Trojans récalcitrantsRésolu/Fermé

Question

Bonjour,


Depuis quelque temps, je suis infecté par un(des ?) trojan(s).

Je reçois régulièrement des fausses alertes du pare feu Windows, m’incitant à aller sur un site web, permettant de télécharger des AdvWare à mon insu. De plus le gestionnaire de tâche à était bloqué.

Apres recherche sur Internet, et scan de avast et de Spybot - Search & Destroy. J’ai réussi à réactiver le gestionnaire de tache, mais je reçois toujours ces fausses alertes du pare-feu.

Que dois-je faire ?
Merci d’avance !

Ps : voici les noms des trojans que le faux pare-feu m’envois :

trojan-spy.win32.keylogger.aa
trojan-spy.html.bankfraud.dq
trojan-downloader.win32.agent.bq
trojan-spy.win32.greenscreen
trojan-clicker.win32.tiny.h

BeFacmoi · Answer

Vu que tu as avast, lance le, et planifie un scan avant le boot de ton windows.

Scipion02 · Answer

J'ai tenté, et cela ne marche pas.

BeFacmoi · Answer

Comment ça cela ne marche pas ? Peux-tu être plus précis ?

Arrives-tu a démarrer Avast et a planifier un scan au prochain boot ?
Si non, quel est le message d'erreur ?

Destrio5 · Answer

Salut,

- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

- Mets-le à jour

- Redémarre en mode sans échec (Recommandé) :
https://www.malekal.com/demarrer-windows-mode-sans-echec/

- Choisis ta session habituelle

- Fais un scan complet avec MalwareByte's Anti-Malware

- Supprime tout ce que le logiciel trouve, enregistre le rapport

- Redémarre en mode normal et poste le rapport ici

Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Scipion02 · Answer

J'avais déjà essayé ! mais pas en mode sans echec, voilà donc le dernier log :

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1071
Windows 5.1.2600 Service Pack 2

23:10:38 19/08/2008
mbam-log-08-19-2008 (23-10-38).txt

Type de recherche: Examen complet (C:\|E:\|F:\|)
Eléments examinés: 105303
Temps écoulé: 1 hour(s), 8 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Destrio5 · Answer

- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

- Clique sur Install ensuite sur I Accept

- Clique sur Do a scan system and save log file

- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.

Scipion02 · Answer

merci de prendre du temps pour moi !

Voilà le rapport :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:35:19, on 20/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\Documents and Settings\All Users\Application Data\bwjypabo	elonijy.exe
E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
F:\steram~1\steam.exe
E:\WINDOWS\system32\dglirqzs.exe
E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\WINDOWS\system32\wuauclt.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Wanadoo
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6488DF32-3582-2E07-8DD6-842DF26C4684} - (no file)
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ForkEach] E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [Steam] "f:\steram~1\steam.exe" -silent
O4 - HKCU\..\Run: [webset] E:\WINDOWS\system32\dglirqzs.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [comappmon] E:\WINDOWS\system32\orsrcvsd.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingD2295] cmd /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB2052] command /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAau.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7084] cmd /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAau.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB619] command /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA_kyf.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3847] cmd /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSA_kyf.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB212] command /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5366] cmd /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAAbout.mht"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8311] command /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1081] cmd /c del "E:\Documents and Settings\All Users\Application Data\SeekmoSA\SeekmoSAEULA.mht"
O4 - HKLM\..\Policies\Explorer\Run: [RRaJS1O11u] E:\Documents and Settings\All Users\Application Data\bwjypabo	elonijy.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] E:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] E:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O21 - SSODL: HlpStrCom - {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Destrio5 · Answer

Ok, je vois les infections.

---> Télécharge Lop S&D sur ton Bureau
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
---> Double-clique dessus pour lancer l'installation
---> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
---> Séléctionne la langue souhaitée, puis choisis l'option 1 (Recherche)
---> Patiente jusqu'à la fin du scan
---> Poste le rapport généré (C:\lopR.txt)

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Si tu as un problème pour utiliser Lop S&D, regarde dans le tutorial :
http://bibou0007.com/outils-specifiques-f78/tutorial-lop-sd-t956.htm#11431

Scipion02 · Answer

Et voilà :


   --------------------\  Lop S&D 4.2.3-2   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Duron(tm) )
   Version 1.00
   USER : Anglais ( Administrator )
   BOOT : Normal boot

   "E:\Lop SD" ( MAJ : 20-08-2008|10:54 )
   Option : [1] ( 20/08/2008|12:44 )
 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [04/02/2006|03:10] E:\DOCUME~1\Alain\APPLIC~1\desktop.ini
   [10/08/2008|18:54] E:\DOCUME~1\Alain\APPLIC~1\Google
   [06/02/2008|15:50] E:\DOCUME~1\Alain\APPLIC~1\Greycake
   [11/02/2006|15:45] E:\DOCUME~1\Alain\APPLIC~1\Help
   [11/02/2006|16:52] E:\DOCUME~1\Alain\APPLIC~1\Identities
   [11/02/2006|01:52] E:\DOCUME~1\Alain\APPLIC~1\Macromedia
   [01/05/2006|11:32] E:\DOCUME~1\Alain\APPLIC~1\Microsoft
   [11/02/2006|13:38] E:\DOCUME~1\Alain\APPLIC~1\Microsoft Web Folders
   [11/02/2006|12:04] E:\DOCUME~1\Alain\APPLIC~1\Symantec

   [11/08/2007|21:05] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [01/09/2007|19:37] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [01/09/2007|19:37] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [17/08/2008|23:38] E:\DOCUME~1\ALLUSE~1\APPLIC~1\bwjypabo
   [06/02/2008|15:51] E:\DOCUME~1\ALLUSE~1\APPLIC~1\DateBowsLoadBash
   [04/02/2006|03:10] E:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [18/08/2008|12:53] E:\DOCUME~1\ALLUSE~1\APPLIC~1\GenInfoCom
   [01/01/2008|15:12] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [19/08/2008|23:17] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [19/08/2008|18:32] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [02/06/2007|15:40] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [05/03/2006|12:14] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [18/02/2006|11:23] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Newsoft
   [11/02/2006|15:42] E:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [18/08/2008|22:10] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [10/08/2008|18:57] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [16/03/2008|14:57] E:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [21/02/2007|20:16] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [10/04/2008|09:05] E:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [12/12/2007|15:25] E:\DOCUME~1\Anglais\APPLIC~1\Adobe
   [02/09/2007|10:38] E:\DOCUME~1\Anglais\APPLIC~1\Apple Computer
   [07/06/2008|17:44] E:\DOCUME~1\Anglais\APPLIC~1\DAEMON Tools
   [04/02/2006|03:10] E:\DOCUME~1\Anglais\APPLIC~1\desktop.ini
   [12/01/2008|20:39] E:\DOCUME~1\Anglais\APPLIC~1\EoRezo
   [01/01/2008|16:14] E:\DOCUME~1\Anglais\APPLIC~1\Google
   [06/02/2008|15:51] E:\DOCUME~1\Anglais\APPLIC~1\Greycake
   [10/08/2008|10:33] E:\DOCUME~1\Anglais\APPLIC~1\gtk-2.0
   [20/03/2007|16:07] E:\DOCUME~1\Anglais\APPLIC~1\Help
   [04/02/2007|17:43] E:\DOCUME~1\Anglais\APPLIC~1\Identities
   [12/01/2008|20:33] E:\DOCUME~1\Anglais\APPLIC~1\ItsLabel
   [05/02/2007|16:35] E:\DOCUME~1\Anglais\APPLIC~1\Macromedia
   [19/08/2008|18:32] E:\DOCUME~1\Anglais\APPLIC~1\Malwarebytes
   [07/04/2008|19:34] E:\DOCUME~1\Anglais\APPLIC~1\Microsoft
   [14/04/2008|15:00] E:\DOCUME~1\Anglais\APPLIC~1\Mozilla
   [29/07/2008|12:10] E:\DOCUME~1\Anglais\APPLIC~1\QuickZip45.ini
   [01/01/2008|15:13] E:\DOCUME~1\Anglais\APPLIC~1\Sun
   [05/01/2008|14:35] E:\DOCUME~1\Anglais\APPLIC~1\Talkback
   [12/08/2007|17:14] E:\DOCUME~1\Anglais\APPLIC~1\vlc

   [04/02/2006|03:10] E:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [04/02/2006|02:27] E:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [04/02/2006|02:27] E:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [12/05/2007|17:40] E:\DOCUME~1\LOCALS~1\APPLIC~1\Symantec

