Win32/adware.virtumonde

nanie1995 -  
raphy00 Messages postés 1112 Statut Membre -
Bonjour,
mon pc est infecté par win32/adware.virtumonde est je ne sait absoluement pas quoi faire, voici le rapport hijackthis s'il vous plait y a t-il qq'un pour me venir en aide. Un grand merci

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:37:52, on 17/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Controle Parental\bin\optproxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\CONTRO~1\bin\optgui.exe
C:\Program Files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Hercules\WiFi Station pour Livebox\WifiStationLB.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\AxBx\Multi Virus Cleaner 2008\MVC.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/?p=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: (no name) - {01A7812B-59E8-4A4F-BFD6-EEE6D4CB6BA2} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OPTENET_GUI] C:\PROGRA~1\CONTRO~1\bin\optgui.exe
O4 - HKLM\..\Run: [DACSMiniApp] C:\Program Files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe
O4 - HKLM\..\Run: [advap32] "C:\DOCUME~1\CHARLE~1\LOCALS~1\Temp\loader.exe" /r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: WiFi Station pour Livebox.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O16 - DPF: {26D73573-F1B3-48C9-A989-E6CE071957A1} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
O16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} - http://www.edipole.fr/kits/WebInstall.dll
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u1-windows-i586-jc.cab
O16 - DPF: {A82DD34D-F830-49FE-BC3C-E78609AD305B} - http://barremagique.tiscali.fr/download/TiscaliBarreMagique.cab
O16 - DPF: {BFC9677B-8006-4336-9D49-2C797AEFCB9E} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} - http://dialup.carpediem.fr/CABS/1,0,3,8/fr/AccesMembre.cab
O16 - DPF: {E3943A24-2F83-4505-9AE5-F705E81B50CB} - https://www.afternic.com/domains/downloadv3.com
O16 - DPF: {E4DF3688-8FE4-4715-B430-AC0FA547C696} - http://barremagique.tiscali.fr/download/TiscaliBarreMagique.cab
O16 - DPF: {F72BC3F0-6C20-4793-9DDA-258589D8A907} - https://www.afternic.com/domains/downloadv3.com
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: ASP.NET State Service aspnet_stateMessenger (aspnet_stateMessenger) - Unknown owner - C:\WINDOWS\
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: avast! Mail Scanner avast!WebClient (avast!WebClient) - Unknown owner - C:\WINDOWS\
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Assistance TCP/IP NetBIOS LmHostslanmanworkstation (LmHostslanmanworkstation) - Unknown owner - C:\WINDOWS\
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - C:\Program Files\Controle Parental\bin\optproxy.exe
O23 - Service: Plug-and-Play PlugPlaySSDPSRV (PlugPlaySSDPSRV) - Unknown owner - C:\WINDOWS\
O23 - Service: Gestionnaire de comptes de sécurité SamSsdmserver (SamSsdmserver) - Unknown owner - C:\WINDOWS\
O23 - Service: Gestionnaire de comptes de sécurité SamSsmnmsrvc (SamSsmnmsrvc) - Unknown owner - C:\WINDOWS\
O23 - Service: Planificateur de tâches ScheduleDcomLaunch (ScheduleDcomLaunch) - Unknown owner - C:\WINDOWS\
O23 - Service: Spouleur d'impression Spoolerxmlprov (Spoolerxmlprov) - Unknown owner - C:\WINDOWS\
O23 - Service: Acquisition d'image Windows (WIA) stisvcEventSystem (stisvcEventSystem) - Unknown owner - C:\WINDOWS\
O23 - Service: Acquisition d'image Windows (WIA) stisvcEventSystem stisvcEventSystemSamSs (stisvcEventSystemSamSs) - Unknown owner - C:\WINDOWS\
O23 - Service: Hôte de périphérique universel Plug-and-Play upnphostRasAuto (upnphostRasAuto) - Unknown owner - C:\WINDOWS\
O23 - Service: Cliché instantané de volume VSSAlerter (VSSAlerter) - Unknown owner - C:\WINDOWS\
O23 - Service: Centre de sécurité wscsvcSENS (wscsvcSENS) - Unknown owner - C:\WINDOWS\
O23 - Service: Mises à jour automatiques wuauservMessenger (wuauservMessenger) - Unknown owner - C:\WINDOWS\

