h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 
Système de fichiers : FAT32

Executé en mode normal

*** Recherche Programmes installés ***




*** Recherche dossiers dans "C:\WINDOWS" ***



*** Recherche dossiers dans "C:\Program Files" ***



*** Recherche dossiers dans "C:\DOCUME~1\ALLUSE~1\APPLIC~1" ***




*** Recherche dossiers dans "C:\Documents and Settings\Philippe.ANDRE.000\applic~1" *** 



*** Recherche dossiers dans "C:\Documents and Settings\Philippe.ANDRE.000\locals~1\applic~1" *** 



*** Recherche dossiers dans "C:\Documents and Settings\Philippe.ANDRE.000\menud+~1\progra~1" *** 


*** Recherche dossiers dans "C:\DOCUME~1\ALLUSE~1\MENUD?~1\PROGRA~1" ***


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net

Aucun Fichier trouvé



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Philippe.ANDRE.000\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" * 

* Recherche dans "C:\DOCUME~1\ANNA\locals~1\applic~1" * 



*** Recherche fichiers *** 




*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Philippe.ANDRE.000\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\ADMINI~1\locals~1\applic~1" : 


* Dans "C:\DOCUME~1\ANNA\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :



*** Analyse terminée le 16/04/2008 à 21:40:54,23 ***

jlpjlp · Answer

ok il a été viré

____
supprime navilog via ton panneau de configuration
_________


analyse ces fichier sur virus total et dis moi lesquels sont inféctés: https://www.virustotal.com/gui/

C:\WINDOWS\system32\bryefp.exe
C:\Documents and Settings\Anna\ggvvea.exe
C:\Documents and Settings\Anna\wzxkvv.exe
C:\WINDOWS\system32\syieii.exe
C:\Documents and Settings\Anna\pmhbdy.exe
C:\Documents and Settings\Anna\spwkly.exe
C:\Documents and Settings\Anna\hcwtrp.exe
C:\WINDOWS\system32\dtdpmy.exe
C:\WINDOWS\system32\bpecne.exe
 C:\WINDOWS\system32\pyvjka.exe
C:\WINDOWS\system32\wzvyei.exe 

___________



scan avec 
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/ 



a plus







rq:
pour protéger gratos ton ordi

http://www.commentcamarche.net/telecharger/logiciel 4 securite

mettre un antivirus

AVAST en français   ou ANTIVIR (en anglais mais très efficace)
https://www.malekal.com/avira-free-security-antivirus-gratuit/ (merci Malekal)
-------------
des anti-espions :
MalwareByte's Anti-Malware + SPYBOT +/-    si tea timer non active de spybot: 
 WINDOWS    DEFENDER ou  SPYWARE TERMINATOR

+
SPYWAREBLASTER pour immuniser le système contre vundo notamment mais en anglais (mais facile d'utilisation  : il suffit de faire "update" pour mettre à jour tous les mois  et ensuite" enable all protection" pour immuniser)...

Rq : spybot et ad-aware ont sorti de nouvelles versions cette année vérifiez que vous avez la dernière version 
--------
un pare feu :
celui de (Windows) ou mieux Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) 

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

 https://forum.pcastuces.com/sujet.asp?f=25&s=35606 
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
http://www.commentcamarche.net/telecharger/telecharger 157 zonealarm

-----------
CCLEANER pour effacer les traces de surf
---------
naviguer avec firefox ou safari ou opera et non internet explorer plus  touché par les virus
http://www.mozilla-europe.org/fr/products/firefox/

Hilfy · Answer

et je fais comment pour les autres sessions? est-ce qu'elles sont infectées aussi?

Hilfy · Answer

A chaque fois que je tente de l'analyser avec virus total :

Il y a Avira Antivir Classic Edition qui le bloque car il dit que c'est un virus (j'ai cliqué sur deny access)

0 bytes size received / Se ha recibido un archivo vacio

Hilfy · Answer

En fait, je crois que ce sont des virus car Avira fait que d'apparaitre XD

jlpjlp · Answer

désactive antivir le temps des scan sur virus total

Hilfy · Answer

OK merci ^^, et pour les logiciels que j'ai installé pour supprimer ce virus (ex : MalwareByte's) je les supprime?

et y'a y risque que les autres sessions soit infectées? (je vais faire une analyse msnfix)

jlpjlp · Answer

les fichiers considérés comme inféctés tu les mets dans la citation otmovit


______________

télécharge OTMoveIt 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau.  Ou sur  https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer. 
copie la liste qui se trouve en citation ci-dessous, 
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved. 

Citation : 




clique sur MoveIt! pour lancer la suppression. 
le résultat apparaitra dans le cadre "Results". 
clique sur Exit pour fermer. 
poste le rapport situé dans C:\_OTMoveIt\MovedFiles. 

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes. 

______________

puis


scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/



a plus

Hilfy · Answer

MalwareByte's Anti-Malware me demande toujours le fichier HPPhotoSmartExpress via un CD et quand j'annule je vois la barre de chargement revenir en arrière, est-ce normal?