   [04/02/2006|02:27] E:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [03/08/2007|13:07] E:\DOCUME~1\Quentin\APPLIC~1\Aimfast
   [04/02/2006|03:10] E:\DOCUME~1\Quentin\APPLIC~1\desktop.ini
   [06/08/2006|11:26] E:\DOCUME~1\Quentin\APPLIC~1\Google
   [06/02/2008|15:53] E:\DOCUME~1\Quentin\APPLIC~1\Greycake
   [05/05/2007|08:27] E:\DOCUME~1\Quentin\APPLIC~1\Greycake(2)
   [14/02/2006|23:59] E:\DOCUME~1\Quentin\APPLIC~1\Help
   [11/02/2006|17:26] E:\DOCUME~1\Quentin\APPLIC~1\Identities
   [11/02/2006|17:28] E:\DOCUME~1\Quentin\APPLIC~1\Macromedia
   [11/02/2007|15:19] E:\DOCUME~1\Quentin\APPLIC~1\MessengerPlus! 3
   [03/02/2007|21:32] E:\DOCUME~1\Quentin\APPLIC~1\Microsoft
   [30/07/2007|19:13] E:\DOCUME~1\Quentin\APPLIC~1\QuickZip45.ini
   [20/07/2007|20:39] E:\DOCUME~1\Quentin\APPLIC~1\vlc
 
   --------------------\  Tâches planifiées dans E:\WINDOWS	asks

   [29/07/2008 17:07][--a------] E:\WINDOWS	asks\AppleSoftwareUpdate.job
   [20/08/2008 12:00][--ah-----] E:\WINDOWS	asks\AC4273AE9181E6C6.job
   [20/08/2008 12:00][--ah-----] E:\WINDOWS	asks\A93C681891981D1C.job
   [20/08/2008 12:00][--ah-----] E:\WINDOWS	asks\AEC56697918B1693.job
   [20/08/2008 09:28][--ah-----] E:\WINDOWS	asks\SA.DAT
   [28/09/2001 14:00][-r-h-----] E:\WINDOWS	asks\desktop.ini

   ( A93C681891981D1C.job )=( e:\docume~1\anglais\applic~1\greycake\Acidglueshow.exe )
   ( AC4273AE9181E6C6.job )=( e:\docume~1\quentin\applic~1\greycake\Acidglueshow.exe )
   ( AEC56697918B1693.job )=( e:\docume~1\alain\applic~1\greycake\Acidglueshow.exe )

   --------------------\  Listing des dossiers dans E:\Program Files

   [18/11/2007|15:05] E:\Program Files\Adobe
   [11/02/2006|13:02] E:\Program Files\Ahead
   [04/02/2006|02:52] E:\Program Files\AIDA32 - Personal System Information
   [06/02/2008|15:25] E:\Program Files\Alwil Software
   [01/09/2007|19:37] E:\Program Files\Apple Software Update
   [20/03/2007|16:07] E:\Program Files\AutoREALM
   [18/11/2007|15:03] E:\Program Files\BlueSquad
   [05/05/2007|08:53] E:\Program Files\CCleaner
   [04/02/2006|02:19] E:\Program Files\ComPlus Applications
   [11/06/2008|13:47] E:\Program Files\directx
   [07/04/2008|13:12] E:\Program Files\DivX
   [11/02/2006|19:37] E:\Program Files\dpp
   [12/01/2008|20:39] E:\Program Files\EoRezo
   [10/08/2008|18:57] E:\Program Files\Fichiers communs
   [15/03/2008|21:17] E:\Program Files\FLV Player
   [13/04/2008|10:50] E:\Program Files\GIMP-2.0
   [02/01/2008|11:07] E:\Program Files\Google
   [11/06/2008|13:46] E:\Program Files\InstallShield Installation Information
   [25/06/2008|09:16] E:\Program Files\Internet Explorer
   [01/01/2008|15:12] E:\Program Files\Java
   [10/08/2008|18:54] E:\Program Files\lracan
   [19/08/2008|18:32] E:\Program Files\Malwarebytes' Anti-Malware
   [11/02/2006|02:13] E:\Program Files\Messenger
   [06/04/2008|10:45] E:\Program Files\Messenger Plus! Live
   [30/03/2008|20:16] E:\Program Files\MessengerPlus! 3
   [11/02/2006|15:41] E:\Program Files\microsoft frontpage
   [11/02/2006|15:42] E:\Program Files\Microsoft Office
   [16/03/2008|12:06] E:\Program Files\Movie Maker
   [20/08/2008|11:57] E:\Program Files\Mozilla Firefox
   [04/02/2006|02:18] E:\Program Files\MSN
   [04/02/2006|02:18] E:\Program Files\MSN Gaming Zone
   [06/04/2008|10:45] E:\Program Files\MSN Messenger
   [29/03/2008|15:35] E:\Program Files\MSXML 4.0
   [25/07/2006|22:59] E:\Program Files\Net Pro Anti Popup
   [30/05/2007|10:23] E:\Program Files\NetMeeting
   [18/02/2006|11:25] E:\Program Files\NewSoft
   [04/02/2006|02:18] E:\Program Files\Online Services
   [13/01/2008|01:27] E:\Program Files\Outlook Express
   [08/03/2008|15:42] E:\Program Files\Picasa2
   [01/09/2007|19:38] E:\Program Files\QuickTime
   [30/05/2006|18:26] E:\Program Files\QuickZip4
   [07/05/2007|10:00] E:\Program Files\RegCleaner
   [07/05/2007|11:36] E:\Program Files\SAGEM
   [07/05/2007|11:36] E:\Program Files\SAGEM Wi-Fi USB 802.11g
   [04/02/2006|02:25] E:\Program Files\Services en ligne
   [11/02/2006|15:42] E:\Program Files\Snapshot Viewer
   [18/08/2008|19:24] E:\Program Files\Spybot - Search & Destroy
   [23/01/2008|16:19] E:\Program Files\StepMania CVS
   [11/05/2007|22:09] E:\Program Files\Symantec
   [11/05/2007|22:08] E:\Program Files\SymNetDrv
   [20/08/2008|09:34] E:\Program Files\Trend Micro
   [04/02/2006|02:35] E:\Program Files\Uninstall Information
   [13/01/2008|01:09] E:\Program Files\UxTheme Multipatcher Fr
   [10/08/2008|21:59] E:\Program Files\Wanadoo
   [10/04/2008|09:06] E:\Program Files\Windows Live
   [04/06/2008|08:48] E:\Program Files\Windows Media Player
   [04/02/2006|02:18] E:\Program Files\Windows NT
   [04/02/2006|02:25] E:\Program Files\WindowsUpdate
   [04/02/2006|02:28] E:\Program Files\xerox
   [28/05/2008|11:14] E:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans E:\Program Files\Fichiers communs

   [25/11/2007|16:50] E:\Program Files\Fichiers communs\Adobe
   [11/02/2006|13:02] E:\Program Files\Fichiers communs\Ahead
   [11/02/2006|13:40] E:\Program Files\Fichiers communs\Designer
   [18/02/2006|11:21] E:\Program Files\Fichiers communs\Digi338
   [30/06/2007|07:49] E:\Program Files\Fichiers communs\InstallShield
   [01/01/2008|15:11] E:\Program Files\Fichiers communs\Java
   [10/02/2008|11:38] E:\Program Files\Fichiers communs\Microsoft Shared
   [04/02/2006|02:20] E:\Program Files\Fichiers communs\MSSoap
   [30/03/2008|20:57] E:\Program Files\Fichiers communs\NewSoft
   [04/02/2006|03:10] E:\Program Files\Fichiers communs\ODBC
   [04/02/2006|02:20] E:\Program Files\Fichiers communs\Services
   [04/02/2006|03:10] E:\Program Files\Fichiers communs\SpeechEngines
   [10/08/2008|21:05] E:\Program Files\Fichiers communs\Symantec Shared
   [13/06/2007|10:22] E:\Program Files\Fichiers communs\System

   --------------------\  Process

   ( 39 Processus )

   ... OK !

   --------------------\  Recherche avec S_Lop

   E:\DOCUME~1\Alain\APPLIC~1\Greycake
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   E:\DOCUME~1\Alain\APPLIC~1\greycake
   E:\DOCUME~1\Anglais\APPLIC~1\greycake
   E:\DOCUME~1\Quentin\APPLIC~1\greycake
   E:\DOCUME~1\Anglais\Cookies\anglais@www.adserver5[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@adultfriendfinder[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@search.adultfriendfinder[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@advertising[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@banner.cotedazurpalace[2].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@cotedazurpalace[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@vegas-millions[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@www.lop[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@888[1].txt
   E:\DOCUME~1\Anglais\Cookies\anglais@888[2].txt
   E:\WINDOWS\Tasks\A93C681891981D1C.job
   E:\WINDOWS\Tasks\AC4273AE9181E6C6.job
   E:\WINDOWS\Tasks\AEC56697918B1693.job
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\free mpeg move]
   "DisplayName"="CiD Help"
   "UninstallString"="E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe -uninstall"

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "ForkEach"="E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe"
   "ForkEach"="E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe"