--
End of file - 8975 bytes
Configuration: Windows XP
Internet Explorer 7.0

8 réponses

  1.
    raphy00 Messages postés 1112 Statut Membre 9
     
    Salut,

    Tu commences par ca :

    Telecharges malwares bytes anti malwares :

    Malwarebytes Anti-Malware: http://www.malwarebytes.org/mbam/program/mbam-setup.exe

    Tutoriel Malwarebytes Anti-Malware: https://forum.pcastuces.com/malwarebytes_antimalwares___tutoriel-f31s3.htm

    Si des elements on ete trouvés > click sur supprimer la selection.

    si il t´es demandé de redemarrer > click sur "yes".

    Fais un scan complet et postes le rapport.
    0
  3. raphy00 Messages postés 1112 Statut Membre 9
     
    Salut alex,

    Cree un nouveau topic, et envoie le lien.
    Et avant tu fais comme lui malwarebytes.

    Ok ? :))
    0
  4. alex 47
     
    merci
    pour le moment il y a jorginho67 qui me propose la même chose
    Je reste avec lui
    mais sinon si çà fait flop je te recontacte(?)
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. raphy00 Messages postés 1112 Statut Membre 9
     
    Re,

    Alex : Reste avec lui il est meilleur que moi, carrement.

    :-))
    0
    1. nanie1995
       
      Voilà j'ai lancé le logiciel malwarebytes et il a pas mal nettoyer mais pas tout, alors que dois faire de plus merci en tout cas de votre aide Voici le rapport

      Malwarebytes' Anti-Malware 1.24
      Version de la base de données: 1060
      Windows 5.1.2600 Service Pack 2

      15:43:58 17/08/2008
      mbam-log-8-17-2008 (15-43-58).txt

      Type de recherche: Examen complet (C:\|)
      Eléments examinés: 88842
      Temps écoulé: 31 minute(s), 47 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 1
      Clé(s) du Registre infectée(s): 10
      Valeur(s) du Registre infectée(s): 4
      Elément(s) de données du Registre infecté(s): 2
      Dossier(s) infecté(s): 12
      Fichier(s) infecté(s): 54

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Delete on reboot.

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{26d73573-f1b3-48c9-a989-e6ce071957a1} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{f8aca5a0-060a-478a-8368-1407780d2251} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{ad9b275b-e42d-4c7f-9ffb-29b5fb81688b} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{bfc9677b-8006-4336-9d49-2c797aefcb9e} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{e3943a24-2f83-4505-9ae5-f705e81b50cb} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{f72bc3f0-6c20-4793-9dda-258589d8a907} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advap32 (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

      Dossier(s) infecté(s):
      C:\Program Files\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\drivers\Winej40.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\drivers\Winsx51.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\drivers\Winek48.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\drivers\Winsx15.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{1432C5C2-F1A4-4243-96FF-4BA5EE0B4BCE}\RP579\A0324555.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{1432C5C2-F1A4-4243-96FF-4BA5EE0B4BCE}\RP579\A0324556.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\rhc5onj0elde.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\rhc5onj0elde.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\loader.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\WinCtrl32.dl_ (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\phc1onj0elde.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\lphc1onj0elde.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\blphc1onj0elde.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\pphc1onj0elde.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\Downloaded Program Files\EGDAccess.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\Downloaded Program Files\EGCOMSERVICE_pack.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\Downloaded Program Files\netslv32.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\mseggrpid.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\qmkicp_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\qmkicp_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
      C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      0
    2. nanie1995
       
      Voilà j'ai lancé le logiciel malwarebytes et il a pas mal nettoyer mais pas tout, alors que dois faire de plus merci en tout cas de votre aide Voici le rapport

      Malwarebytes' Anti-Malware 1.24
      Version de la base de données: 1060
      Windows 5.1.2600 Service Pack 2