Hilfy · Answer

Fichier uitira.exe reçu le 2008.04.15 10:36:26 (CET)
Situation actuelle: terminé
Résultat: 27/31 (87.10%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
AhnLab-V3 	2008.4.15.1 	2008.04.15 	Win-Trojan/Downloader.9296.G
AntiVir 	7.6.0.85 	2008.04.15 	TR/Crypt.ULPM.Gen
Authentium 	4.93.8 	2008.04.14 	-
Avast 	4.8.1169.0 	2008.04.15 	Win32:Small-JMH
AVG 	7.5.0.516 	2008.04.14 	Downloader.Generic7.GT
BitDefender 	7.2 	2008.04.15 	Trojan.Retapu.D
CAT-QuickHeal 	9.50 	2008.04.14 	TrojanDownloader.Small.sth
ClamAV 	0.92.1 	2008.04.15 	Trojan.Retapu-2
DrWeb 	4.44.0.09170 	2008.04.15 	Trojan.DownLoader.50051
eSafe 	7.0.15.0 	2008.04.09 	Win32.Small.sth
eTrust-Vet 	31.3.5700 	2008.04.15 	-
Ewido 	4.0 	2008.04.14 	Downloader.Small.sth
F-Prot 	4.4.2.54 	2008.04.14 	-
F-Secure 	6.70.13260.0 	2008.04.15 	Trojan-Downloader.Win32.Small.sth
FileAdvisor 	1 	2008.04.15 	High threat detected
Fortinet 	3.14.0.0 	2008.04.15 	W32/Dloader.O!tr
Ikarus 	T3.1.1.26 	2008.04.15 	Virus.Win32.Small.JMH
Kaspersky 	7.0.0.125 	2008.04.15 	Trojan-Downloader.Win32.Small.sth
McAfee 	5273 	2008.04.14 	Generic Downloader.ab
Microsoft 	1.3408 	2008.04.14 	TrojanDownloader:Win32/Matcash.B
NOD32v2 	3026 	2008.04.14 	a variant of Win32/TrojanDownloader.Small.IAW
Norman 	5.80.02 	2008.04.14 	W32/DLoader.GBIX
Panda 	9.0.0.4 	2008.04.14 	Trj/Downloader.SZG
Prevx1 	V2 	2008.04.15 	Downloader.Generic7.GT
Rising 	20.40.02.00 	2008.04.14 	Trojan.Win32.Direct.a
Sophos 	4.28.0 	2008.04.15 	Mal/DownLdr-O
Sunbelt 	3.0.1041.0 	2008.04.12 	WaveRevenue-McBoo
TheHacker 	6.2.92.277 	2008.04.14 	Trojan/Downloader.Small.sth
VBA32 	3.12.6.4 	2008.04.14 	Trojan-Downloader.Win32.Small.sth
VirusBuster 	4.3.26:9 	2008.04.14 	-
Webwasher-Gateway 	6.6.2 	2008.04.15 	Trojan.Crypt.ULPM.Gen
Information additionnelle
File size: 9296 bytes
MD5...: bd836c0c5645b27c7323b59544021240
SHA1..: 5b874438b8a5db3383617612ef452ebd5258432f
SHA256: 734c0c87a713ab217546210765d27100d2601275c246b9c003ab587e4adeb8c1
SHA512: 8dcbbceb118d04582e55a36c7f92af04106ab7873e7b259c109b241220b10a4a
00f6fd773428f0575a5f67c486a2ce5b4d7dd99f4a4727403e25b66bb42e9fe3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40f8ed
timedatestamp.....: 0x47d565d1 (Mon Mar 10 16:46:09 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
WSrT 0x1000 0xd000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
WSrT 0xe000 0x2000 0x1a00 7.78 32a78ec7bdd41e49581c9318df5a113e
.rsrc 0x10000 0x1000 0x600 2.93 16fad880dfb960b96970d32bf14d42f9

( 6 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> ADVAPI32.dll: RegCloseKey
> MFC42.DLL: -
> MSVCRT.dll: free
> SHELL32.dll: ShellExecuteA
> USER32.dll: wsprintfA

( 0 exports )
packers: UPX
packers: UPX
Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=bd836c0c5645b27c7323b59544021240
packers: UPX
packers: PE_Patch.Upolyx, PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=67482D37504B8CEB242B00A30B2E060071CE0B24

