Rapport Hijackthis Résolu

Question

Bonjour,

depuis quelque je trouve que mon ordinateur rame(alors qu'il fonctionnais très bien)
je me demandais si je m'étais pas pris un virus ou autre ..., j'utilise comme anti virus avg 7.5 internet security et depuis 2 jours impossible de le démarrer application win32 non valide (c'est ce qui m'a pousser à vous mettre mon rapport de hijacthis).

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:24:50, on 24/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\APPS\Powercinema\PCMService.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\oodtray.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Documents and Settings\Nicolas\Application Data\m\flec006.exe
D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\GPGOE\GPGOEInit.exe
C:\Program Files\BoostKit\boostkit2.exe
C:\Program Files\Weezo\bin\Weezo.exe
D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\WinPT\WinPT.exe
C:\Program Files\BoostKit\ahelp.exe
C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe
C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\The Cleaner Free\cleaner.exe
D:\Documents and Settings\Nicolas\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ask.com/?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [Vaderetro Outlook] "C:\PROGRA~1\GOTOSO~1\VADERE~1\VrMoRegister.exe -s"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TrueTransparency] "D:\DOCUME~1\Nicolas\LOCALS~1\Temp\Rar$EX00.063\TrueTransparency\TrueTransparency.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [zweitgeist Assistant] "C:\Program Files\weblin\weblinAssistant.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [drvsyskit] C:\WINDOWS\system32\drivers\hldrrr.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [mule_st_key] D:\Documents and Settings\Nicolas\Application Data\m\flec006.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BoostKit.lnk = C:\Program Files\BoostKit\bk.exe
O4 - Startup: GPGOEInit.lnk = Windows Privacy Tools\GPGOE\GPGOEInit.exe
O4 - Startup: Weezo.lnk = C:\Program Files\Weezo\bin\Weezo.exe
O4 - Startup: WinPT.lnk = Windows Privacy Tools\WinPT\WinPT.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

g!rly · Answer

Salut,

Tu es visiblement infecté par bagle

Supprime le crack que tu as telechargé...

Puis :

Télécharge ELIBAGLA en bas de cette page
http://www.zonavirus.com/datos/descargas/95/elibagla.asp (clique sur le bouton "Descargar Elibagla") sur ton bureau.

Lance-le, de préférence en mode sans échec si tu en as la possibilité, en mode normal dans le cas contraire. Patiente le temps du scan.
Lorsqu'il a terminé, poste le contenu du fichier infoSat.txt qui se trouve dans Poste de travail > Disque C:\
Et par la même occasion, précise si tu peux à nouveau démarrer en mode sans échec.

***Ne pas rebooter en passant par msconfig.

Comment redémarrer en mode sans echec? 

   Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
   Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
   Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
   Ps : si F8 ne marche pas utilise la touche F5.

@+

Nico70 · Answer

tien voila infoSAT.txt


	  Mon May 26 19:57:39 2008
EliBagle v11.42  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 26 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
D:\DOCUMENTS AND SETTINGS\NICOLAS\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
D:\DOCUMENTS AND SETTINGS\NICOLAS\APPLICATION DATA\M\LIST.OCT --> Eliminado Bagle
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Mon May 26 19:58:55 2008
EliBagle v11.42  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 26 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Bagle Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Bagle (rootkit) Acceso Denegado.
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Bagle.dldr Acceso Denegado.
D:\DOCUMENTS AND SETTINGS\NICOLAS\APPLICATION DATA\M\FLEC006.EXE --> Bagle Acceso Denegado.
Restaurada Clave: "SafeBoot\Minimal y Network"
Reinicie para Completar la Limpieza.

	  Mon May 26 19:59:04 2008
EliBagle v11.42  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 26 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\

g!rly · Answer

ok

recommence eliblaga mais en mode sans echec maintenant.

post le rapport 

@+

Nico70 · Answer

je ne peut pas mais quand j'ai rdemaré l'ordi il ma afficher eliblaga et il ma supprimer un fichier infester

g!rly · Answer

Salut nico70,

Fais ceci :

Ca devrait grandement faciliter le boulot d'Elibagla :

Télécharge sur ton bureau http://sd-1.archive-host.com/membres/up/1366464061/KB.exe

Sur ton bureau double clic sur KB.exe.
Toujours sur ton bureau double clic ensuite sur le raccourci "KillB"
Au message "Voulez-vous exécuter Elibagla", tape 1 (Oui) puis valide avec la touche 'Entrée'

Juste après, l'outil Elibagla va se lancer automatiquement, clic sur "ok" aux premières boîtes de dialogue qui peuvent apparaître avant le menu principal de l'outil :

Por favor, envienos una muestra del fichero
C:\Muestras\HLDRRR.EXE.Muestra EliBagle v11.18
a "virus@satinfo.es". Gracias
et/ou
Eliminando Gusano BAGLE

Une fois fait, le menu principal d'Elibagla apparaîtra :

- Laisse la case "Eliminar ficheros automaticamente" coché
- Clic sur "Explorar" pour lancer le scan.

/!\ Pendant toute la durée du scan, n'utilise pas ton pc, n'ouvre aucun programmes et laisse l'outil travailler.
/!\ Ne redémarre pas ton pc après l'analyse de l'outil.

Le scan terminé, poste dans ta prochaine réponse le contenu du fichier C:\KB\KB.txt ainsi que C:\InfoSat.txt

Bon courage !

@+

jalobservateur · Answer

Hey G!rly, moi j'ai un gros pingouin qui bouffe mon ecran ;-)

g!rly · Answer

Ha ha ;-)
J´croyais que t´avais banni ce site ?!
Kisses`

Nico70 · Answer

voila le big rapport



KB.txt

Exécuté le : 28/05/2008 à 19:41:13,78
C:\KB\

+-> Processus infectieux actifs

- Aucun processus infectieux en cours d'utilisation.


+- Etape 2 : Recherche des fichiers infectieux

- Aucun élément infectieux détecté.