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts MODIFIE

   127.0.0.1 bin.errorprotector.com ## added by CiD
   127.0.0.1 br.errorsafe.com ## added by CiD
   127.0.0.1 br.winantivirus.com ## added by CiD
   127.0.0.1 br.winfixer.com ## added by CiD
   127.0.0.1 cdn.drivecleaner.com ## added by CiD
   127.0.0.1 cdn.errorsafe.com ## added by CiD
   127.0.0.1 cdn.winsoftware.com ## added by CiD
   127.0.0.1 de.errorsafe.com ## added by CiD
   127.0.0.1 de.winantivirus.com ## added by CiD
   127.0.0.1 download.cdn.drivecleaner.com ## added by CiD
   127.0.0.1 download.cdn.errorsafe.com ## added by CiD
   127.0.0.1 download.cdn.winsoftware.com ## added by CiD
   127.0.0.1 download.errorsafe.com ## added by CiD
   127.0.0.1 download.systemdoctor.com ## added by CiD
   127.0.0.1 download.winantispyware.com ## added by CiD
   127.0.0.1 download.windrivecleaner.com ## added by CiD
   127.0.0.1 download.winfixer.com ## added by CiD
   127.0.0.1 drivecleaner.com ## added by CiD
   127.0.0.1 dynamique.drivecleaner.com ## added by CiD
   127.0.0.1 errorprotector.com ## added by CiD
   127.0.0.1 errorsafe.com ## added by CiD
   127.0.0.1 es.winantivirus.com ## added by CiD
   127.0.0.1 fr.winantivirus.com ## added by CiD
   127.0.0.1 fr.winfixer.com ## added by CiD
   127.0.0.1 go.drivecleaner.com ## added by CiD
   127.0.0.1 go.errorsafe.com ## added by CiD
   127.0.0.1 go.winantispyware.com ## added by CiD
   127.0.0.1 go.winantivirus.com ## added by CiD
   127.0.0.1 hk.winantivirus.com ## added by CiD
   127.0.0.1 instlog.errorsafe.com ## added by CiD
   127.0.0.1 instlog.winantivirus.com ## added by CiD
   127.0.0.1 instlog.winfixer.com ## added by CiD
   127.0.0.1 jsp.drivecleaner.com ## added by CiD
   127.0.0.1 kb.errorsafe.com ## added by CiD
   127.0.0.1 kb.winantivirus.com ## added by CiD
   127.0.0.1 nl.errorsafe.com ## added by CiD
   127.0.0.1 se.errorsafe.com ## added by CiD
   127.0.0.1 secure.drivecleaner.com ## added by CiD
   127.0.0.1 secure.errorsafe.com ## added by CiD
   127.0.0.1 secure.winantispam.com ## added by CiD
   127.0.0.1 secure.winantispy.com ## added by CiD
   127.0.0.1 secure.winantivirus.com ## added by CiD
   127.0.0.1 support.winantivirus.com ## added by CiD
   127.0.0.1 trial.updates.winsoftware.com ## added by CiD
   127.0.0.1 ulog.winantivirus.com ## added by CiD
   127.0.0.1 utils.errorsafe.com ## added by CiD
   127.0.0.1 utils.winantivirus.com ## added by CiD
   127.0.0.1 utils.winfixer.com ## added by CiD
   127.0.0.1 winantispyware.com ## added by CiD
   127.0.0.1 winantivirus.com ## added by CiD
   127.0.0.1 winfixer.com ## added by CiD
   127.0.0.1 winfixer2006.com ## added by CiD
   127.0.0.1 winsoftware.com ## added by CiD
   127.0.0.1 [i]ww/iw.drivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorprotector.com ## added by CiD
   127.0.0.1 [i]ww/iw.errorsafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.systemdoctor.com ## added by CiD
   127.0.0.1 [i]ww/iw.utils.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-anti-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.win-virus-pro.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispam.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispy.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantispyware.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantivirus.com ## added by CiD
   127.0.0.1 [i]ww/iw.winantiviruspro.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivecleaner.com ## added by CiD
   127.0.0.1 [i]ww/iw.windrivesafe.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer.com ## added by CiD
   127.0.0.1 [i]ww/iw.winfixer2006.com ## added by CiD
   127.0.0.1 [i]ww/iw.winsoftware.com ## added by CiD

   -> 9031 [ 70 ## added by CiD ]

   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-08-20 12:48:04
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 91
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:342][D:68]-> E:\DOCUME~1\Anglais\LOCALS~1\Temp
   [F:160][D:0]-> E:\DOCUME~1\Anglais\Cookies
   [F:5686][D:12]-> F:	empo\TEMPOR~1\content.IE5

   --------------------\  Fin du rapport a 12:50:13

Destrio5 · Answer

---> Relance Lop S&D
---> Choisis cette fois-ci l'option 2 (Suppression)
---> Ne ferme pas la fenêtre lors de la suppression !
---> Poste le rapport généré (C:\lopR.txt)

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet Fichier, Nouvelle tâche, tape explorer.exe et valide)

Scipion02 · Answer

Voici :


   --------------------\  Lop S&D 4.2.3-2   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free : AMD Duron(tm) )
   Version 1.00
   USER : Anglais ( Administrator )
   BOOT : Normal boot

   "E:\Lop SD" ( MAJ : 20-08-2008|10:54 )
   Option : [2] ( 20/08/2008|13:02 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@www.adserver5[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@adultfriendfinder[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@search.adultfriendfinder[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@advertising[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@banner.cotedazurpalace[2].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@cotedazurpalace[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@vegas-millions[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@www.lop[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@888[1].txt
   Supprime! - E:\DOCUME~1\Anglais\Cookies\anglais@888[2].txt
   Supprime! - E:\WINDOWS\Tasks\A93C681891981D1C.job 
   Supprime! - E:\WINDOWS\Tasks\AC4273AE9181E6C6.job 
   Supprime! - E:\WINDOWS\Tasks\AEC56697918B1693.job 
   Supprime! - E:\DOCUME~1\Alain\APPLIC~1\greycake
   Supprime! - E:\DOCUME~1\Anglais\APPLIC~1\greycake
   Supprime! - E:\DOCUME~1\Quentin\APPLIC~1\greycake
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [04/02/2006|03:10] E:\DOCUME~1\Alain\APPLIC~1\desktop.ini
   [10/08/2008|18:54] E:\DOCUME~1\Alain\APPLIC~1\Google
   [11/02/2006|15:45] E:\DOCUME~1\Alain\APPLIC~1\Help
   [11/02/2006|16:52] E:\DOCUME~1\Alain\APPLIC~1\Identities
   [11/02/2006|01:52] E:\DOCUME~1\Alain\APPLIC~1\Macromedia
   [01/05/2006|11:32] E:\DOCUME~1\Alain\APPLIC~1\Microsoft
   [11/02/2006|13:38] E:\DOCUME~1\Alain\APPLIC~1\Microsoft Web Folders
   [11/02/2006|12:04] E:\DOCUME~1\Alain\APPLIC~1\Symantec

   [11/08/2007|21:05] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [01/09/2007|19:37] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [01/09/2007|19:37] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [17/08/2008|23:38] E:\DOCUME~1\ALLUSE~1\APPLIC~1\bwjypabo
   [06/02/2008|15:51] E:\DOCUME~1\ALLUSE~1\APPLIC~1\DateBowsLoadBash
   [04/02/2006|03:10] E:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
   [18/08/2008|12:53] E:\DOCUME~1\ALLUSE~1\APPLIC~1\GenInfoCom
   [01/01/2008|15:12] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [19/08/2008|23:17] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
   [19/08/2008|18:32] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [02/06/2007|15:40] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
   [05/03/2006|12:14] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [18/02/2006|11:23] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Newsoft
   [11/02/2006|15:42] E:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [18/08/2008|22:10] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [10/08/2008|18:57] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [16/03/2008|14:57] E:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [21/02/2007|20:16] E:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [10/04/2008|09:05] E:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [12/12/2007|15:25] E:\DOCUME~1\Anglais\APPLIC~1\Adobe
   [02/09/2007|10:38] E:\DOCUME~1\Anglais\APPLIC~1\Apple Computer
   [07/06/2008|17:44] E:\DOCUME~1\Anglais\APPLIC~1\DAEMON Tools
   [04/02/2006|03:10] E:\DOCUME~1\Anglais\APPLIC~1\desktop.ini
   [12/01/2008|20:39] E:\DOCUME~1\Anglais\APPLIC~1\EoRezo
   [01/01/2008|16:14] E:\DOCUME~1\Anglais\APPLIC~1\Google
   [10/08/2008|10:33] E:\DOCUME~1\Anglais\APPLIC~1\gtk-2.0
   [20/03/2007|16:07] E:\DOCUME~1\Anglais\APPLIC~1\Help
   [04/02/2007|17:43] E:\DOCUME~1\Anglais\APPLIC~1\Identities
   [12/01/2008|20:33] E:\DOCUME~1\Anglais\APPLIC~1\ItsLabel
   [05/02/2007|16:35] E:\DOCUME~1\Anglais\APPLIC~1\Macromedia
   [19/08/2008|18:32] E:\DOCUME~1\Anglais\APPLIC~1\Malwarebytes
   [07/04/2008|19:34] E:\DOCUME~1\Anglais\APPLIC~1\Microsoft
   [14/04/2008|15:00] E:\DOCUME~1\Anglais\APPLIC~1\Mozilla
   [29/07/2008|12:10] E:\DOCUME~1\Anglais\APPLIC~1\QuickZip45.ini
   [01/01/2008|15:13] E:\DOCUME~1\Anglais\APPLIC~1\Sun
   [05/01/2008|14:35] E:\DOCUME~1\Anglais\APPLIC~1\Talkback
   [12/08/2007|17:14] E:\DOCUME~1\Anglais\APPLIC~1\vlc