Hilfy · Answer

Fichier uitira.exe reçu le 2008.04.15 10:36:26 (CET)
Situation actuelle: terminé
Résultat: 27/31 (87.10%)
Formaté Formaté
Impression des résultats Impression des résultats
Antivirus 	Version 	Dernière mise à jour 	Résultat
AhnLab-V3 	2008.4.15.1 	2008.04.15 	Win-Trojan/Downloader.9296.G
AntiVir 	7.6.0.85 	2008.04.15 	TR/Crypt.ULPM.Gen
Authentium 	4.93.8 	2008.04.14 	-
Avast 	4.8.1169.0 	2008.04.15 	Win32:Small-JMH
AVG 	7.5.0.516 	2008.04.14 	Downloader.Generic7.GT
BitDefender 	7.2 	2008.04.15 	Trojan.Retapu.D
CAT-QuickHeal 	9.50 	2008.04.14 	TrojanDownloader.Small.sth
ClamAV 	0.92.1 	2008.04.15 	Trojan.Retapu-2
DrWeb 	4.44.0.09170 	2008.04.15 	Trojan.DownLoader.50051
eSafe 	7.0.15.0 	2008.04.09 	Win32.Small.sth
eTrust-Vet 	31.3.5700 	2008.04.15 	-
Ewido 	4.0 	2008.04.14 	Downloader.Small.sth
F-Prot 	4.4.2.54 	2008.04.14 	-
F-Secure 	6.70.13260.0 	2008.04.15 	Trojan-Downloader.Win32.Small.sth
FileAdvisor 	1 	2008.04.15 	High threat detected
Fortinet 	3.14.0.0 	2008.04.15 	W32/Dloader.O!tr
Ikarus 	T3.1.1.26 	2008.04.15 	Virus.Win32.Small.JMH
Kaspersky 	7.0.0.125 	2008.04.15 	Trojan-Downloader.Win32.Small.sth
McAfee 	5273 	2008.04.14 	Generic Downloader.ab
Microsoft 	1.3408 	2008.04.14 	TrojanDownloader:Win32/Matcash.B
NOD32v2 	3026 	2008.04.14 	a variant of Win32/TrojanDownloader.Small.IAW
Norman 	5.80.02 	2008.04.14 	W32/DLoader.GBIX
Panda 	9.0.0.4 	2008.04.14 	Trj/Downloader.SZG
Prevx1 	V2 	2008.04.15 	Downloader.Generic7.GT
Rising 	20.40.02.00 	2008.04.14 	Trojan.Win32.Direct.a
Sophos 	4.28.0 	2008.04.15 	Mal/DownLdr-O
Sunbelt 	3.0.1041.0 	2008.04.12 	WaveRevenue-McBoo
TheHacker 	6.2.92.277 	2008.04.14 	Trojan/Downloader.Small.sth
VBA32 	3.12.6.4 	2008.04.14 	Trojan-Downloader.Win32.Small.sth
VirusBuster 	4.3.26:9 	2008.04.14 	-
Webwasher-Gateway 	6.6.2 	2008.04.15 	Trojan.Crypt.ULPM.Gen
Information additionnelle
File size: 9296 bytes
MD5...: bd836c0c5645b27c7323b59544021240
SHA1..: 5b874438b8a5db3383617612ef452ebd5258432f
SHA256: 734c0c87a713ab217546210765d27100d2601275c246b9c003ab587e4adeb8c1
SHA512: 8dcbbceb118d04582e55a36c7f92af04106ab7873e7b259c109b241220b10a4a
00f6fd773428f0575a5f67c486a2ce5b4d7dd99f4a4727403e25b66bb42e9fe3
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40f8ed
timedatestamp.....: 0x47d565d1 (Mon Mar 10 16:46:09 2008)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
WSrT 0x1000 0xd000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
WSrT 0xe000 0x2000 0x1a00 7.78 32a78ec7bdd41e49581c9318df5a113e
.rsrc 0x10000 0x1000 0x600 2.93 16fad880dfb960b96970d32bf14d42f9

( 6 imports )
> KERNEL32.DLL: LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
> ADVAPI32.dll: RegCloseKey
> MFC42.DLL: -
> MSVCRT.dll: free
> SHELL32.dll: ShellExecuteA
> USER32.dll: wsprintfA

( 0 exports )
packers: UPX
packers: UPX
Bit9 info: http://fileadvisor.bit9.com/services/extinfo.aspx?md5=bd836c0c5645b27c7323b59544021240
packers: UPX
packers: PE_Patch.Upolyx, PE_Patch.UPX, UPX
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=67482D37504B8CEB242B00A30B2E060071CE0B24

ATENTION ATTENTION: VirusTotal iest un service gratuit offert par Hispasec Sistemas. Il n'y a aucune garantie quant à la disponibilité et la continuité de ce service. Bien que le taux de détection permis par l'utilisation de multiples moteurs antivirus soit bien supérieur à celui offert par seulement un produit, ces résultats NE garantissent PAS qu'un fichier est sans danger. Il n'y a actuellement aucune solution qui offre un taux d'efficacité de 100% pour la détection des virus et malwares.

jlpjlp · Answer

les fichiers considérés comme inféctés tu les mets dans la citation otmovit


______________

télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :




clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.

______________

puis


scan avec
MalwareByte's Anti-Malware et vire ce qui est trouvé et colle le rapport

https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

________________

et recolle un combofix et hijackhtis 

a plus

Hilfy · Answer

Dans C:\Documents and Settings\

Il y a :
-Administrateur
-All user
-Anna (session de ma soeur)
-Philippe.ANDRE.000 (qui contient les éléments de ma session)
-Philippe (qui est quasi-ment vide et impossible à supprimer)

Je dois faire quoi, s'il vous plaît?

Hilfy · Answer

Malwarebytes' Anti-Malware 1.11
Version de la base de données: 636

Type de recherche: Examen rapide
Eléments examinés: 34641
Temps écoulé: 15 minute(s), 7 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Hilfy · Answer

C:\WINDOWS\system32\bryefp.exe moved successfully.
C:\Documents and Settings\Anna\ggvvea.exe moved successfully.
C:\Documents and Settings\Anna\wzxkvv.exe moved successfully.
C:\WINDOWS\system32\syieii.exe moved successfully.
C:\Documents and Settings\Anna\pmhbdy.exe moved successfully.
C:\Documents and Settings\Anna\spwkly.exe moved successfully.
C:\Documents and Settings\Anna\hcwtrp.exe moved successfully.
C:\WINDOWS\system32\dtdpmy.exe moved successfully.
C:\WINDOWS\system32\bpecne.exe moved successfully.
C:\WINDOWS\system32\pyvjka.exe moved successfully.
C:\WINDOWS\system32\wzvyei.exe moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04162008_223521