-+ Fin du rapport
C:\WINDOWS\system32\drivers\hldrrr.exe
C:\WINDOWS\system32\drivers\mdelk.exe
C:\WINDOWS\system32\drivers\srosa.sys
C:\WINDOWS\system32\ban_list.txt
C:\WINDOWS\system32\mdelk.exe
C:\WINDOWS\system32\wintems.exe
C:\WINDOWS\system32\drivers\downld
D:\Documents and Settings\Nicolas\Application Data\m
C:\APPS\SMP\SmpSys.exe
C:\Program Files\AVS4YOU\AVSSoftwareNavigator\AVS4YOUSoftwareNavigator.exe
C:\Program Files\AVS4YOU\AVSVideoConverter\AVSVideoConverter.exe
C:\Program Files\AVS4YOU\Registration.exe
C:\Program Files\Fichiers communs\AVSMedia\AVS DVDMenu Editor\AVSDVDMenuEditor.exe
C:\Program Files\Fichiers communs\AVSMedia\BurnerService\AVSVideoBurner.exe
C:\Program Files\Fichiers communs\AVSMedia\MobileUploader\AVSMobileUploader.exe
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP273\A0151810.exe
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP295\A0159205.exe
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP295\A0159214.exe
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP295\A0159267.exe
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP295\A0159275.exe
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP295\A0159292.exe
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP295\A0159301.exe
C:\WINDOWS\system32\MRT.exe


-+ Fin du rapport





InfoSAT.txt


	  Wed May 28 19:41:18 2008
EliBagle v11.41  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 22 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Acción Directa):
C:\WINDOWS\SYSTEM32\WINTEMS.EXE --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\BAN_LIST.TXT --> Eliminado Bagle
C:\WINDOWS\SYSTEM32\DRIVERS\SROSA.SYS --> Eliminado Bagle (rootkit)
C:\WINDOWS\SYSTEM32\DRIVERS\HLDRRR.EXE --> Eliminado Bagle.dldr
D:\DOCUMENTS AND SETTINGS\NICOLAS\APPLICATION DATA\M\FLEC006.EXE --> Eliminado Bagle
D:\DOCUMENTS AND SETTINGS\NICOLAS\APPLICATION DATA\M\LIST.OCT --> Eliminado Bagle

	  Wed May 28 19:41:37 2008
EliBagle v11.41  (c)2008 S.G.H. / Satinfo S.L. (Modificado el 22 de Mayo del 2008)
----------------------------------------------
Lista de Acciones (por Exploración):
Explorando Unidad C:\
C:\APPS\SMP\SMPSYS.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP297\A0162644.EXE --> Eliminado Bagle
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP297\A0162645.SYS --> Eliminado Bagle (rootkit)
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP297\A0162646.EXE --> Eliminado Bagle.dldr
C:\System Volume Information\_restore{751238CC-FEB5-4605-9EA9-B441EBD3D66D}\RP297\A0162648.EXE --> Eliminado Bagle.dldr
C:\WINDOWS\system32\MDELK.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\MDELK.EXE --> Eliminado Bagle.dldr
C:\WINDOWS\system32\drivers\downld\267906.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\274609.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\293171.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\295218.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\295812.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\302828.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\319906.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\325750.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\350656.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\368625.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\380890.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\381921.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\51856546.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\51937828.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\5696218.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\5744671.EXE --> Eliminado Bagle
C:\WINDOWS\system32\drivers\downld\7232000.EXE --> Eliminado Bagle

Nº Total de Directorios:   9459
Nº Total de Ficheros:      98444
Nº de Ficheros Analizados: 15874
Nº de Ficheros Infectados: 24
Nº de Ficheros Limpiados:  24




Merci de ton aide

g!rly · Answer

cool ;-)

Ca a l´air de l´avoir fait !

passe ceci maintenant :

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe     

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

Avant d'utiliser ComboFix :

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours.

-> Désactive provisoirement et seulement le temps de l'utilisation de ComboFix, la protection en temps réel de ton Antivirus et de tes Antispywares, qui peuvent géner fortement la procédure de recherche et de nettoyage de l'outil.

Une fois fait, sur ton bureau double-clic sur Combofix.exe.

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes.

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire.

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt)

-> Réactive la protection en temps réel de ton Antivirus et de tes Antispywares, avant de te reconnecter à internet.

-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

-> Tutoriel https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

et

un nouveau rapport hijack this stp

tes protections devraient remarcher, non ?