   [04/02/2006|03:10] E:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
   [04/02/2006|02:27] E:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [04/02/2006|02:27] E:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [12/05/2007|17:40] E:\DOCUME~1\LOCALS~1\APPLIC~1\Symantec

   [04/02/2006|02:27] E:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [03/08/2007|13:07] E:\DOCUME~1\Quentin\APPLIC~1\Aimfast
   [04/02/2006|03:10] E:\DOCUME~1\Quentin\APPLIC~1\desktop.ini
   [06/08/2006|11:26] E:\DOCUME~1\Quentin\APPLIC~1\Google
   [05/05/2007|08:27] E:\DOCUME~1\Quentin\APPLIC~1\Greycake(2)
   [14/02/2006|23:59] E:\DOCUME~1\Quentin\APPLIC~1\Help
   [11/02/2006|17:26] E:\DOCUME~1\Quentin\APPLIC~1\Identities
   [11/02/2006|17:28] E:\DOCUME~1\Quentin\APPLIC~1\Macromedia
   [11/02/2007|15:19] E:\DOCUME~1\Quentin\APPLIC~1\MessengerPlus! 3
   [03/02/2007|21:32] E:\DOCUME~1\Quentin\APPLIC~1\Microsoft
   [30/07/2007|19:13] E:\DOCUME~1\Quentin\APPLIC~1\QuickZip45.ini
   [20/07/2007|20:39] E:\DOCUME~1\Quentin\APPLIC~1\vlc
 
   --------------------\  Tâches planifiées dans E:\WINDOWS	asks

   [29/07/2008 17:07][--a------] E:\WINDOWS	asks\AppleSoftwareUpdate.job
   [20/08/2008 09:28][--ah-----] E:\WINDOWS	asks\SA.DAT
   [28/09/2001 14:00][-r-h-----] E:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans E:\Program Files

   [18/11/2007|15:05] E:\Program Files\Adobe
   [11/02/2006|13:02] E:\Program Files\Ahead
   [04/02/2006|02:52] E:\Program Files\AIDA32 - Personal System Information
   [06/02/2008|15:25] E:\Program Files\Alwil Software
   [01/09/2007|19:37] E:\Program Files\Apple Software Update
   [20/03/2007|16:07] E:\Program Files\AutoREALM
   [18/11/2007|15:03] E:\Program Files\BlueSquad
   [05/05/2007|08:53] E:\Program Files\CCleaner
   [04/02/2006|02:19] E:\Program Files\ComPlus Applications
   [11/06/2008|13:47] E:\Program Files\directx
   [07/04/2008|13:12] E:\Program Files\DivX
   [11/02/2006|19:37] E:\Program Files\dpp
   [12/01/2008|20:39] E:\Program Files\EoRezo
   [10/08/2008|18:57] E:\Program Files\Fichiers communs
   [15/03/2008|21:17] E:\Program Files\FLV Player
   [13/04/2008|10:50] E:\Program Files\GIMP-2.0
   [02/01/2008|11:07] E:\Program Files\Google
   [11/06/2008|13:46] E:\Program Files\InstallShield Installation Information
   [25/06/2008|09:16] E:\Program Files\Internet Explorer
   [01/01/2008|15:12] E:\Program Files\Java
   [10/08/2008|18:54] E:\Program Files\lracan
   [19/08/2008|18:32] E:\Program Files\Malwarebytes' Anti-Malware
   [11/02/2006|02:13] E:\Program Files\Messenger
   [06/04/2008|10:45] E:\Program Files\Messenger Plus! Live
   [30/03/2008|20:16] E:\Program Files\MessengerPlus! 3
   [11/02/2006|15:41] E:\Program Files\microsoft frontpage
   [11/02/2006|15:42] E:\Program Files\Microsoft Office
   [16/03/2008|12:06] E:\Program Files\Movie Maker
   [20/08/2008|11:57] E:\Program Files\Mozilla Firefox
   [04/02/2006|02:18] E:\Program Files\MSN
   [04/02/2006|02:18] E:\Program Files\MSN Gaming Zone
   [06/04/2008|10:45] E:\Program Files\MSN Messenger
   [29/03/2008|15:35] E:\Program Files\MSXML 4.0
   [25/07/2006|22:59] E:\Program Files\Net Pro Anti Popup
   [30/05/2007|10:23] E:\Program Files\NetMeeting
   [18/02/2006|11:25] E:\Program Files\NewSoft
   [04/02/2006|02:18] E:\Program Files\Online Services
   [13/01/2008|01:27] E:\Program Files\Outlook Express
   [08/03/2008|15:42] E:\Program Files\Picasa2
   [01/09/2007|19:38] E:\Program Files\QuickTime
   [30/05/2006|18:26] E:\Program Files\QuickZip4
   [07/05/2007|10:00] E:\Program Files\RegCleaner
   [07/05/2007|11:36] E:\Program Files\SAGEM
   [07/05/2007|11:36] E:\Program Files\SAGEM Wi-Fi USB 802.11g
   [04/02/2006|02:25] E:\Program Files\Services en ligne
   [11/02/2006|15:42] E:\Program Files\Snapshot Viewer
   [18/08/2008|19:24] E:\Program Files\Spybot - Search & Destroy
   [23/01/2008|16:19] E:\Program Files\StepMania CVS
   [11/05/2007|22:09] E:\Program Files\Symantec
   [11/05/2007|22:08] E:\Program Files\SymNetDrv
   [20/08/2008|09:34] E:\Program Files\Trend Micro
   [04/02/2006|02:35] E:\Program Files\Uninstall Information
   [13/01/2008|01:09] E:\Program Files\UxTheme Multipatcher Fr
   [10/08/2008|21:59] E:\Program Files\Wanadoo
   [10/04/2008|09:06] E:\Program Files\Windows Live
   [04/06/2008|08:48] E:\Program Files\Windows Media Player
   [04/02/2006|02:18] E:\Program Files\Windows NT
   [04/02/2006|02:25] E:\Program Files\WindowsUpdate
   [04/02/2006|02:28] E:\Program Files\xerox
   [28/05/2008|11:14] E:\Program Files\Zero G Registry

   --------------------\  Listing des dossiers dans E:\Program Files\Fichiers communs

   [25/11/2007|16:50] E:\Program Files\Fichiers communs\Adobe
   [11/02/2006|13:02] E:\Program Files\Fichiers communs\Ahead
   [11/02/2006|13:40] E:\Program Files\Fichiers communs\Designer
   [18/02/2006|11:21] E:\Program Files\Fichiers communs\Digi338
   [30/06/2007|07:49] E:\Program Files\Fichiers communs\InstallShield
   [01/01/2008|15:11] E:\Program Files\Fichiers communs\Java
   [10/02/2008|11:38] E:\Program Files\Fichiers communs\Microsoft Shared
   [04/02/2006|02:20] E:\Program Files\Fichiers communs\MSSoap
   [30/03/2008|20:57] E:\Program Files\Fichiers communs\NewSoft
   [04/02/2006|03:10] E:\Program Files\Fichiers communs\ODBC
   [04/02/2006|02:20] E:\Program Files\Fichiers communs\Services
   [04/02/2006|03:10] E:\Program Files\Fichiers communs\SpeechEngines
   [10/08/2008|21:05] E:\Program Files\Fichiers communs\Symantec Shared
   [13/06/2007|10:22] E:\Program Files\Fichiers communs\System

   --------------------\  Process

   ( 40 Processus )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-08-20 13:04:47
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 91
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:344][D:68]-> E:\DOCUME~1\Anglais\LOCALS~1\Temp
   [F:150][D:0]-> E:\DOCUME~1\Anglais\Cookies
   [F:5712][D:12]-> F:	empo\TEMPOR~1\content.IE5

   --------------------\  Fin du rapport a 13:06:43

Destrio5 · Answer

Désinstalle Lop S&D.

---> Télécharge OTMoveIt2 à partir du lien ci-dessous : 
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe 

---> Enregistre le fichier sur le Bureau.

---> Double-clique sur le fichier OTMoveIt2.exe pour lancer l'outil.
Assure-toi que la case Unregister Dll's and Ocx's soit bien cochée.

---> Copie l'intégralité du texte ci-dessous et colle-le dans la fenêtre intitulée Paste Standard List of Files/Folders to be moved.