jlpjlp · Answer

a plus

Hilfy · Answer

ComboFix 08-04-15.8 - Philippe 2008-04-16 22:42:36.3 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.33.1036.18.588 [GMT 2:00] Endroit: C:\HELP\KillBagle.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . ((((((((((((((((((((((((((((( Fichiers créés 2008-03-16 to 2008-04-16 )))))))))))))))))))))))))))))))))))) . 2008-04-16 22:38 . 2008-04-16 22:38 d-------- C:\HELP 2008-04-16 22:35 . 2008-04-16 22:35 d-------- C:\_OTMoveIt 2008-04-16 21:58 . 2008-04-16 21:58 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Malwarebytes 2008-04-16 21:57 . 2008-04-16 21:57 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-04-16 21:57 . 2008-04-16 21:57 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-04-16 21:47 . 2008-04-16 21:48 d-------- C:\Program Files\Avira 2008-04-16 21:47 . 2008-04-16 21:48 d-------- C:\Documents and Settings\All Users\Application Data\Avira 2008-04-16 21:37 . 2008-04-16 21:37 d-------- C:\Program Files\Navilog1 2008-04-16 20:19 . 2008-04-16 20:19 d--hs---- C:\FOUND.007 2008-04-16 20:08 . 2008-04-16 20:08 d-------- C:\MSNCleaner 2008-04-16 19:35 . 2008-04-16 19:35 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\HP 2008-04-16 19:20 . 2008-04-16 19:20 d-------- C:\HiJackThis 2008-04-13 22:55 . 2008-04-13 22:55 d-------- C:\WINDOWS\ERUNT 2008-04-13 22:48 . 2008-04-13 22:48 1,546,928 --a------ C:\mbam-setup.exe 2008-04-13 22:45 . 2008-04-12 19:17 d-------- C:\SDFix 2008-04-13 22:43 . 2008-04-13 22:43 1,419,043 --a------ C:\SDFix.exe 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Program Files\QuickTime 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Program Files\Apple Software Update 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-04-12 11:13 . 2008-04-12 11:13 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-04-12 11:05 . 2008-04-12 11:05 668 --a------ C:\Annulation du rendez-vous (Rise).rtf 2008-04-11 21:05 . 2008-04-11 21:05 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Lavasoft 2008-04-11 10:52 . 2008-04-11 10:52 d--hs---- C:\FOUND.006 2008-04-10 17:03 . 2008-04-10 17:03 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Thunderbird 2008-04-10 15:58 . 2008-04-10 15:58 d-------- C:\Program Files\Mozilla Thunderbird 2008-04-10 15:58 . 2008-04-10 15:58 d-------- C:\Documents and Settings\Anna\Application Data\Thunderbird 2008-04-10 13:10 . 2008-04-10 13:10 d-------- C:\Documents and Settings\Administrateur\Application Data\Talkback 2008-04-09 19:48 . 2008-04-09 19:48 d--hs---- C:\FOUND.005 2008-03-29 11:18 . 2008-03-29 11:18 9,296 --a------ C:\WINDOWS\system32\cvfhvn.exe 2008-03-29 10:45 . 2008-03-29 10:45 d--hs---- C:\FOUND.004 2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx 2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts 2008-03-24 10:22 . 2008-03-24 10:23 9,296 --a------ C:\WINDOWS\system32\urbhkk.exe 2008-03-23 22:39 . 2008-03-23 22:39 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\Talkback 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Voisinage réseau 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Voisinage d'impression 2008-03-23 22:21 . 2006-05-23 16:22 d--h----- C:\Documents and Settings\Philippe.ANDRE.000\Modèles 2008-03-23 22:21 . 2008-03-23 22:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Mes documents 2008-03-23 22:21 . 2006-05-23 16:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Menu Démarrer 2008-03-23 22:21 . 2008-03-23 22:22 dr------- C:\Documents and Settings\Philippe.ANDRE.000\Favoris 2008-03-23 22:21 . 2006-05-23 16:22 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Bureau 2008-03-23 22:21 . 2006-05-23 16:43 d-------- C:\Documents and Settings\Philippe.ANDRE.000\Application Data\ATI 2008-03-23 22:21 . 2008-03-23 22:21 d-------- C:\Documents and Settings\Philippe.ANDRE.000 2008-03-22 20:42 . 2008-03-22 20:42 d--hs---- C:\FOUND.003 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-16 18:06 90,112 ----a-w C:\WINDOWS\DUMP82c0.tmp 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-20 08:09 1,845,376 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys 2008-03-15 18:48 --------- d-----w C:\Documents and Settings\Anna\Application Data\Lavasoft 2008-03-14 22:12 9,296 ----a-w C:\WINDOWS\system32\vrneki.exe 2008-03-14 21:58 --------- d-----w C:\Program Files\Fichiers communs\i4j_jres 2008-03-14 21:58 --------- d-----w C:\Program Files\Ankama Games 2008-03-14 21:25 --------- d-----w C:\Documents and Settings\Anna\Application Data\Talkback 2008-03-14 20:15 --------- d-----w C:\Documents and Settings\Anna\Application Data\Grisoft 2008-03-14 20:02 --------- d-----w C:\Documents and Settings\Administrateur\Application Data\Lavasoft 2008-03-03 18:50 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-03-03 18:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-03 18:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-03 18:36 --------- d-----w C:\Program Files\Trend Micro 2008-02-29 19:30 --------- d-sh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller 2008-02-29 19:29 --------- d-----w C:\Program Files\Windows Live 2008-02-29 19:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\SET72.tmp 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\dllcache\gdi32.dll 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\SET91.tmp 2008-02-20 06:51 282,624 ------w C:\WINDOWS\system32\SET78.tmp 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\SET40.tmp 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-20 05:35 45,568 ----a-w C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\SET8C.tmp 2008-02-20 05:35 45,568 ------w C:\WINDOWS\system32\SET73.tmp 2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\SET41.tmp 2008-02-20 05:35 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\SET8D.tmp 2008-02-20 05:35 148,992 ------w C:\WINDOWS\system32\SET74.tmp . ((((((((((((((((((((((((((((( snapshot@2008-04-16_20.42.18,43 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-16 18:28:06 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-16 19:45:38 2,048 --s-a-w C:\WINDOWS\bootstat.dat - 2006-02-23 16:17:22 32,768 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys + 2008-01-21 16:12:58 41,792 ----a-w C:\WINDOWS\system32\drivers\avgntdd.sys - 2005-07-04 10:58:48 14,848 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys + 2008-01-21 16:11:30 22,336 ----a-w C:\WINDOWS\system32\drivers\avgntmgr.sys + 2008-03-04 11:28:54 79,424 ----a-w C:\WINDOWS\system32\drivers\avipbb.sys + 2007-03-01 08:34:22 28,352 ----a-w C:\WINDOWS\system32\drivers\ssmdrv.sys + 2008-04-16 19:46:16 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_1b0.dat + 2008-04-16 19:45:42 16,384 ----a-w C:\WINDOWS\Temp\Perflib_Perfdata_594.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 05:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "LaunchApp"="" [] "AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2006-04-14 22:35 53248] "ntiMUI"="C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7 tiMUI.exe" [2005-05-11 17:15 45056] "Acer ePresentation HPD"="C:\Acer\Empowering Technology\ePresentation\ePresentation.exe" [2006-03-31 16:39 204800] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-05 05:00 208952] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 05:00 59392] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 05:00 455168] "RTHDCPL"="RTHDCPL.EXE" [2006-06-27 23:54 16248320 C:\WINDOWS\RTHDCPL.exe] "SkyTel"="SkyTel.EXE" [2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe] "ePower_DMC"="C:\Acer\Empowering Technology\ePower\ePower_DMC.exe" [2006-05-30 12:11 421888] "Boot"="C:\Acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 22:12 579584] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 13:07 761946] "LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2006-06-23 06:59 602112] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056] "BisonBar"="C:\WINDOWS\BUtilityBar\BisonBar.exe" [2006-09-08 11:49 245760] "eRecoveryService"="C:\Acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-06-01 14:40 413696] "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 02:41 49152] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 05:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Acer Empowering Technology.lnk - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2006-03-27 11:37:58 45056] HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\Windows Live\Messenger\MSNMSGR.EXE"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Ankama Games\DofusArenaBeta2\DofusArena.exe"= "C:\Program Files\Fichiers communs\i4j_jres\1.6.0\bin\java.exe"= "C:\Program Files\Messenger\MSMSGS.EXE"= "C:\WINDOWS\system32\sessmgr.exe"= "C:\Program Files\Acer\Acer Arcade\PCMService.exe"= "C:\PVSW\Bin\w3dbsmgr.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"= "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"= "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"= S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;C:\WINDOWS\system32\eLock2BurnerLockDriver.sys [] S2 eLock2FSCTLDriver;eLock2FSCTLDriver;C:\WINDOWS\system32\eLock2FSCTLDriver.sys [] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58] S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-05 05:00] *Newly Created Service* - ANTIVIRSCHEDULER *Newly Created Service* - ANTIVIRSERVICE *Newly Created Service* - AVIPBB . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-04-12 09:13:26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-16 22:44:41 Windows 5.1.2600 Service Pack 2 FAT NTAPI Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-04-16 22:45:23 ComboFix-quarantined-files.txt 2008-04-16 20:45:20 ComboFix3.txt 2008-04-16 18:42:44 ComboFix2.txt 2008-04-16 19:32:22 Pre-Run: 23,060,021,248 octets libres Post-Run: 23,053,434,880 octets libres . 2008-04-16 17:36:44 --- E O F ---