@+

Nico70 · Answer

Combofix.txt ComboFix 08-05-27.4 - Nicolas 2008-05-28 22:27:27.2 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.121 [GMT 2:00] Endroit: D:\Documents and Settings\xxxxxxx\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . C:\WINDOWS\config.ini C:\WINDOWS\system32\drivers\downld C:\WINDOWS\system32\drivers\downld\230562.exe C:\WINDOWS\system32\drivers\downld\261703.exe C:\WINDOWS\system32\drivers\downld\268062.exe C:\WINDOWS\system32\drivers\downld\270171.exe C:\WINDOWS\system32\drivers\downld\273234.exe C:\WINDOWS\system32\drivers\downld\274687.exe C:\WINDOWS\system32\drivers\downld\278078.exe C:\WINDOWS\system32\drivers\downld\283593.exe C:\WINDOWS\system32\drivers\downld\285234.exe C:\WINDOWS\system32\drivers\downld\294312.exe C:\WINDOWS\system32\drivers\downld\298406.exe C:\WINDOWS\system32\drivers\downld\304093.exe C:\WINDOWS\system32\drivers\downld\304671.exe C:\WINDOWS\system32\drivers\downld\307500.exe C:\WINDOWS\system32\drivers\downld\309812.exe C:\WINDOWS\system32\drivers\downld\316656.exe C:\WINDOWS\system32\drivers\downld\335250.exe C:\WINDOWS\system32\drivers\downld\336234.exe C:\WINDOWS\system32\drivers\downld\341546.exe C:\WINDOWS\system32\drivers\downld\343906.exe C:\WINDOWS\system32\drivers\downld\376734.exe C:\WINDOWS\system32\drivers\downld\387312.exe C:\WINDOWS\system32\drivers\downld\396421.exe C:\WINDOWS\system32\drivers\downld\402656.exe C:\WINDOWS\system32\drivers\downld\414640.exe C:\WINDOWS\system32\drivers\downld\415750.exe C:\WINDOWS\system32\drivers\downld\417625.exe C:\WINDOWS\system32\drivers\downld\433468.exe C:\WINDOWS\system32\drivers\downld\454343.exe C:\WINDOWS\system32\drivers\downld\455500.exe C:\WINDOWS\system32\drivers\downld\466281.exe C:\WINDOWS\system32\drivers\downld\473359.exe C:\WINDOWS\system32\drivers\downld\495109.exe C:\WINDOWS\system32\drivers\downld\511984.exe C:\WINDOWS\system32\drivers\downld\51798843.exe C:\WINDOWS\system32\drivers\downld\51805953.exe C:\WINDOWS\system32\drivers\downld\51911578.exe C:\WINDOWS\system32\drivers\downld\51951953.exe C:\WINDOWS\system32\drivers\downld\521218.exe C:\WINDOWS\system32\drivers\downld\52177437.exe C:\WINDOWS\system32\drivers\downld\52197578.exe C:\WINDOWS\system32\drivers\downld\523250.exe C:\WINDOWS\system32\drivers\downld\532093.exe C:\WINDOWS\system32\drivers\downld\544859.exe C:\WINDOWS\system32\drivers\downld\556218.exe C:\WINDOWS\system32\drivers\downld\567359.exe C:\WINDOWS\system32\drivers\downld\572625.exe C:\WINDOWS\system32\drivers\downld\5766453.exe C:\WINDOWS\system32\drivers\downld\5834281.exe C:\WINDOWS\system32\drivers\downld\5847828.exe C:\WINDOWS\system32\drivers\downld\5861078.exe C:\WINDOWS\system32\drivers\downld\586968.exe C:\WINDOWS\system32\drivers\downld\594625.exe C:\WINDOWS\system32\drivers\downld\609140.exe C:\WINDOWS\system32\drivers\downld\620140.exe C:\WINDOWS\system32\drivers\downld\631125.exe C:\WINDOWS\system32\drivers\downld\633734.exe C:\WINDOWS\system32\drivers\downld\633765.exe C:\WINDOWS\system32\drivers\downld\640390.exe C:\WINDOWS\system32\drivers\downld\652187.exe C:\WINDOWS\system32\drivers\downld\699843.exe C:\WINDOWS\system32\drivers\downld\716437.exe C:\WINDOWS\system32\drivers\downld\7193109.exe C:\WINDOWS\system32\drivers\downld\7197359.exe C:\WINDOWS\system32\drivers\downld\7239453.exe C:\WINDOWS\system32\drivers\downld\724453.exe C:\WINDOWS\system32\drivers\downld\7328531.exe C:\WINDOWS\system32\drivers\downld\7344625.exe C:\WINDOWS\system32\drivers\downld\7352515.exe D:\Documents and Settings\All Users\Application Data\HotbarSA D:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA.dat D:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSA_kyf.dat D:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAAbout.mht D:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAau.dat D:\Documents and Settings\All Users\Application Data\HotbarSA\HotbarSAEULA.mht . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_NWSAPAGENT -------\Legacy_SROSA -------\Service_NwSapAgent ((((((((((((((((((((((((((((( Fichiers créés 2008-04-28 to 2008-05-28 )))))))))))))))))))))))))))))))))))) . 2008-05-28 21:16 . 2008-05-28 21:16 d-------- C:\Program Files\Trend Micro 2008-05-28 19:29 . 2008-05-28 21:20 d-------- C:\KB 2008-05-28 16:38 . 2008-05-28 16:38 d-------- C:\Program Files\Submitic 2008-05-26 19:09 . 2008-05-28 11:43 d-------- D:\Documents and Settings\All Users\Application Data\ma-config.com 2008-05-24 19:31 . 2008-05-24 19:31 5,376 --a------ C:\WINDOWS\system32\drivers\MS1000.sys 2008-05-24 19:29 . 2008-05-27 20:38 d-------- C:\Program Files\The Cleaner Free 2008-05-23 18:40 . 2008-05-24 11:54 d-------- C:\Program Files\IE Accelerator 2008-05-22 20:44 . 2008-05-22 20:44 d-------- D:\Documents and Settings\All Users\Application Data\FLEXnet 2008-05-22 19:51 . 2008-05-22 19:51 d-------- C:\Program Files\PC Inspector File Recovery 2008-05-22 19:51 . 2002-02-18 18:40 6,200 --a------ C:\WINDOWS\system32\INT13EXT.VXD 2008-05-22 17:17 . 2008-05-22 17:17 d-------- C:\Program Files\KC Softwares 2008-05-18 18:41 . 2008-05-24 12:34 d-------- C:\Program Files\Mozilla Sunbird 2008-05-17 11:55 . 2008-05-28 22:01 30,648 --a------ C:\WINDOWS\system32\oodbs.lor 2008-05-16 18:03 . 2008-05-16 18:03 50 --a------ C:\WINDOWS\MegaManager.INI 2008-05-16 16:56 . 2008-05-16 16:57 d-------- D:\Documents and Settings\Nicolas\Application Data\Weezo 2008-05-16 16:56 . 2008-05-16 16:57 d-------- C:\Program Files\Weezo 2008-05-15 19:49 . 2008-05-15 19:49 d-------- C:\Program Files\HD Tune 2008-05-15 15:01 . 2008-05-17 11:23 d-------- D:\Documents and Settings\Nicolas\Application Data\FrostWire 2008-05-15 15:00 . 2008-05-15 15:01 d-------- C:\Program Files\FrostWire 2008-05-15 14:53 . 2008-05-15 14:53 0 --a------ C:\WINDOWS\oodcnt.INI 2008-05-14 21:25 . 2008-05-25 14:27 d-------- C:\WINDOWS\system32\oodag 2008-05-14 21:21 . 2008-05-14 21:21 d-------- C:\Program Files\OO Software 2008-05-14 19:35 . 2008-05-14 19:35 d-------- C:\Program Files\Alcohol Soft 2008-05-14 19:35 . 2008-05-14 19:35 223,128 --a------ C:\WINDOWS\system32\drivers\vaxscsi.sys 2008-05-14 15:53 . 2008-05-14 15:54 d-------- C:\Program Files\weblin 2008-05-14 15:52 . 2008-05-27 18:30 d-------- D:\Documents and Settings\Nicolas\Application Data\zweitgeist 2008-05-14 15:09 . 2008-05-14 15:09 96,584 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-05-13 03:53 . 2008-05-13 03:53 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-05-13 03:53 . 