      15:43:58 17/08/2008
      mbam-log-8-17-2008 (15-43-58).txt

      Type de recherche: Examen complet (C:\|)
      Eléments examinés: 88842
      Temps écoulé: 31 minute(s), 47 second(s)

      Processus mémoire infecté(s): 0
      Module(s) mémoire infecté(s): 1
      Clé(s) du Registre infectée(s): 10
      Valeur(s) du Registre infectée(s): 4
      Elément(s) de données du Registre infecté(s): 2
      Dossier(s) infecté(s): 12
      Fichier(s) infecté(s): 54

      Processus mémoire infecté(s):
      (Aucun élément nuisible détecté)

      Module(s) mémoire infecté(s):
      C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Delete on reboot.

      Clé(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{26d73573-f1b3-48c9-a989-e6ce071957a1} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Interface\{f8aca5a0-060a-478a-8368-1407780d2251} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_CLASSES_ROOT\Typelib\{ad9b275b-e42d-4c7f-9ffb-29b5fb81688b} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{bfc9677b-8006-4336-9d49-2c797aefcb9e} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{e3943a24-2f83-4505-9ae5-f705e81b50cb} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{f72bc3f0-6c20-4793-9dda-258589d8a907} (Adware.EGDAccess) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WinCtrl32 (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

      Valeur(s) du Registre infectée(s):
      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\advap32 (Trojan.Agent) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

      Elément(s) de données du Registre infecté(s):
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
      HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

      Dossier(s) infecté(s):
      C:\Program Files\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\rhc5onj0elde\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.

      Fichier(s) infecté(s):
      C:\WINDOWS\system32\drivers\Winej40.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\drivers\Winsx51.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\drivers\Winek48.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\drivers\Winsx15.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{1432C5C2-F1A4-4243-96FF-4BA5EE0B4BCE}\RP579\A0324555.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\System Volume Information\_restore{1432C5C2-F1A4-4243-96FF-4BA5EE0B4BCE}\RP579\A0324556.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\rhc5onj0elde.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\rhc5onj0elde.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Program Files\rhc5onj0elde\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\loader.exe (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\WinCtrl32.dll (Trojan.Agent) -> Delete on reboot.
      C:\WINDOWS\system32\WinCtrl32.dl_ (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\~.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\phc1onj0elde.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\lphc1onj0elde.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\blphc1onj0elde.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\pphc1onj0elde.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
      C:\WINDOWS\Downloaded Program Files\EGDAccess.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\Downloaded Program Files\EGCOMSERVICE_pack.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\Downloaded Program Files\netslv32.inf (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\mseggrpid.dll (Adware.EGDAccess) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\qmkicp_navps.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
      C:\WINDOWS\system32\qmkicp_nav.dat (Adware.NaviPromo) -> Quarantined and deleted successfully.
      C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\WINDOWS\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\BN9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      C:\Documents and Settings\charley Alzingre\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
      0
  7. raphy00 Messages postés 1112 Statut Membre 9
     
    Re,

    Ok il fait toujours du bon boulot celui la..

    Maintenant repostes un rapport Hijackthis apres l'avoir renommé en saut.exe.