jlpjlp · Answer

analyse aussi sur virus toal:


C:\WINDOWS\system32\cvfhvn.exe
C:\WINDOWS\system32\urbhkk.exe
C:\WINDOWS\system32\vrneki.exe 

et si inféctés:
tu vire aussi avec otmovit en mettant dans la citation

________________

vire ensuite ce qui est dans moved fiels en allant dans poste de travail puis C puis otmovit
________________

colle un rapport avec antivir que tu as

_______________

recolle  hijackhtis et dis tes soucis actuels




a plus

Hilfy · Answer

C:\WINDOWS\system32\cvfhvn.exe moved successfully.
C:\WINDOWS\system32\urbhkk.exe moved successfully.

jlpjlp · Answer

celui ci aussi a voir:

C:\WINDOWS\system32\vrneki.exe 

cf message 37

Hilfy · Answer

File/Folder C:\WINDOWS\system32\vrneki.exe moved successfully.

jlpjlp · Answer

vire ensuite ce qui est dans moved fiels en allant dans poste de travail puis C puis otmovit
________________

colle un rapport avec antivir que tu as

_______________

recolle hijackhtis et dis tes soucis actuels




a plus

Hilfy · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:53:30, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\Eden.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/JA-JP/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

Hilfy · Answer

Je n'ai pas fait de rapport Antivir car ca prendrait trop de temps (enfin je crois XD)

Hilfy · Answer

Pourquoi il faut suprimer ce qui se trouve dans movefiles?

jlpjlp · Answer

si les fichiers que je t'ai fais analyser sont inféctés , il ne sert a rien de les garder sur ton ordi meme si ils ont eté deplacés

Hilfy · Answer

OK Merci ^^.