2008-05-13 03:53 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe 2008-05-13 03:53 . 2008-05-13 03:53 9,878 --a------ C:\WINDOWS\system32\dsm_fr.qm 2008-05-13 03:53 . 2008-05-13 03:53 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb 2008-05-13 03:51 . 2008-05-13 03:51 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll 2008-05-13 03:51 . 2008-05-13 03:51 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll 2008-05-13 03:49 . 2008-05-13 03:49 630,784 --a------ C:\WINDOWS\system32\divxdec.ax 2008-05-13 03:49 . 2008-05-13 03:49 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax 2008-05-13 03:49 . 2008-05-13 03:49 161,096 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2008-05-13 03:49 . 2008-05-13 03:49 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2008-05-13 03:48 . 2008-05-13 03:48 8,835 --a------ C:\WINDOWS\system32\dpufr.qm 2008-05-09 18:41 . 2005-08-03 20:10 102,400 --a------ C:\WINDOWS\system32\tsccvid.dll 2008-05-09 18:40 . 2008-05-09 18:40 d-------- C:\Program Files\TechSmith 2008-05-09 18:40 . 2005-08-04 03:01 45,056 --a------ C:\WINDOWS\system32\CSvidcap.dll 2008-05-09 12:34 . 2008-05-25 15:48 d-------- C:\Program Files\eMule 2008-05-06 18:04 . 2008-05-06 18:51 d-------- C:\Program Files\Mozilla Firefox 3 Beta 5 2008-05-05 21:52 . 2008-05-24 12:18 d-------- C:\Program Files\SnIco Edit 2008-05-05 21:24 . 2008-05-14 13:37 d-------- C:\Program Files\Movie Collection 2008-05-05 21:04 . 2008-05-05 21:04 120 --a------ C:\WINDOWS\Winchat.ini 2008-05-04 22:01 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-05-04 21:59 . 2008-05-04 21:59 d-------- C:\Program Files\Microsoft SQL Server Compact Edition 2008-05-04 20:13 . 2008-05-28 22:04 d--h----- C:\WINDOWS\FlyakiteOSX 2008-05-04 20:13 . 2008-04-13 19:33 219,648 --a------ C:\WINDOWS\system32\uxtheme.backup 2008-05-04 18:24 . 2008-05-04 18:24 d--h----- C:\WINDOWS\PIF 2008-05-04 16:17 . 2008-05-04 16:17 110,592 --a------ C:\WINDOWS\system32\avgfwafu.dll 2008-05-04 11:18 . 2008-05-04 11:21 d-------- C:\WINDOWS\ServicePackFiles 2008-05-04 11:14 . 2006-12-28 12:01 19,569 --a------ C:\WINDOWS\[u]0/u02666_.tmp 2008-05-04 11:10 . 2008-05-04 11:10 d-------- C:\WINDOWS\EHome 2008-05-04 11:04 . 2008-05-04 11:05 d-------- C:\Program Files\Safari 2008-05-03 16:29 . 2008-05-28 22:06 d-------- D:\Documents and Settings\Nicolas\Application Data\GnuPG 2008-05-02 20:22 . 2008-05-02 20:22 d-------- C:\WINDOWS\system32\Adobe 2008-05-02 20:17 . 2008-05-04 21:28 d-------- C:\Program Files\iTunes 2008-05-02 20:17 . 2008-05-02 20:17 d-------- C:\Program Files\iPod 2008-05-02 20:16 . 2008-05-02 20:16 d-------- C:\Program Files\Bonjour 2008-05-02 19:47 . 2008-05-02 19:47 d-------- C:\Program Files\Fichiers communs\xing shared 2008-05-01 20:40 . 2008-05-01 20:40 d-------- C:\Program Files\Spybot - Search & Destroy 2008-04-28 19:16 . 2008-04-28 19:16 d-------- D:\Documents and Settings\Nicolas\Application Data\Leadertech 2008-04-28 18:38 . 2008-04-28 18:39 d-------- C:\Program Files\OpenOffice.org 2.4 . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-05-28 17:36 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-05-25 09:30 --------- d-----w D:\Documents and Settings\Nicolas\Application Data\FileZilla 2008-05-24 11:31 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-05-24 11:29 475,508 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx 2008-05-24 11:29 40,128,544 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat 2008-05-24 11:26 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-05-24 10:39 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-05-24 10:34 --------- d-----w C:\Program Files\DivX 2008-05-24 10:32 --------- d-----w C:\Program Files\Windows Live 2008-05-24 10:16 --------- d-----w C:\Program Files\Opera 2008-05-24 10:12 --------- d-----w C:\Program Files\CCleaner 2008-05-23 16:42 --------- d-----w D:\Documents and Settings\Nicolas\Application Data\AVG7 2008-05-18 17:09 --------- d-----w C:\Program Files\Recuva 2008-05-18 16:33 --------- d-----w D:\Documents and Settings\Nicolas\Application Data\OpenOffice.org2 2008-05-16 15:45 --------- d-----w C:\Program Files\Notepad++ 2008-05-14 10:52 --------- d-----w D:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-11 16:05 --------- d-----w D:\Documents and Settings\All Users\Application Data\WLInstaller 2008-05-04 14:21 --------- d-----w C:\Program Files\FileZilla FTP Client 2008-05-04 09:06 --------- d-----w D:\Documents and Settings\Nicolas\Application Data\Apple Computer 2008-05-04 09:01 --------- d-----w C:\Program Files\Apple Software Update 2008-05-02 18:21 --------- d-----w C:\Program Files\Java 2008-05-02 18:15 --------- d-----w C:\Program Files\QuickTime 2008-05-02 17:47 --------- d-----w C:\Program Files\Fichiers communs\Real 2008-05-01 19:37 --------- d-----w D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-01 14:15 --------- d-----w D:\Documents and Settings\Nicolas\Application Data\gtk-2.0 2008-04-30 19:43 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys 2008-04-28 17:31 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-04-28 16:37 --------- d-----w C:\Program Files\OpenOffice.org 2.3 2008-04-24 16:54 --------- d-----w C:\Program Files\GIMP-2.0 2008-04-22 18:44 --------- d-----w C:\Program Files\FileZilla 2008-04-22 18:44 --------- d-----w C:\Program Files\DVDFab HD Decrypter 4 2008-04-22 18:44 --------- d-----w C:\Program Files\DVD Shrink 2008-04-22 18:41 --------- d-----w C:\Program Files\Steam 2008-04-22 18:32 --------- d-----w C:\Program Files\Panda Security 2008-04-22 18:02 81,920 ----a-w C:\WINDOWS\system32\W32N50.dll 2008-04-22 18:02 17,134 ----a-w C:\WINDOWS\system32\PCANDIS5.sys 2008-04-21 19:22 691,481 ----a-w C:\WINDOWS\unins000.exe 2008-04-13 17:50 1,804 ----a-w C:\WINDOWS\system32\dcache.bin 2008-04-13 17:37 332,800 ----a-w C:\WINDOWS\system32\netsetup.exe 2008-04-13 17:33 98,816 ----a-w C:\WINDOWS\system32\psbase.dll 2008-04-13 17:32 764,416 ----a-w C:\WINDOWS\system32\winntbbu.dll 2008-04-13 17:32 76,288 ----a-w C:\WINDOWS\system32\uniime.dll 2008-04-13 17:32 61,471 ----a-w C:\WINDOWS\system32\odbcji32.dll 2008-04-13 17:32 5,632 ----a-w C:\WINDOWS\system32\wmi.dll 2008-04-13 17:10 73,600 ----a-w C:\WINDOWS\system32\drivers\sr.sys 2008-04-13 17:09 80,384 ----a-w C:\WINDOWS\system32\drivers\parport.sys 2008-04-13 17:09 68,608 ----a-w C:\WINDOWS\system32\drivers\pci.sys 2008-04-13 17:09 46,848 ----a-w C:\WINDOWS\system32\drivers\p3.sys 2008-04-13 17:09 120,576 ----a-w