    :))
    0
  8. nanie1995
     
    Voilà voici mon nouveau rapport, par contre je n'ai pas compris qu'est ce que tu voulais dire dans renommer en saut.exe explique moi comment faire parce que je suis un peu novice en informatique j'essaye peu à peu de m'y mettre parce que cela me plait.
    Merci pour ton aide
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:35:18, on 17/08/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\PROGRA~1\CONTRO~1\bin\optgui.exe
    C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
    C:\Program Files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Controle Parental\bin\optproxy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Hercules\WiFi Station pour Livebox\WifiStationLB.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/?p=us
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O3 - Toolbar: (no name) - {01A7812B-59E8-4A4F-BFD6-EEE6D4CB6BA2} - (no file)
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [OPTENET_GUI] C:\PROGRA~1\CONTRO~1\bin\optgui.exe
    O4 - HKLM\..\Run: [DACSMiniApp] C:\Program Files\Fisher-Price\DACS\MiniApp\DACSMiniApp.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: WiFi Station pour Livebox.lnk = ?
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://home.free.fr/
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/pr02/resources/MSNPUpld.cab
    O16 - DPF: {7DBFDA8E-D33B-11D4-9269-00600868E56E} - http://www.edipole.fr/kits/WebInstall.dll
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u1-windows-i586-jc.cab
    O16 - DPF: {A82DD34D-F830-49FE-BC3C-E78609AD305B} - http://barremagique.tiscali.fr/download/TiscaliBarreMagique.cab
    O16 - DPF: {D1B80EBF-1A26-4FEC-B0B9-DCB934C6507E} - http://dialup.carpediem.fr/CABS/1,0,3,8/fr/AccesMembre.cab
    O16 - DPF: {E4DF3688-8FE4-4715-B430-AC0FA547C696} - http://barremagique.tiscali.fr/download/TiscaliBarreMagique.cab
    O23 - Service: ASP.NET State Service aspnet_stateMessenger (aspnet_stateMessenger) - Unknown owner - C:\WINDOWS\
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: avast! Mail Scanner avast!WebClient (avast!WebClient) - Unknown owner - C:\WINDOWS\
    O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
    O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Assistance TCP/IP NetBIOS LmHostslanmanworkstation (LmHostslanmanworkstation) - Unknown owner - C:\WINDOWS\
    O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Orange Contrôle Parental (OPTENET_FILTER) - Orange - C:\Program Files\Controle Parental\bin\optproxy.exe
    O23 - Service: Plug-and-Play PlugPlaySSDPSRV (PlugPlaySSDPSRV) - Unknown owner - C:\WINDOWS\
    O23 - Service: Gestionnaire de comptes de sécurité SamSsdmserver (SamSsdmserver) - Unknown owner - C:\WINDOWS\
    O23 - Service: Gestionnaire de comptes de sécurité SamSsmnmsrvc (SamSsmnmsrvc) - Unknown owner - C:\WINDOWS\
    O23 - Service: Planificateur de tâches ScheduleDcomLaunch (ScheduleDcomLaunch) - Unknown owner - C:\WINDOWS\
    O23 - Service: Spouleur d'impression Spoolerxmlprov (Spoolerxmlprov) - Unknown owner - C:\WINDOWS\
    O23 - Service: Acquisition d'image Windows (WIA) stisvcEventSystem (stisvcEventSystem) - Unknown owner - C:\WINDOWS\
    O23 - Service: Acquisition d'image Windows (WIA) stisvcEventSystem stisvcEventSystemSamSs (stisvcEventSystemSamSs) - Unknown owner - C:\WINDOWS\
    O23 - Service: Hôte de périphérique universel Plug-and-Play upnphostRasAuto (upnphostRasAuto) - Unknown owner - C:\WINDOWS\
    O23 - Service: Cliché instantané de volume VSSAlerter (VSSAlerter) - Unknown owner - C:\WINDOWS\
    O23 - Service: Centre de sécurité wscsvcSENS (wscsvcSENS) - Unknown owner - C:\WINDOWS\
    O23 - Service: Mises à jour automatiques wuauservMessenger (wuauservMessenger) - Unknown owner - C:\WINDOWS\
    0
  9. raphy00 Messages postés 1112 Statut Membre 9
     
    Re,

    Desolé, c'est vrai que c'est pas evident..

    Tu vas la :

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    Tu renommes hijackThis.exe en saut.exe
    Et tu relances Hijackthis, et postes le rapport.

    Voila :))
    0

Discussions similaires

Problème avec "PUADIManager:Win32/OfferCore
Knaki -
bazfile -

3 réponses
PUADlManager:Win32/OfferCore
tenmalade -
tenmalade -

2 réponses
PUA:Win32/InstallCore detecté par windows sécurité
thetib -
bazfile -

11 réponses
PUADlManager:Win32/OfferCore
bernardarrad -
bazfile -

3 réponses
win32:malware-gen bloqué par avast
ikkual -
Utilisateur anonyme -

69 réponses