Comment fait-on un rapport avec Antivir?

jlpjlp · Answer

tu n'as jamais fais ?   il faut scanner son ordi tous les mois pour vérifier que rien n'est passé avec un antivirus....


regarde ici :

https://www.malekal.com/avira-free-security-antivirus-gratuit/




rq: antivir vient de sortir sa version 8 alors si tu ne peux mettre a jour telecharge ici ( desinstaller la derniere version via ton panneau de configuration et mettre la derniere)

ici

https://download.cnet.com/Avira-Free-Security-with-Antivirus/3000-18510_4-10322935.html?part=dl-10322935&subj=dl&tag=button&cdlpid=10322935


ou

https://www.avira.com/en/downloads

Hilfy · Answer

Voila, dans C:\Documents and Settings\

Je voudrais supprimer le dossier Philippe.ANDRE.000 ainsi que son contenu

le message suivant apparait :

Impossible de supprimer NTUSER.DAT : Cette ressource est utilisée par une autre personne ou un autre programme.

Fermez les programmes susceptibles d'utiliser le fichier et essayez à nouveau.

jlpjlp · Answer

pour supprimer ce fichier tu peux essayer en mode sans echec

https://www.informatruc.com


ou sinon avec unlocker (l(installer puis cliquer sur le fichier que tu veux virer avec le bouton droit de la souris et choisir unlocker)

https://www.01net.com/telecharger/windows/Utilitaire/manipulation_de_fichier/fiches/32585.html

Hilfy · Answer

je peux le supprimer avec OTMoveIt2?

Hilfy · Answer

PS : j'ai déjà essayé en mode sans echec ca ne marche pas :/

jlpjlp · Answer

ou sinon avec unlocker (l(installer puis cliquer sur le fichier que tu veux virer avec le bouton droit de la souris et choisir unlocker)

https://www.01net.com/


________

ou sinon oui tu peux tenter otmovit

Hilfy · Answer

NTUSER.DAT est un fichier caché contenu dans le dossier Philippe.ANDRE.000

Hilfy · Answer

OK j'essaye ca tout de suite ^^

jlpjlp · Answer

pense surtout a me faire un rapport antivir et un nouveau hijakchtis et medire tes soucis actuel

a plus

Hilfy · Answer

File move failed. C:\Documents and Settings\Philippe.ANDRE.000\NTUSER.DAT scheduled to be moved on reboot.
 
OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 04162008_231538

Files moved on Reboot...
C:\Documents and Settings\Philippe.ANDRE.000\NTUSER.DAT moved successfully.

Hilfy · Answer

J'ai réussi à le supprimer ! ENFIN ! ^^

MERCI BEAUCOUP !

Hilfy · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:43, on 16/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP2 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\BUtilityBar\BisonBar.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Trend Micro\HijackThis\Eden.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ycomp/defaults/sp/*https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [ntiMUI] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7
tiMUI.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [BisonBar] C:\WINDOWS\BUtilityBar\BisonBar.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Acer Empowering Technology.lnk = C:\Acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/JA-JP/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Memory Check Service (AcerMemUsageCheckService) - Acer Inc. - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe

jlpjlp · Answer

ok
plus que le rapport antivir et me dire tes problemes actuels!!!




rq:
tu mettra aussi a jour adobe reader avec la version 8   https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html

Hilfy · Answer

Normalement j'ai plus de soucis à part le fait que j'avais utilisé Windows messenger (fourni) et que maintenant dès que je démarre ma session ca me connecte XD y'a-t-il une solution? (sinon je vais effacer la session pour en recréer une nouvelle).

Je lance tout de suite une analyse complète avec antivir en mode sans echec.

jlpjlp · Answer

je suis pas sur d'avoir saisi ce que tu veux...


Windows messenger:

pour le virer si c'est cela que tu veux : vas dans panneau de configuration puis AJOUT/ SUPPRESSION DE PROGRAMME puis AJOUTER OU SUPPRIMER DES COMPOSANT WINDOws  et tu decoche window messenger

________________

ou pour virer du demarrage: DEMARRER puis EXECUTER puis  tape  msconfig  puis dans l'onglet DEMARER tu decoche windows mesnger (au demarrage suivant accepter ce qui s'affiche pour toujours)

________________


sinon maintenant pour utiliser msn il faut mettre windows live messenger:

https://www.01net.com/telecharger/windows/Internet/communication/fiches/33534.html

Hilfy · Answer

OK merci beaucoup de votre aide.

Je vais faire l'analyse antivir.

Au revoir, et merci encore ^^.