C:\WINDOWS\system32\drivers\pcmcia.sys 2008-04-13 17:08 2,191,104 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-04-13 17:07 2,067,968 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-04-13 17:06 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll 2008-04-13 17:05 800,256 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys 2008-04-13 17:05 25,216 ----a-w C:\WINDOWS\system32\drivers\kbdclass.sys 2008-04-13 17:05 154,496 ----a-w C:\WINDOWS\system32\drivers\dmio.sys 2008-04-13 17:05 14,720 ----a-w C:\WINDOWS\system32\drivers\kbdhid.sys 2008-04-13 17:04 93,184 ------w C:\WINDOWS\system32\msxml6r.dll 2008-04-13 17:04 93,184 ------w C:\WINDOWS\system32\dllcache\msxml6r.dll 2008-04-13 17:04 37,632 ----a-w C:\WINDOWS\system32\drivers\isapnp.sys 2008-04-13 17:03 81,920 ------w C:\WINDOWS\system32\msshavmsg.dll 2008-04-13 17:03 5,504 ----a-w C:\WINDOWS\system32\drivers\intelide.sys 2008-04-13 17:03 40,576 ----a-w C:\WINDOWS\system32\drivers\intelppm.sys 2008-04-13 17:02 50,688 ----a-w C:\WINDOWS\system32\inetres.dll 2008-04-13 17:02 40,960 ----a-w C:\WINDOWS\system32\drivers\crusoe.sys 2008-04-13 17:01 572,416 ----a-w C:\WINDOWS\system32\shdoclc.dll 2008-04-13 17:00 66,048 ----a-w C:\WINDOWS\system32\drivers\serial.sys 2008-04-13 17:00 54,144 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys 2008-04-13 16:59 25,856 ----a-w C:\WINDOWS\system32\drivers\hidbth.sys 2008-04-13 16:59 10,240 ----a-w C:\WINDOWS\system32\gpkrsrc.dll 2008-04-13 16:58 273,664 ----a-w C:\WINDOWS\system32\drivers\bthport.sys 2008-04-13 16:58 1,845,760 ----a-w C:\WINDOWS\system32\win32k.sys 2008-04-13 16:58 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll 2008-04-13 16:57 70,144 ----a-w C:\WINDOWS\system32\browselc.dll 2008-04-13 16:57 58,752 ----a-w C:\WINDOWS\system32\drivers\redbook.sys 2008-04-13 16:57 44,672 ----a-w C:\WINDOWS\system32\drivers\fips.sys 2008-04-13 16:56 53,376 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys 2008-04-13 16:55 701,440 ------w C:\WINDOWS\system32\drivers\ati2mtag.sys 2008-04-13 16:55 40,064 ----a-w C:\WINDOWS\system32\drivers\processr.sys 2008-04-13 16:55 327,168 ------w C:\WINDOWS\system32\drivers\ati2mtaa.sys 2008-04-13 16:54 41,856 ----a-w C:\WINDOWS\system32\drivers\amdk7.sys 2008-04-13 16:54 41,472 ----a-w C:\WINDOWS\system32\drivers\amdk6.sys 2008-04-13 16:54 103,936 ----a-w C:\WINDOWS\system32\dpcdll.dll 2008-04-13 16:53 30,336 ----a-w C:\WINDOWS\system32\drivers\modem.sys 2008-04-13 16:53 23,680 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys 2008-04-13 16:52 188,672 ----a-w C:\WINDOWS\system32\drivers\acpi.sys 2008-04-13 10:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys 2008-04-13 10:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys 2008-04-13 10:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys 2008-04-13 10:20 361,344 ------w C:\WINDOWS\system32\drivers\tcpip.sys 2008-04-13 10:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys 2008-04-13 10:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys 2008-04-13 10:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys 2008-04-13 10:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys 2008-04-13 10:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys 2008-04-13 10:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-04-13 10:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys 2008-04-13 10:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys 2008-04-13 10:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys 2008-04-13 10:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys 2008-04-13 10:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SmpcSys"="C:\APPS\SMP\SmpSys.exe" [ ] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-14 11:10 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:34 15360] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [ ] "zweitgeist Assistant"="C:\Program Files\weblin\weblinAssistant.exe" [2008-05-14 15:54 192512] "ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-04-23 18:19 1189104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-05 14:00 455168] "RTHDCPL"="RTHDCPL.EXE" [2006-02-10 19:25 15969280 C:\WINDOWS\RTHDCPL.exe] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776] "nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "PCMService"="c:\APPS\Powercinema\PCMService.exe" [2006-02-23 12:08 147456] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-05-28 20:52 579584] "BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-13 19:34 110592 C:\WINDOWS\system32\bthprops.cpl] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2004-12-14 18:19 221184] "Vade Retro Outlook Express"="C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" [2006-02-16 16:46 295936] "Vaderetro Outlook"="C:\PROGRA~1\GOTOSO~1\VADERE~1\VrMoRegister.exe" [2006-07-22 11:59 44544] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-05-02 19:46 185896] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "System Files Updater"="C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe" [2006-02-25 13:58 118485] "OODefragTray"="C:\WINDOWS\system32\oodtray.exe" [2007-06-28 23:01 2512128] "IE Accelerator"="C:\PROGRA~1\IEACCE~1\IEAccelerator.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 19:34 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-05-28 20:52 219136] D:\Documents and Settings\Nicolas\Menu D‚marrer\Programmes\D‚marrage\ BoostKit.lnk - C:\Program Files\BoostKit\bk.exe [2004-07-23 18:29:41 28672] GPGOEInit.lnk - D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\GPGOE\GPGOEInit.exe [2003-04-01 02:36:52 28672] Weezo.lnk - C:\Program Files\Weezo\bin\Weezo.exe [2008-05-16 16:56:44 2342912] WinPT.lnk - D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\WinPT\WinPT.exe [2003-04-26 23:52:08 368640] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 15:39 294400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf] avgwlntf.dll 2007-06-12 11:45 9216 C:\WINDOWS\system32\avgwlntf.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "MSVideo"= CSvidcap.