E:\DOCUME~1\ALLUSE~1\APPLIC~1\bwjypabo\
E:\DOCUME~1\ALLUSE~1\APPLIC~1\DateBowsLoadBash\
E:\DOCUME~1\Quentin\APPLIC~1\Greycake(2)\
E:\WINDOWS\system32\dglirqzs.exe 
E:\WINDOWS\system32\orsrcvsd.exe 


---> Clique sur MoveIt! pour lancer la suppression.
Lorsqu'un résultat apparaît dans le cadre Results, clique sur Exit.

Note : Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. Accepte en cliquant sur YES. 

---> Poste le rapport de OTMoveIt qui se trouve dans C:\_OTMoveIt\MovedFiles.

Scipion02 · Answer

logiquement, c'est ceci :

E:\DOCUME~1\ALLUSE~1\APPLIC~1\bwjypabo moved successfully.
E:\DOCUME~1\ALLUSE~1\APPLIC~1\DateBowsLoadBash moved successfully.
E:\DOCUME~1\Quentin\APPLIC~1\Greycake(2) moved successfully.
E:\WINDOWS\system32\dglirqzs.exe moved successfully.
E:\WINDOWS\system32\orsrcvsd.exe moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08202008_183833

Destrio5 · Answer

Bien.

- Télécharge Deckard's System Scanner (DSS) sur ton bureau :
http://deckard.geekstogo.com/dss.exe
- Ferme toutes les applications en cours antivirus y compris
- Double-clique sur dss.exe pour lancer le soft 
- S'il ne trouve pas HijackThis, clique sur Oui    
- Clique sur OK à chaque fois que cela sera demandé
- L'analyse finie, un fichier texte s'affichera. Enregistre-le et poste-le.
- Le rapport se trouve ici : C:\Deckard\System Scanner\main.txt

Scipion02 · Answer

Le lien est Hs :s

Et je n'ai pas trouver d'autre site de téléchargement opérationnel.

Destrio5 · Answer

Ok, pour l'instant, il n'est plus disponible, il ne faut plus l'utiliser.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix.txt

Scipion02 · Answer

Voilà : ComboFix 08-08-19.02 - Anglais 2008-08-20 19:53:07.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.245 [GMT 2:00] Endroit: E:\Documents and Settings\Anglais\Bureau\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . E:\Documents and Settings\Alain\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML E:\Documents and Settings\Anglais\Cookies\anglais@edt02[1].txt E:\Documents and Settings\Anglais\Cookies\anglais@serving-sys[1].txt . ((((((((((((((((((((((((((((( Fichiers créés 2008-07-20 to 2008-08-20 )))))))))))))))))))))))))))))))))))) . 2008-08-20 18:58 . 2008-08-20 18:58 86,016 --a------ E:\WINDOWS\system32\jmvipaze.exe 2008-08-20 18:38 . 2008-08-20 18:38 d-------- E:\_OTMoveIt 2008-08-20 12:44 . 2008-08-20 13:06 d-------- E:\Lop SD 2008-08-20 10:00 . 2008-08-20 10:00 86,016 --a------ E:\WINDOWS\system32\honmhalm.exe 2008-08-20 09:34 . 2008-08-20 09:34 d-------- E:\Program Files\Trend Micro 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Program Files\Malwarebytes' Anti-Malware 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Documents and Settings\Anglais\Application Data\Malwarebytes 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-19 18:32 . 2008-08-17 15:01 38,472 --a------ E:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-19 18:32 . 2008-08-17 15:01 17,144 --a------ E:\WINDOWS\system32\drivers\mbam.sys 2008-08-19 10:51 . 2008-08-19 10:57 17,454 --a------ E:\WINDOWS\wininit.ini 2008-08-18 19:23 . 2008-08-18 19:24 d-------- E:\Program Files\Spybot - Search & Destroy 2008-08-18 19:23 . 2008-08-18 22:10 d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-17 23:40 . 2008-08-17 23:40 54,156 --ah----- E:\WINDOWS\QTFont.qfn 2008-08-17 23:40 . 2008-08-17 23:40 1,409 --a------ E:\WINDOWS\QTFont.for 2008-08-11 01:42 . 2008-08-11 01:53 d-------- E:\WINDOWS\system32\NtmsData 2008-08-10 18:54 . 2008-08-10 18:54 d-------- E:\Program Files\lracan 2008-08-10 18:40 . 2008-08-18 12:53 d-------- E:\Documents and Settings\All Users\Application Data\GenInfoCom . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-19 21:17 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater 2008-08-10 19:59 --------- d-----w E:\Program Files\Wanadoo 2008-08-10 19:05 --------- d-----w E:\Program Files\Fichiers communs\Symantec Shared 2008-08-10 16:57 --------- d-----w E:\Documents and Settings\All Users\Application Data\Symantec 2008-08-10 08:33 --------- d-----w E:\Documents and Settings\Anglais\Application Data\gtk-2.0 2008-06-20 17:41 247,808 ----a-w E:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w E:\WINDOWS\system32\drivers cpip.sys 2008-06-20 10:44 138,368 ----a-w E:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w E:\WINDOWS\system32\drivers cpip6.sys 2006-08-05 09:04 21,924,135 -c--a-w E:\Documents and Settings\Alain\securitoo_controle_parental_orange_r8.exe 1998-08-24 11:09 10,000 -c--a-w E:\WINDOWS\inf\unregpn.exe . ------- Sigcheck ------- 2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\explorer.exe 2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 E:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-19 18:09 1036288 2a7bd330924252a2fd80344fc949bb72 E:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\system32\dllcache\explorer.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-10 13:47 68856] "Picasa Media Detector"="E:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968] "Steam"="f:\steram~1\steam.exe" [2008-07-31 15:34 1271032] "SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720] "avast!"="E:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 16:38 78008] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "ALUAlert"="E:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [2006-08-03 17:29 67264] E:\Documents and Settings\Anglais\Menu D‚marrer\Programmes\D‚marrage\ TransBar.lnk - E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 21:41:18 65536] UberIcon.lnk - E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 09:43:08 180224] Y'z Shadow.lnk - E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 09:43:14 155648] E:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Microsoft Office.lnk - E:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-18 00:05:56 65588] Outil de mise … jour Google.lnk - E:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-10 13:46:58 124912] Utilitaire r‚seau pour SAGEM Wi-Fi 11g USB adapter.lnk - E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe [2007-05-07 11:36:41 835584] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "HlpStrCom"= {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll [2008-08-10 18:54 102400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.NSVI"= NSVIDEO.DLL "VIDC.JPEG"= JpegCode.dll "VIDC.MJPG"= JpegCode.dll "VIDC.HFYU"= huffyuv.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "E:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"= "E:\Program Files\Messenger\msmsgs.exe"= "E:\Program Files\MSN Messenger\msnmsgr.exe"= "E:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 aswSP;avast! Self Protection;E:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;E:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 NwSapAgent;Agent SAP;E:\WINDOWS\system32\svchost.exe [2004-08-19 18:10] R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;E:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37] S3 DSCVc;Video Capture;E:\WINDOWS\system32\DRIVERS\CoachVc.sys [2003-11-03 18:31] S3 ZDCndis5;ZDCndis5 Protocol Driver;E:\WINDOWS\system32\ZDCndis5.SYS [] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 *Newly Created Service* - ZDPNDIS5 . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' 2008-07-29 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job - E:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42] . - - - - ORPHANS REMOVED - - - - BHO-{6488DF32-3582-2E07-8DD6-842DF26C4684} - (no file) HKCU-Run-webset - E:\WINDOWS\system32\dglirqzs.exe HKCU-Run-comappmon - E:\WINDOWS\system32\orsrcvsd.exe HKCU-Run-ForkEach - E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe HKLM-Explorer_Run-RRaJS1O11u - E:\Documents and Settings\All Users\Application Data\bwjypabo elonijy.exe Notify-WgaLogon - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - E:\Documents and Settings\Anglais\Application Data\Mozilla\Firefox\Profiles\4xqg1e25.default\ FF -: plugin - E:\Program Files\DivX\DivX Content Uploader pUpload.dll FF -: plugin - E:\Program Files\Google\Google Updater\2.2.940.34809 pCIDetect11.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-20 19:55:41 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-08-20 19:58:02 ComboFix-quarantined-files.txt 2008-08-20 17:57:56 Pre-Run: 4,482,740,224 octets libres Post-Run: 4,748,832,768 octets libres 140 --- E O F --- 2008-07-28 19:59:29

Destrio5 · Answer

* Télécharge SDFix (par Andy Manchesta) et sauvegarde-le sur ton bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

* Double-clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.
* Redémarre le PC en mode sans échec :
https://www.malekal.com/demarrer-windows-mode-sans-echec/
* Choisis ton compte.

Déroule la liste des instructions ci-dessous :
* Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double-clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le nettoyage.
* Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du bureau, l'outil aura terminé et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
* Enfin, copie/colle le rapport du fichier Report.txt.