jlpjlp · Answer

ok tu collera le rapport

a plus

Hilfy · Answer

Avira AntiVir Personal Report file date: jeudi 17 avril 2008 13:03 Scanning for 1204777 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Save mode Username: Incandescence Computer name: ANDRE Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:58 AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:38 LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:24 LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:42 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58 ANTIVIR2.VDF : 7.0.3.156 795136 Bytes 11/04/2008 19:53:52 ANTIVIR3.VDF : 7.0.3.176 153088 Bytes 16/04/2008 19:53:52 Engineversion : 8.1.0.30 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:22 AESCRIPT.DLL : 8.1.0.23 233851 Bytes 16/04/2008 19:54:04 AESCN.DLL : 8.1.0.13 115061 Bytes 16/04/2008 19:54:02 AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:46 AEPACK.DLL : 8.1.1.1 364918 Bytes 16/04/2008 19:54:02 AEOFFICE.DLL : 8.1.0.17 192891 Bytes 16/04/2008 19:54:00 AEHEUR.DLL : 8.1.0.18 1167735 Bytes 16/04/2008 19:53:58 AEHELP.DLL : 8.1.0.12 115063 Bytes 16/04/2008 19:53:56 AEGEN.DLL : 8.1.0.15 299379 Bytes 07/04/2008 15:34:44 AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:44 AECORE.DLL : 8.1.0.26 168311 Bytes 16/04/2008 19:53:54 AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:54 AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:52 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:48 AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:50 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:24 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:32 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:04 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:12 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:26 RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:12 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: jeudi 17 avril 2008 13:03 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'avcenter.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'Explorer.EXE' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 12 processes with 12 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '27' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\FOUND.002\FILE0000.CHK [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48534119.qua'! C:\Documents and Settings\Administrateur\Mes documents\MSNFix\14032008_23060120.zip [0] Archive type: ZIP --> backup/mrofinu1423.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '483745e1.qua'! C:\Documents and Settings\Administrateur\Mes documents\MSNFix\22032008_20163042.zip [0] Archive type: ZIP --> backup/mrofinu1423.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen --> backup/mrofinu1423.exe.tmp [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '483745e0.qua'! C:\Documents and Settings\Administrateur\Mes documents\MSNFix\07042008_10095985.zip [0] Archive type: ZIP --> backup/mrofinu1423.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen --> backup/mrofinu1423.exe.tmp [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '483745e6.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP65\A0016549.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bda.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP65\A0016576.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bdb.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP65\A0016598.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bdd.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016782.exe [DETECTION] Is the Trojan horse TR/Drop.Agent.eso [NOTE] The file was moved to '48374bf3.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016784.exe [DETECTION] Is the Trojan horse TR/Matcash.DLN [NOTE] The file was moved to '48374bf4.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016785.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a858cd.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016786.exe [DETECTION] Is the Trojan horse TR/Agent.AHBF [NOTE] The file was moved to '48374bf6.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016797.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bf5.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016801.exe [DETECTION] Is the Trojan horse TR/Drop.Agent.eso [NOTE] The file was moved to '49a858cf.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016803.exe [DETECTION] Is the Trojan horse TR/Matcash.DLN [NOTE] The file was moved to '48374be8.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016804.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bf7.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016805.exe [DETECTION] Is the Trojan horse TR/Agent.AHBF [NOTE] The file was moved to '49a858c0.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016840.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bf9.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016844.exe [DETECTION] Is the Trojan horse TR/Dldr.PurityScan.FJ.2 [NOTE] The file was moved to '48374bfa.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016846.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a858c3.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016847.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bfc.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016854.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bfb.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016858.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a858c4.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016859.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a858c5.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016860.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bfe.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016906.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a858c7.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016915.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374bff.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016946.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c00.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0016951.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c01.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0017001.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c04.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP69\A0017012.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f3d.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP70\A0017099.exe [DETECTION] Is the Trojan horse TR/Dldr.PurityScan.FK [NOTE] The file was moved to '48374c0f.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP70\A0017119.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c10.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP70\A0017141.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c11.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP70\A0017142.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c12.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP70\A0017143.exe [DETECTION] Is the Trojan horse TR/Dldr.PurityScan.FK [NOTE] The file was moved to '49a85f2b.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP72\A0017153.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c17.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP72\A0017177.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c18.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017498.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c41.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017907.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c54.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017962.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c58.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017970.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f61.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017971.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c5a.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017972.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c59.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017973.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f62.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017974.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c5b.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017975.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f64.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0017976.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f63.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0021064.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c5f.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022130.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c65.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022133.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f5e.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022153.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c67.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022193.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c69.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022195.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f52.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022214.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c6b.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022224.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f54.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022225.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c6d.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022226.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c6c.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0022227.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f55.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023202.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c6e.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023203.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f56.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023207.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c6f.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023208.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f48.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023209.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f57.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023210.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374c60.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023211.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f59.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023752.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cb5.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023759.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cb6.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023769.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cb7.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023796.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cb9.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023804.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f82.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0023857.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cba.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0024807.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cbc.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0024810.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85f85.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025809.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cc9.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025814.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85ff2.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025836.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ccb.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025837.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85ff4.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025841.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ccd.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025858.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ccc.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025861.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85ff6.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025883.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cce.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025884.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85ff7.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0025937.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cd0.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026001.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cd4.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026002.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85fed.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026022.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cd5.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026023.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cd6.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026114.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cda.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026117.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cdb.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026138.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cdc.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0026218.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ce0.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0027253.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ce2.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0027261.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ce3.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0027280.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ce4.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0027344.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374ce8.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0027345.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85fd1.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0028345.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cea.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0028402.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cf0.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0028403.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85fc9.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0028404.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cf2.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0028406.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85fcb.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP76\A0028424.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cf4.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP77\A0028491.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cf6.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP77\A0028492.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cf7.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP77\A0028586.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374cfc.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP87\A0037166.exe [DETECTION] Is the Trojan horse TR/Dldr.Agent.ltf.1 [NOTE] The file was moved to '48374d34.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP88\A0037217.EXE [DETECTION] Is the Trojan horse TR/Trash.Gen [NOTE] The file was moved to '48374d3b.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038622.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d72.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038623.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85e4b.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038624.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d74.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038625.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d73.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038626.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85e4c.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038627.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d75.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038628.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85e4e.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038629.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85e4d.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038630.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d76.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038631.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85e4f.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038632.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d68.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038633.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d77.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038634.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '49a85e40.qua'! C:\System Volume Information\_restore{114BBA23-0C1A-4D24-8D0F-D4F7325498E1}\RP89\A0038635.exe [DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen [NOTE] The file was moved to '48374d79.qua'! Begin scan in 'D:\' End of the scan: jeudi 17 avril 2008 15:21 Used time: 2:17:43 min The scan has been done completely. 4603 Scanning directories 210850 Files were scanned 123 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 121 files were moved to quarantine 0 files were renamed 1 Files cannot be scanned 210727 Files not concerned 6411 Archives were scanned 1 Warnings 121 Notes