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SRService] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="" [HKLM\~\startupfolder\D:^Documents and Settings^All Users^Menu Démarrer^Programmes^Démarrage^Windows Desktop Search.lnk] path=D:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\Windows Desktop Search.lnk backup=C:\WINDOWS\pss\Windows Desktop Search.lnkCommon Startup [HKLM\~\startupfolder\D:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^OpenOffice.org 2.3.lnk] path=D:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\OpenOffice.org 2.3.lnk backup=C:\WINDOWS\pss\OpenOffice.org 2.3.lnkStartup [HKLM\~\startupfolder\D:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^TribalWeb.lnk] path=D:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\TribalWeb.lnk backup=C:\WINDOWS\pss\TribalWeb.lnkStartup [HKLM\~\startupfolder\D:^Documents and Settings^Nicolas^Menu Démarrer^Programmes^Démarrage^WampServer.lnk] path=D:\Documents and Settings\Nicolas\Menu Démarrer\Programmes\Démarrage\WampServer.lnk backup=C:\WINDOWS\pss\WampServer.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileZilla Server Interface] --a------ 2007-02-27 16:55 937984 C:\Program Files\FileZilla Server\FileZilla Server Interface.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search] --a------ 2007-09-02 12:52 1838592 C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-03-30 10:36 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoRepair] --a------ 2004-12-14 18:57 458752 C:\Program Files\Logitech\Video\ISStart.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LogitechVideoTray] --a------ 2004-12-14 18:51 217088 C:\Program Files\Logitech\Video\LogiTray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr] C:\Program Files\Windows Live\Messenger\msnmsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-03-28 23:37 413696 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] c:\program files\steam\steam.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueTransparency] D:\DOCUME~1\Nicolas\LOCALS~1\Temp\Rar$EX03.438\TrueTransparency\TrueTransparency.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UberIcon] C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOKIT] --a------ 2004-08-23 14:50 122880 C:\PROGRA~1\Wanadoo\Shell.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOTASKBARICON] --------- 2004-10-14 16:55 32768 C:\PROGRA~1\Wanadoo\GestMaj.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WOOWATCH] --a------ 2004-08-23 14:49 20480 C:\PROGRA~1\Wanadoo\Watch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZangoSA] C:\Program Files\Zango\bin\10.0.275.0\ZangoSA.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 "Alcmtr"=ALCMTR.EXE [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\AOL 9.0\aol.exe"= "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe"= "%windir%\system32\sessmgr.exe"= "C:\Program Files\Grisoft\AVG7\avginet.exe"= "C:\Program Files\Grisoft\AVG7\avgamsvr.exe"= "C:\Program Files\Grisoft\AVG7\avgcc.exe"= "C:\Program Files\eMule\emule.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\TribalWeb\tribalweb.exe"= "C:\Program Files\Windows Live\Mail\wlmail.exe"= "C:\WINDOWS\system32\dpnsvr.exe"= "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"= "C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe"= "C:\APPS\skype\phone\Skype.exe"= "C:\Program Files\Bonjour\mDNSResponder.exe"= "C:\Program Files\iTunes\iTunes.exe"= "C:\Program Files\FrostWire\FrostWire.exe"= "C:\Program Files\Weezo\Apache\bin\weezoHttpd.exe"= [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7734f88b-e084-11dc-be87-000c55fe6a6e}] \Shell\AutoRun\command - H:\nideiect.com \Shell\explore\Command - H:\nideiect.com \Shell\open\Command - H:\nideiect.com . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-03-13 14:53:54 C:\WINDOWS\Tasks\anni xxxx.job" - D:\Documents and Settings\Nicolas\Mes documents\Dates de naissances\anni xxxx.bat "2008-05-04 09:02:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-13 14:51:18 C:\WINDOWS\Tasks\test anni xxxx.job" - D:\Documents and Settings\xxxxxxx\Mes documents\Dates de naissances\anni xxxx.bat . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-28 22:31:25 Windows 5.1.2600 Service Pack 3 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-05-28 22:40:45 ComboFix-quarantined-files.txt 2008-05-28 20:40:32 Pre-Run: 14,563,766,272 octets libres Post-Run: 14,544,818,176 octets libres 431 --- E O F --- 2008-05-17 09:33:34 Hijackthis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:44:06, on 28/05/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16640) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe C:\Program Files\FileZilla Server\FileZilla Server.exe C:\WINDOWS\System32\FTRTSVC.exe c:\APPS\HIDSERVICE\HIDSERVICE.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\oodag.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\SearchIndexer.exe c:\APPS\Powercinema\Kernel\TV\CLSched.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\APPS\Powercinema\PCMService.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\LVCOMSX.EXE C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\BoostKit\boostkit2.exe D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\GPGOE\GPGOEInit.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Weezo\bin\Weezo.exe C:\Program Files\BoostKit\ahelp.exe D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\WinPT\WinPT.exe C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe C:\WINDOWS\explorer.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HJT.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ask.com/?o=1607 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file) O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file) O2 - BHO: (no name) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - (no file) O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file) O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file) O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" O4 - HKLM\..\Run: [Vaderetro Outlook] "C:\PROGRA~1\GOTOSO~1\VADERE~1\VrMoRegister.exe -s" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe O4 - HKLM\..\Run: [IE Accelerator] C:\PROGRA~1\IEACCE~1\IEAccelerator.exe /Auto O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [zweitgeist Assistant] "C:\Program Files\weblin\weblinAssistant.exe" O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: BoostKit.lnk = C:\Program Files\BoostKit\bk.exe O4 - Startup: GPGOEInit.lnk = Windows Privacy Tools\GPGOE\GPGOEInit.exe O4 - Startup: Weezo.lnk = C:\Program Files\Weezo\bin\Weezo.exe O4 - Startup: WinPT.lnk = Windows Privacy Tools\WinPT\WinPT.exe O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU) O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe (file missing) O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing) O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