Scipion02 · Answer

Voici :


[b]SDFix: Version 1.218 [/b]
Run by Anglais on 21/08/2008 at 16:48

Microsoft Windows XP [version 5.1.2600]
Running From: E:\antivirustest\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

No Trojan Files Found




Folder E:\Documents and Settings\Anglais\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#w*w.redtube.com - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 17:14:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:a1,8a,86,11,a6,bd,a6,db,90,07,37,58,80,f7,b8,86,5e,37,24,80,03,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:a1,8a,86,11,a6,bd,a6,db,90,07,37,58,80,f7,b8,86,5e,37,24,80,03,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"="E:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe:*:Enabled:Assistance … distance - Windows Messenger et voix"
"E:\Program Files\Messenger\msmsgs.exe"="E:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"E:\Program Files\MSN Messenger\msnmsgr.exe"="E:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"E:\Program Files\MSN Messenger\livecall.exe"="E:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\Program Files\MSN Messenger\msnmsgr.exe"="E:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"E:\Program Files\MSN Messenger\livecall.exe"="E:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Sat  8 Mar 2008     6,104,632 A..H. --- "E:\Program Files\Picasa2\setup.exe"
Mon  7 Jul 2008     1,429,840 A.SHR --- "E:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon  7 Jul 2008     4,891,472 A.SHR --- "E:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon  7 Jul 2008     2,156,368 A.SHR --- "E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 10 May 2006         4,348 A.SH. --- "E:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 19 Aug 2008        20,992 ...H. --- "E:\Documents and Settings\Anglais\Bureau\~WRL1693.tmp"
Sun  2 Mar 2008             0 A.SH. --- "E:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sat 19 Jul 2008             0 A..H. --- "E:\WINDOWS\SoftwareDistribution\Download\be077a0a5c65554c0fa221a5c8a0529b\BIT7.tmp"
Sat  5 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0001.tmp"
Mon 28 May 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0003.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0004.tmp"
Sun  9 Sep 2007        20,992 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0005.tmp"
Sun 14 Oct 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0006.tmp"
Thu  3 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0007.tmp"
Sat  5 Jan 2008        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0008.tmp"
Sun  6 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0009.tmp"
Sun  6 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0010.tmp"
Sun  3 Feb 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0011.tmp"
Sat  9 Feb 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0012.tmp"
Tue 17 Jun 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0013.tmp"
Wed  2 Jul 2008        19,968 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0014.tmp"
Mon 18 Aug 2008        20,992 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0015.tmp"
Sun  6 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0446.tmp"
Sun  3 Feb 2008        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0736.tmp"
Sat  5 Jan 2008        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL0749.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1107.tmp"
Sat 11 Aug 2007        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1200.tmp"
Thu  3 Jan 2008        19,968 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1216.tmp"
Sat 11 Aug 2007        19,968 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1376.tmp"
Wed  2 Jul 2008        20,480 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1647.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL1663.tmp"
Wed 20 Aug 2008        20,992 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2194.tmp"
Wed 15 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2372.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2454.tmp"
Sat 11 Aug 2007        19,456 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL2635.tmp"
Mon 18 Aug 2008        21,504 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL3056.tmp"
Sun  9 Sep 2007        22,528 ...H. --- "E:\Documents and Settings\Anglais\Application Data\Microsoft\Word\~WRL3873.tmp"
Sat 30 Jun 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0003.tmp"
Sun 30 Apr 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0004.tmp"
Sat 30 Jun 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0005.tmp"
Sun  1 Jul 2007        21,504 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0006.tmp"
Wed  4 Jul 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0007.tmp"
Thu  5 Jul 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0008.tmp"
Wed 27 Dec 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL0363.tmp"
Sat 30 Jun 2007        21,504 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL1526.tmp"
Mon  5 Feb 2007        19,968 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL1568.tmp"
Wed 18 Oct 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL2253.tmp"
Tue 31 Oct 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL2461.tmp"
Sat 30 Jun 2007        20,480 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL2501.tmp"
Tue 31 Oct 2006        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL3496.tmp"
Sat 30 Jun 2007        20,480 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL3788.tmp"
Wed 14 Mar 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL3911.tmp"
Wed 14 Mar 2007        19,456 ...H. --- "E:\Documents and Settings\Quentin\Application Data\Microsoft\Word\~WRL4079.tmp"

[b]Finished![/b]

Destrio5 · Answer

---> Télécharge le fichier CFScript et enregistre-le sur ton bureau :
http://www.megaupload.com/fr/?d=NKK50MM2

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

Scipion02 · Answer

Les Symptômes du trojan, ont visiblement disparus, verdict ? Reste encore des risques ? ComboFix 08-08-19.06 - Anglais 2008-08-21 22:41:23.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.291 [GMT 2:00] Endroit: E:\Documents and Settings\Anglais\Bureau\ComboFix.exe Command switches used :: E:\Documents and Settings\Anglais\Bureau\CFScript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: E:\WINDOWS\system32\honmhalm.exe E:\WINDOWS\system32\jmvipaze.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . E:\Program Files\Symantec E:\Program Files\Symantec\LiveUpdate\1.Settings.Default.LiveUpdate E:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE E:\Program Files\Symantec\LiveUpdate\ALUNOTIFYRES.DLL E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvcRes.dll E:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE E:\Program Files\Symantec\LiveUpdate\AUPDATERES.DLL E:\Program Files\Symantec\LiveUpdate\LISEZMOI.TXT E:\Program Files\Symantec\LiveUpdate\LSETUP.EXE E:\Program Files\Symantec\LiveUpdate\LSETUPRES.DLL E:\Program Files\Symantec\LiveUpdate\LUALL.EXE E:\Program Files\Symantec\LiveUpdate\LUALLRES.DLL E:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe E:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE E:\Program Files\Symantec\LiveUpdate\LuComServerPS_3_0.DLL E:\Program Files\Symantec\LiveUpdate\LuComServerRes.dll E:\Program Files\Symantec\LiveUpdate\ludirloc.dat E:\Program Files\Symantec\LiveUpdate\LUINFO.INF E:\Program Files\Symantec\LiveUpdate\LUInit.exe E:\Program Files\Symantec\LiveUpdate\LUInit.ini E:\Program Files\Symantec\LiveUpdate\LUINSDLL.DLL E:\Program Files\Symantec\LiveUpdate\LUINSDLLRES.DLL E:\Program Files\Symantec\LiveUpdate\luinventoryinst.jar E:\Program Files\Symantec\LiveUpdate\LuPreCon.DLL E:\Program Files\Symantec\LiveUpdate\LuResult.txt E:\Program Files\Symantec\LiveUpdate\LUSESAIntegration.dll E:\Program Files\Symantec\LiveUpdate\LUSESAIntegrationRes.dll E:\Program Files\Symantec\LiveUpdate\LUSETUP.EXE E:\Program Files\Symantec\LiveUpdate\LUUPDATE.EXE E:\Program Files\Symantec\LiveUpdate\MFC71.DLL E:\Program Files\Symantec\LiveUpdate\MSVCP71.DLL E:\Program Files\Symantec\LiveUpdate\MSVCR71.DLL E:\Program Files\Symantec\LiveUpdate\NetDetectController_3_0.DLL E:\Program Files\Symantec\LiveUpdate\ProductRegCom_3_0.DLL E:\Program Files\Symantec\LiveUpdate\providerInst.jar E:\Program Files\Symantec\LiveUpdate\S32LIVE1.DLL E:\Program Files\Symantec\LiveUpdate\S32LUCP1.CPL E:\Program Files\Symantec\LiveUpdate\S32LUCP1RES.DLL E:\Program Files\Symantec\LiveUpdate\S32LUIS1.DLL E:\Program Files\Symantec\LiveUpdate\S32LUWI1.DLL E:\Program Files\Symantec\LiveUpdate\SESA.Settings.LiveUpdate E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.exe E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.log E:\Program Files\Symantec\LiveUpdate\SymantecRootInstallerRes.dll E:\Program Files\Symantec\LiveUpdate\UNRAR.DLL E:\Program Files\Symantec\LiveUpdate\winluproviderinst.jar E:\Program Files\Symantec\S32EVNT1.DLL E:\Program Files\Symantec\SYMEVENT.CAT E:\Program Files\Symantec\SYMEVENT.INF E:\Program Files\Symantec\SYMEVENT.SYS E:\WINDOWS\system32\honmhalm.exe E:\WINDOWS\system32\jmvipaze.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))))))) . 2008-08-21 16:40 . 2008-08-21 16:40 d-------- E:\WINDOWS\ERUNT 2008-08-21 16:35 . 2008-08-21 16:35 d-------- E:\antivirustest 2008-08-20 18:38 . 2008-08-20 18:38 d-------- E:\_OTMoveIt 2008-08-20 12:44 . 2008-08-20 13:06 d-------- E:\Lop SD 2008-08-20 09:34 . 2008-08-20 09:34 d-------- E:\Program Files\Trend Micro 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Program Files\Malwarebytes' Anti-Malware 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Documents and Settings\Anglais\Application Data\Malwarebytes 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-19 18:32 . 2008-08-17 15:01 38,472 --a------ E:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-19 18:32 . 2008-08-17 15:01 17,144 --a------ E:\WINDOWS\system32\drivers\mbam.sys 2008-08-19 10:51 . 2008-08-19 10:57 17,454 --a------ E:\WINDOWS\wininit.ini 2008-08-18 19:23 . 2008-08-18 19:24 d-------- E:\Program Files\Spybot - Search & Destroy 2008-08-18 19:23 . 2008-08-18 22:10 d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-17 23:40 . 2008-08-17 23:40 54,156 --ah----- E:\WINDOWS\QTFont.qfn 2008-08-17 23:40 . 2008-08-17 23:40 1,409 --a------ E:\WINDOWS\QTFont.for 2008-08-11 01:42 . 2008-08-11 01:53 d-------- E:\WINDOWS\system32\NtmsData 2008-08-10 18:54 . 2008-08-10 18:54 d-------- E:\Program Files\lracan 2008-08-10 18:40 . 2008-08-18 12:53 d-------- E:\Documents and Settings\All Users\Application Data\GenInfoCom . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 08:37 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater 2008-08-10 19:59 --------- d-----w E:\Program Files\Wanadoo 2008-08-10 19:05 --------- d-----w E:\Program Files\Fichiers communs\Symantec Shared 2008-08-10 16:57 --------- d-----w E:\Documents and Settings\All Users\Application Data\Symantec 2008-08-10 08:33 --------- d-----w E:\Documents and Settings\Anglais\Application Data\gtk-2.0 2008-06-20 17:41 247,808 ----a-w E:\WINDOWS\system32\mswsock.dll 2006-08-05 09:04 21,924,135 -c--a-w E:\Documents and Settings\Alain\securitoo_controle_parental_orange_r8.exe 1998-08-24 11:09 10,000 -c--a-w E:\WINDOWS\inf\unregpn.exe . ------- Sigcheck ------- 2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\explorer.exe 2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 E:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-19 18:09 1036288 2a7bd330924252a2fd80344fc949bb72 E:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\system32\dllcache\explorer.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-20_19.57.23.32 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-21 14:45:23 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-21 14:45:23 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-21 14:40:53 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-21 14:40:53 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-21 20:45:33 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_7b8.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="E:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968] "SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368] "webset"="E:\WINDOWS\system32\dglirqzs.exe" [BU] "comappmon"="E:\WINDOWS\system32\orsrcvsd.exe" [BU] "ForkEach"="E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe" [BU] "swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-10 13:47 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "HlpStrCom"= {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll [2008-08-10 18:54 102400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon] [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.NSVI"= NSVIDEO.DLL "VIDC.JPEG"= JpegCode.dll "VIDC.MJPG"= JpegCode.dll "VIDC.HFYU"= huffyuv.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "E:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"= "E:\Program Files\Messenger\msmsgs.exe"= "E:\Program Files\MSN Messenger\msnmsgr.exe"= "E:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 aswSP;avast! Self Protection;E:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;E:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 NwSapAgent;Agent SAP;E:\WINDOWS\system32\svchost.exe [2004-08-19 18:10] R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;E:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37] S3 DSCVc;Video Capture;E:\WINDOWS\system32\DRIVERS\CoachVc.sys [2003-11-03 18:31] S3 ZDCndis5;ZDCndis5 Protocol Driver;E:\WINDOWS\system32\ZDCndis5.SYS [] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-07-29 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job - E:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42] . - - - - ORPHANS REMOVED - - - - BHO-{6488DF32-3582-2E07-8DD6-842DF26C4684} - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-21 22:46:11 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: E:\WINDOWS\explorer.exe -> E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll . ------------------------ Other Running Processes ------------------------ . E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe E:\Program Files\Google\Google Updater\GoogleUpdater.exe E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Temps d'accomplissement: 2008-08-21 22:51:07 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-21 20:51:01 ComboFix2.txt 2008-08-20 17:58:03 Pre-Run: 4,707,233,792 octets libres Post-Run: 4,902,338,560 octets libres 194 --- E O F --- 2008-07-28 19:59:29