Hilfy · Answer

Avira AntiVir Personal Report file date: jeudi 17 avril 2008 15:42 Scanning for 1204777 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Boot mode: Normally booted Username: SYSTEM Computer name: ANDRE Version information: BUILD.DAT : 8.1.00.295 16479 Bytes 09/04/2008 16:24:00 AVSCAN.EXE : 8.1.2.12 311553 Bytes 18/03/2008 09:02:58 AVSCAN.DLL : 8.1.1.0 53505 Bytes 07/02/2008 08:43:38 LUKE.DLL : 8.1.2.9 151809 Bytes 28/02/2008 08:41:24 LUKERES.DLL : 8.1.2.1 12033 Bytes 21/02/2008 08:28:42 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34 ANTIVIR1.VDF : 7.0.3.2 5447168 Bytes 07/03/2008 13:08:58 ANTIVIR2.VDF : 7.0.3.156 795136 Bytes 11/04/2008 19:53:52 ANTIVIR3.VDF : 7.0.3.176 153088 Bytes 16/04/2008 19:53:52 Engineversion : 8.1.0.30 AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:22 AESCRIPT.DLL : 8.1.0.23 233851 Bytes 16/04/2008 19:54:04 AESCN.DLL : 8.1.0.13 115061 Bytes 16/04/2008 19:54:02 AERDL.DLL : 8.1.0.19 418164 Bytes 07/04/2008 15:34:46 AEPACK.DLL : 8.1.1.1 364918 Bytes 16/04/2008 19:54:02 AEOFFICE.DLL : 8.1.0.17 192891 Bytes 16/04/2008 19:54:00 AEHEUR.DLL : 8.1.0.18 1167735 Bytes 16/04/2008 19:53:58 AEHELP.DLL : 8.1.0.12 115063 Bytes 16/04/2008 19:53:56 AEGEN.DLL : 8.1.0.15 299379 Bytes 07/04/2008 15:34:44 AEEMU.DLL : 8.1.0.5 430450 Bytes 07/04/2008 15:34:44 AECORE.DLL : 8.1.0.26 168311 Bytes 16/04/2008 19:53:54 AVWINLL.DLL : 1.0.0.7 14593 Bytes 23/01/2008 17:07:54 AVPREF.DLL : 8.0.0.1 25857 Bytes 18/02/2008 10:37:52 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:26:48 AVREG.DLL : 8.0.0.0 30977 Bytes 23/01/2008 17:07:50 AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:24 AVEVTLOG.DLL : 8.0.0.11 114945 Bytes 28/02/2008 08:31:32 SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:04 SMTPLIB.DLL : 1.2.0.19 28929 Bytes 23/01/2008 17:08:40 NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:12 RCIMAGE.DLL : 8.0.0.35 2371841 Bytes 10/03/2008 14:37:26 RCTEXT.DLL : 8.0.32.0 86273 Bytes 06/03/2008 12:02:12 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: C:, D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: off Scan all files...................: Intelligent file selection Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: medium Start of the scan: jeudi 17 avril 2008 15:42 The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'wuauclt.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ALG.EXE' - '1' Module(s) have been scanned Scan process 'WMIAPSRV.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'UNSECAPP.EXE' - '1' Module(s) have been scanned Scan process 'WMIPRVSE.EXE' - '1' Module(s) have been scanned Scan process 'ULCDRSvr.exe' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'RichVideo.exe' - '1' Module(s) have been scanned Scan process 'HPZipm12.exe' - '1' Module(s) have been scanned Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned Scan process 'AVGUARD.EXE' - '1' Module(s) have been scanned Scan process 'MSNMSGR.EXE' - '1' Module(s) have been scanned Scan process 'CTFMON.EXE' - '1' Module(s) have been scanned Scan process 'ePower_DMC.exe' - '1' Module(s) have been scanned Scan process 'AVGNT.EXE' - '1' Module(s) have been scanned Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned Scan process 'MemCheck.exe' - '1' Module(s) have been scanned Scan process 'SCHED.EXE' - '1' Module(s) have been scanned Scan process 'EXPLORER.EXE' - '1' Module(s) have been scanned Scan process 'SPOOLSV.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'SVCHOST.EXE' - '1' Module(s) have been scanned Scan process 'ATI2EVXX.EXE' - '1' Module(s) have been scanned Scan process 'LSASS.EXE' - '1' Module(s) have been scanned Scan process 'SERVICES.EXE' - '1' Module(s) have been scanned Scan process 'WINLOGON.EXE' - '1' Module(s) have been scanned Scan process 'CSRSS.EXE' - '1' Module(s) have been scanned Scan process 'SMSS.EXE' - '1' Module(s) have been scanned 35 processes with 35 modules were scanned Starting master boot sector scan: Master boot sector HD0 [INFO] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [INFO] No virus was found! Boot sector 'D:\' [INFO] No virus was found! Starting to scan the registry. The registry was scanned ( '23' files ). Starting the file scan: Begin scan in 'C:\' C:\pagefile.sys [WARNING] The file could not be opened! C:\hiberfil.sys [WARNING] The file could not be opened! Begin scan in 'D:\' End of the scan: jeudi 17 avril 2008 16:10 Used time: 27:38 min The scan has been done completely. 4604 Scanning directories 210851 Files were scanned 0 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 0 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 210851 Files not concerned 6409 Archives were scanned 2 Warnings 0 Notes

jlpjlp · Answer

ok antivir est ok 
si pas de souci c'est bon!

Virus msn : album photo suisse

66 réponses

Discussions similaires

Newsletters