g!rly · Answer

re,

desinstale avg et essaie celui ci a la place :

Telecharge et instales l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php 
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes : 
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

puis dis moi a quoi te servent ces programmes :

C:\Program Files\Weezo

C:\PROGRA~1\IEACCE~1 > ie accelerator

C:\Program Files\BoostKit

D:\Documents and Settings\All Users\Documents\Windows Privacy Tools

dis moi si antivir fonctionne ?!

@+

Nico70 · Answer

antivir à fonctionné il ne m'a détecté aucun programme malveillant

voici le rapport 



Avira AntiVir Personal
Report file date: jeudi 29 mai 2008  15:15

Scanning for 1296469 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 3)  [5.1.2600]
Boot mode:        Normally booted
Username:         Nicolas
Computer name:    SN111652950305

Version information:
BUILD.DAT     : 8.1.00.295      16479 Bytes  09/04/2008 16:24:00
AVSCAN.EXE    : 8.1.2.12       311553 Bytes  18/03/2008 09:02:56
AVSCAN.DLL    : 8.1.1.0         53505 Bytes  07/02/2008 08:43:37
LUKE.DLL      : 8.1.2.9        151809 Bytes  28/02/2008 08:41:23
LUKERES.DLL   : 8.1.2.1         12033 Bytes  21/02/2008 08:28:40
ANTIVIR0.VDF  : 6.40.0.0     11030528 Bytes  18/07/2007 10:33:34
ANTIVIR1.VDF  : 7.0.3.2       5447168 Bytes  07/03/2008 13:08:58
ANTIVIR2.VDF  : 7.0.4.53      1848832 Bytes  17/05/2008 13:04:53
ANTIVIR3.VDF  : 7.0.4.111      294400 Bytes  29/05/2008 13:04:54
Engineversion : 8.1.0.46  
AEVDF.DLL     : 8.1.0.5        102772 Bytes  25/02/2008 09:58:21
AESCRIPT.DLL  : 8.1.0.33       266618 Bytes  29/05/2008 13:05:03
AESCN.DLL     : 8.1.0.18       119156 Bytes  29/05/2008 13:05:03
AERDL.DLL     : 8.1.0.20       418165 Bytes  29/05/2008 13:05:02
AEPACK.DLL    : 8.1.1.5        364918 Bytes  29/05/2008 13:05:01
AEOFFICE.DLL  : 8.1.0.18       192890 Bytes  29/05/2008 13:05:00
AEHEUR.DLL    : 8.1.0.29      1253750 Bytes  29/05/2008 13:04:59
AEHELP.DLL    : 8.1.0.14       115063 Bytes  29/05/2008 13:04:57
AEGEN.DLL     : 8.1.0.21       303477 Bytes  29/05/2008 13:04:56
AEEMU.DLL     : 8.1.0.6        430451 Bytes  29/05/2008 13:04:55
AECORE.DLL    : 8.1.0.29       168311 Bytes  29/05/2008 13:04:55
AVWINLL.DLL   : 1.0.0.7         14593 Bytes  23/01/2008 17:07:53
AVPREF.DLL    : 8.0.0.1         25857 Bytes  18/02/2008 10:37:50
AVREP.DLL     : 7.0.0.1        155688 Bytes  16/04/2007 13:26:47
AVREG.DLL     : 8.0.0.0         30977 Bytes  23/01/2008 17:07:49
AVARKT.DLL    : 1.0.0.23       307457 Bytes  12/02/2008 08:29:23
AVEVTLOG.DLL  : 8.0.0.11       114945 Bytes  28/02/2008 08:31:31
SQLITE3.DLL   : 3.3.17.1       339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.19        28929 Bytes  23/01/2008 17:08:39
NETNT.DLL     : 8.0.0.1          7937 Bytes  25/01/2008 12:05:10
RCIMAGE.DLL   : 8.0.0.35      2371841 Bytes  10/03/2008 14:37:25
RCTEXT.DLL    : 8.0.32.0        86273 Bytes  06/03/2008 12:02:11

Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: D:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILESootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922

Start of the scan: jeudi 29 mai 2008  15:15

Starting search for hidden objects.
HKEY_USERS\S-1-5-21-1311150570-138002088-1945516036-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FA955F63-0BE3-9003-15FA-96603AFAE6FA}
aamjglblodbmajafnplllpbdifk
      [INFO]      The registry entry is invisible.
HKEY_USERS\S-1-5-21-1311150570-138002088-1945516036-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FA955F63-0BE3-9003-15FA-96603AFAE6FA}\maolddleonidikjjnjjeefipjo
      [INFO]      The registry entry is invisible.
HKEY_USERS\S-1-5-21-1311150570-138002088-1945516036-1006\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{FA955F63-0BE3-9003-15FA-96603AFAE6FA}\gbpfongmdfmpabliaemginejlagmmfnkkohiiipanhbbid
      [INFO]      The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FA955F63-0BE3-9003-15FA-96603AFAE6FA}\InProcServer32\oacmcjlnbdjndcpodfbbopoapgfgbo
      [INFO]      The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FA955F63-0BE3-9003-15FA-96603AFAE6FA}\InProcServer32
acmmkcfioojcmocggkodbcbhooh
      [INFO]      The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{FA955F63-0BE3-9003-15FA-96603AFAE6FA}\InProcServer32\gacmcjinjpmpoo
      [INFO]      The registry entry is invisible.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\System\oodefrag10.00.00.01workstation
      [INFO]      The registry entry is invisible.
'463140' objects were checked, '7' hidden objects were found.