Scipion02 · Answer

Les symptôme du trojan on disparus (à savoir les fausses alerte du pare-feu), il reste encore des risques ? ComboFix 08-08-19.06 - Anglais 2008-08-21 22:41:23.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.291 [GMT 2:00] Endroit: E:\Documents and Settings\Anglais\Bureau\ComboFix.exe Command switches used :: E:\Documents and Settings\Anglais\Bureau\CFScript.txt * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] FILE :: E:\WINDOWS\system32\honmhalm.exe E:\WINDOWS\system32\jmvipaze.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . E:\Program Files\Symantec E:\Program Files\Symantec\LiveUpdate\1.Settings.Default.LiveUpdate E:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE E:\Program Files\Symantec\LiveUpdate\ALUNOTIFYRES.DLL E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe E:\Program Files\Symantec\LiveUpdate\AluSchedulerSvcRes.dll E:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE E:\Program Files\Symantec\LiveUpdate\AUPDATERES.DLL E:\Program Files\Symantec\LiveUpdate\LISEZMOI.TXT E:\Program Files\Symantec\LiveUpdate\LSETUP.EXE E:\Program Files\Symantec\LiveUpdate\LSETUPRES.DLL E:\Program Files\Symantec\LiveUpdate\LUALL.EXE E:\Program Files\Symantec\LiveUpdate\LUALLRES.DLL E:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe E:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE E:\Program Files\Symantec\LiveUpdate\LuComServerPS_3_0.DLL E:\Program Files\Symantec\LiveUpdate\LuComServerRes.dll E:\Program Files\Symantec\LiveUpdate\ludirloc.dat E:\Program Files\Symantec\LiveUpdate\LUINFO.INF E:\Program Files\Symantec\LiveUpdate\LUInit.exe E:\Program Files\Symantec\LiveUpdate\LUInit.ini E:\Program Files\Symantec\LiveUpdate\LUINSDLL.DLL E:\Program Files\Symantec\LiveUpdate\LUINSDLLRES.DLL E:\Program Files\Symantec\LiveUpdate\luinventoryinst.jar E:\Program Files\Symantec\LiveUpdate\LuPreCon.DLL E:\Program Files\Symantec\LiveUpdate\LuResult.txt E:\Program Files\Symantec\LiveUpdate\LUSESAIntegration.dll E:\Program Files\Symantec\LiveUpdate\LUSESAIntegrationRes.dll E:\Program Files\Symantec\LiveUpdate\LUSETUP.EXE E:\Program Files\Symantec\LiveUpdate\LUUPDATE.EXE E:\Program Files\Symantec\LiveUpdate\MFC71.DLL E:\Program Files\Symantec\LiveUpdate\MSVCP71.DLL E:\Program Files\Symantec\LiveUpdate\MSVCR71.DLL E:\Program Files\Symantec\LiveUpdate\NetDetectController_3_0.DLL E:\Program Files\Symantec\LiveUpdate\ProductRegCom_3_0.DLL E:\Program Files\Symantec\LiveUpdate\providerInst.jar E:\Program Files\Symantec\LiveUpdate\S32LIVE1.DLL E:\Program Files\Symantec\LiveUpdate\S32LUCP1.CPL E:\Program Files\Symantec\LiveUpdate\S32LUCP1RES.DLL E:\Program Files\Symantec\LiveUpdate\S32LUIS1.DLL E:\Program Files\Symantec\LiveUpdate\S32LUWI1.DLL E:\Program Files\Symantec\LiveUpdate\SESA.Settings.LiveUpdate E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.exe E:\Program Files\Symantec\LiveUpdate\SymantecRootInstaller.log E:\Program Files\Symantec\LiveUpdate\SymantecRootInstallerRes.dll E:\Program Files\Symantec\LiveUpdate\UNRAR.DLL E:\Program Files\Symantec\LiveUpdate\winluproviderinst.jar E:\Program Files\Symantec\S32EVNT1.DLL E:\Program Files\Symantec\SYMEVENT.CAT E:\Program Files\Symantec\SYMEVENT.INF E:\Program Files\Symantec\SYMEVENT.SYS E:\WINDOWS\system32\honmhalm.exe E:\WINDOWS\system32\jmvipaze.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))))))) . 2008-08-21 16:40 . 2008-08-21 16:40 d-------- E:\WINDOWS\ERUNT 2008-08-21 16:35 . 2008-08-21 16:35 d-------- E:\antivirustest 2008-08-20 18:38 . 2008-08-20 18:38 d-------- E:\_OTMoveIt 2008-08-20 12:44 . 2008-08-20 13:06 d-------- E:\Lop SD 2008-08-20 09:34 . 2008-08-20 09:34 d-------- E:\Program Files\Trend Micro 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Program Files\Malwarebytes' Anti-Malware 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Documents and Settings\Anglais\Application Data\Malwarebytes 2008-08-19 18:32 . 2008-08-19 18:32 d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-08-19 18:32 . 2008-08-17 15:01 38,472 --a------ E:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-08-19 18:32 . 2008-08-17 15:01 17,144 --a------ E:\WINDOWS\system32\drivers\mbam.sys 2008-08-19 10:51 . 2008-08-19 10:57 17,454 --a------ E:\WINDOWS\wininit.ini 2008-08-18 19:23 . 2008-08-18 19:24 d-------- E:\Program Files\Spybot - Search & Destroy 2008-08-18 19:23 . 2008-08-18 22:10 d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-17 23:40 . 2008-08-17 23:40 54,156 --ah----- E:\WINDOWS\QTFont.qfn 2008-08-17 23:40 . 2008-08-17 23:40 1,409 --a------ E:\WINDOWS\QTFont.for 2008-08-11 01:42 . 2008-08-11 01:53 d-------- E:\WINDOWS\system32\NtmsData 2008-08-10 18:54 . 2008-08-10 18:54 d-------- E:\Program Files\lracan 2008-08-10 18:40 . 2008-08-18 12:53 d-------- E:\Documents and Settings\All Users\Application Data\GenInfoCom . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-21 08:37 --------- d-----w E:\Documents and Settings\All Users\Application Data\Google Updater 2008-08-10 19:59 --------- d-----w E:\Program Files\Wanadoo 2008-08-10 19:05 --------- d-----w E:\Program Files\Fichiers communs\Symantec Shared 2008-08-10 16:57 --------- d-----w E:\Documents and Settings\All Users\Application Data\Symantec 2008-08-10 08:33 --------- d-----w E:\Documents and Settings\Anglais\Application Data\gtk-2.0 2008-06-20 17:41 247,808 ----a-w E:\WINDOWS\system32\mswsock.dll 2006-08-05 09:04 21,924,135 -c--a-w E:\Documents and Settings\Alain\securitoo_controle_parental_orange_r8.exe 1998-08-24 11:09 10,000 -c--a-w E:\WINDOWS\inf\unregpn.exe . ------- Sigcheck ------- 2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\explorer.exe 2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 E:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2004-08-19 18:09 1036288 2a7bd330924252a2fd80344fc949bb72 E:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 E:\WINDOWS\system32\dllcache\explorer.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 68440 84d9a61860272d6177d46c86b8431557 E:\WINDOWS\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-20_19.57.23.32 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-08-21 14:45:23 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-21 14:45:23 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-08-21 14:40:53 11,419,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\ntuser.dat + 2008-08-21 14:40:53 155,648 ----a-w E:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-21 20:45:33 16,384 ----atw E:\WINDOWS\Temp\Perflib_Perfdata_7b8.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Picasa Media Detector"="E:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 03:23 443968] "SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368] "webset"="E:\WINDOWS\system32\dglirqzs.exe" [BU] "comappmon"="E:\WINDOWS\system32\orsrcvsd.exe" [BU] "ForkEach"="E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe" [BU] "swg"="E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-10 13:47 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "HlpStrCom"= {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll [2008-08-10 18:54 102400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon] [BU] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.NSVI"= NSVIDEO.DLL "VIDC.JPEG"= JpegCode.dll "VIDC.MJPG"= JpegCode.dll "VIDC.HFYU"= huffyuv.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "E:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe"= "E:\Program Files\Messenger\msmsgs.exe"= "E:\Program Files\MSN Messenger\msnmsgr.exe"= "E:\Program Files\MSN Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R1 aswSP;avast! Self Protection;E:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R2 aswFsBlk;aswFsBlk;E:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 NwSapAgent;Agent SAP;E:\WINDOWS\system32\svchost.exe [2004-08-19 18:10] R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;E:\WINDOWS\system32\DRIVERS\WlanUZXP.sys [2005-07-13 16:37] S3 DSCVc;Video Capture;E:\WINDOWS\system32\DRIVERS\CoachVc.sys [2003-11-03 18:31] S3 ZDCndis5;ZDCndis5 Protocol Driver;E:\WINDOWS\system32\ZDCndis5.SYS [] . Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es' 2008-07-29 E:\WINDOWS\Tasks\AppleSoftwareUpdate.job - E:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42] . - - - - ORPHANS REMOVED - - - - BHO-{6488DF32-3582-2E07-8DD6-842DF26C4684} - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-21 22:46:11 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: E:\WINDOWS\explorer.exe -> E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon.dll . ------------------------ Other Running Processes ------------------------ . E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe E:\Program Files\Alwil Software\Avast4\ashServ.exe E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe E:\Program Files\Google\Google Updater\GoogleUpdater.exe E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe E:\Program Files\Alwil Software\Avast4\ashWebSv.exe . ************************************************************************** . Temps d'accomplissement: 2008-08-21 22:51:07 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-21 20:51:01 ComboFix2.txt 2008-08-20 17:58:03 Pre-Run: 4,707,233,792 octets libres Post-Run: 4,902,338,560 octets libres 194 --- E O F --- 2008-07-28 19:59:29