End of the scan: jeudi 29 mai 2008  16:28
Used time:  1:13:12 min

The scan has been done completely.

      0 Scanning directories
      0 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      0 Files cannot be scanned
      0 Files not concerned
      0 Archives were scanned
      0 Warnings
      0 Notes
 463140 Objects were scanned with rootkit scan
      7 Hidden objects were found



C:\Program Files\Weezo


c'est mon serveur de partage


C:\PROGRA~1\IEACCE~1 > ie accelerator


à rien il plante


C:\Program Files\BoostKit


accelère mon ordi


D:\Documents and Settings\All Users\Documents\Windows Privacy Tools 

a rien à été installer en même temps que wlm je crois

g!rly · Answer

ok nicos 70

plutot cool

supprime :

C:\PROGRA~1\IEACCE~1 > ie accelerator

D:\Documents and Settings\All Users\Documents\Windows Privacy Tools 

puis repost un nouveau rapport hijack this stp

@+

Nico70 · Answer

et voici le rapport 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:07:29, on 29/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\APPS\Powercinema\PCMService.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\BoostKit\boostkit2.exe
D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\GPGOE\GPGOEInit.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Weezo\bin\Weezo.exe
C:\Program Files\BoostKit\ahelp.exe
D:\Documents and Settings\All Users\Documents\Windows Privacy Tools\WinPT\WinPT.exe
C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe
C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\mspaint.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ask.com/?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [Vaderetro Outlook] "C:\PROGRA~1\GOTOSO~1\VADERE~1\VrMoRegister.exe -s"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [IE Accelerator] C:\PROGRA~1\IEACCE~1\IEAccelerator.exe /Auto
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [zweitgeist Assistant] "C:\Program Files\weblin\weblinAssistant.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: BoostKit.lnk = C:\Program Files\BoostKit\bk.exe
O4 - Startup: Weezo.lnk = C:\Program Files\Weezo\bin\Weezo.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe (file missing)
O23 - Service: AVG E-mail Scanner (AVGEMS) - Unknown owner - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe (file missing)
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

g!rly · Answer

re,

* Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

C:\PROGRA~1\IEACCE~1

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

A láide de hijack this coche et fix les lignes suivantes :

O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file) 
O2 - BHO: (no name) - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O2 - BHO: (no name) - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - (no file)
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" 
O4 - HKLM\..\Run: [IE Accelerator] C:\PROGRA~1\IEACCE~1\IEAccelerator.exe /Auto
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

tu n´as pas desinstallé avg ?!!!

@+

Nico70 · Answer

la réponse de otmoveit2

File/Folder  not found.
File/Folder C:\PROGRA~1\IEACCE~1 not found.
 
OTMoveIt2 by OldTimer - Version 1.0.4.2 log created on 05292008_194216

c'est pas dangereux d'enlever 

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

g!rly · Answer

bon il l trouve pas..

fais une recherche pour ie acelerator sur ton pc et supprime le

ctfmon enfin dans ce cas les lignes sont superflues, elles appartiennent a office...

@+

Nico70 · Answer

pour ie accelerator pas trouvé 

j'ai supprimé les ligne superflu

le log d'hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:09:17, on 29/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
C:\Program Files\FileZilla Server\FileZilla Server.exe
C:\WINDOWS\System32\FTRTSVC.exe
c:\APPS\HIDSERVICE\HIDSERVICE.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
c:\APPS\Powercinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\APPS\Powercinema\PCMService.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\system32\oodtray.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\BoostKit\boostkit2.exe
C:\Program Files\Weezo\bin\Weezo.exe
C:\Program Files\BoostKit\ahelp.exe
C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe
C:\Program Files\Weezo\Apache\bin\WeezoHttpd.exe
C:\Program Files\Trend Micro\HijackThis\HJT.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.ask.com/?o=1607
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "c:\APPS\Powercinema\PCMService.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [Vade Retro Outlook Express] "C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe"
O4 - HKLM\..\Run: [Vaderetro Outlook] "C:\PROGRA~1\GOTOSO~1\VADERE~1\VrMoRegister.exe -s"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [SmpcSys] C:\APPS\SMP\SmpSys.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [TrueTransparency] "D:\DOCUME~1\Nicolas\LOCALS~1\Temp\Rar$EX03.438\TrueTransparency\TrueTransparency.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: BoostKit.lnk = C:\Program Files\BoostKit\bk.exe
O4 - Startup: Weezo.lnk = C:\Program Files\Weezo\bin\Weezo.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\FICHIE~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - c:\APPS\Powercinema\Kernel\TV\CLSched.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe
O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Program Files\FileZilla Server\FileZilla Server.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Generic Service for HID Keyboard Input Collections (GenericHidService) - Unknown owner - c:\APPS\HIDSERVICE\HIDSERVICE.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe

g!rly · Answer

ok

quand tu en auras fini avec avg ( la liscence ) instale antivir, beaucoup plus performant !

instale ceci pour plus de sureté :

spywareblaster :

http://www.brightfort.com/spywareblaster.html

c´est un resident, il suffit de le mettre a jour de temps en temps car la version gratuite ne le fait pas toute seul , une fois installé et mis a jour tu mets toutes les protections sur "enable"

tuto : https://www.malekal.com/tutorial-spywareblaster/

nos chemins se quittent maintenant

bonne continuation

bye

g!rly`

ps : pour supprimer les outils/fix utilisés :

Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

...

g!rly · Answer

De rien Nico70`

je peux te donner ce tutoriel dans un premier temps si l´intrepretation d´un hijack this t´interresse :

https://www.bleepingcomputer.com/tutorials/comment-utiliser-hijackthis/

apres tu pourras me poser des questions ;)

@+

Nico70 · Answer

ok merci problème résolu

g!rly · Answer

;-)
Kisses`

Rapport Hijackthis

22 réponses

Votre réponse

Discussions similaires

Newsletters