Destrio5 · Answer

---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

---> Poste un nouveau rapport HijackThis

Scipion02 · Answer

Tadam :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:03:04, on 22/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [webset] E:\WINDOWS\system32\dglirqzs.exe
O4 - HKCU\..\Run: [comappmon] E:\WINDOWS\system32\orsrcvsd.exe
O4 - HKCU\..\Run: [ForkEach] E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O21 - SSODL: HlpStrCom - {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Destrio5 · Answer

---> Mets à jour Internet Explorer :
http://www.microsoft.com/downloads/details.aspx?FamilyId=9AE91EBE-3385-447C-8A30-081805B2F90B&displaylang=fr

---> Mets à jour Java :
https://www.java.com/fr/download/manual.jsp

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

R3 - URLSearchHook: (no name) - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) 

O4 - HKCU\..\Run: [webset] E:\WINDOWS\system32\dglirqzs.exe 

O4 - HKCU\..\Run: [comappmon] E:\WINDOWS\system32\orsrcvsd.exe 

O4 - HKCU\..\Run: [ForkEach] E:\DOCUME~1\Anglais\APPLIC~1\Greycake\Eq tray.exe 

O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office\OSA9.EXE     

O21 - SSODL: HlpStrCom - {3C613E47-AFA7-E725-1FAB-08C886C75476} - E:\Program Files\lracan\HlpStrCom.dll 

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Supprime les traces de Norton avec ceci :
ftp://ftp.symantec.com/public/francais/removal_tools/Norton_Removal_Tool.exe

--->  Poste un nouveau rapport HijackThis

Scipion02 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:14:13, on 22/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\system32\calc.exe
E:\WINDOWS\system32
otepad.exe
E:\Program Files\Microsoft Office\Office\WINWORD.EXE
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Destrio5 · Answer

Important : Désactive TeaTimer, le résident de Spybot, il va gêner la désinfection en empêchant la modification des BHO.

--->  Démarre Spybot, clique sur Mode, coche Mode avancé
---> A gauche, clique sur Outils, puis sur Résident
--->  Décoche la case devant Résident "TeaTimer" :
http://apu.mabul.org/up/5/apu-5-gpdx9e06cwz2dypom2q7n6nc.jpg
--->  Quitte Spybot

Note : Je te conseille de ne pas le réactiver, il a été incapable d'empêcher l'infection de ton PC.

Puis recommence ce que je t'ai demandé de faire.

Pour HijackThis, si des lignes n'apparaissent plus, tu ne les coches pas tout simplement.

Scipion02 · Answer

Désolé pour le temps :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:48:39, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Windows Media Player\wmplayer.exe
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Destrio5 · Answer

Mets à jour Java et Internet Explorer.

Scipion02 · Answer

Eurf oublié.

Alors je viens de mettre à jour Java, et par contre je ne me sers (quasiment) jamais de Ie.

Destrio5 · Answer

Mets-le à jour quand même.

Scipion02 · Answer

Bien , je reposte donc j'imagine, le rapport modifié :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:54:18, on 24/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
E:\Program Files\Alwil Software\Avast4\ashServ.exe
E:\WINDOWS\Explorer.EXE
E:\WINDOWS\system32\spoolsv.exe
E:\Program Files\Picasa2\PicasaMediaDetector.exe
E:\Program Files\Google\Google Updater\GoogleUpdater.exe
E:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
E:\WINDOWS\system32\svchost.exe
E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Program Files\MSN Messenger\msnmsgr.exe
E:\Program Files\MSN Messenger\livecall.exe
E:\Program Files\MSN Messenger\usnsvc.exe
E:\Program Files\Windows Media Player\wmplayer.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\Microsoft Office\Office\WINWORD.EXE
E:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - E:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [NoIE4StubProcessing] E:\WINDOWS\system32eg.exe DELETE "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components" /v "NoIE4StubProcessing" /f
O4 - HKCU\..\Run: [Picasa Media Detector] E:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] E:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: TransBar.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = E:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = E:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - E:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O10 - Unknown file in Winsock LSP: e:\windows\system32
wprovau.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F362E72C-E709-4354-A6C9-613672B1BC9F}: NameServer = 192.168.1.1
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - E:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - E:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - E:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Unknown owner - E:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE (file missing)
O23 - Service: Planificateur LiveUpdate automatique - Unknown owner - E:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - E:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe

Trojans récalcitrants

32 réponses

Discussions similaires

Newsletters