Virus "antivirus"

manbo49 Messages postés 66 Statut Membre -  
geoffrey5 Messages postés 14008 Statut Contributeur sécurité -
Bonjour,

J'ai attrapé un virus "antivirus" apparement assez courant en ce moment qui bien évidemment me dis que j'ai des trojans et qu'il fo que j'achete un antivirus, etc...
Lorsque mon pc s'allume, j'ai sur mon bureau une fenetre qui est impossible a fermer et qui se nomme "warning spyware detected on your computer..."

Serait il possible de m'aider svp ?

Si j'ai besoin de vous envoyer un rapport hijackthis ou SSD, pourriez vous m'expliquer la procédure pour savoir quelle ligne sont suspectes, cela m'éviterait de vous embeter régulirerement, d'autant que j'ai pas mal de connaissance en informatique et que je pense etre capable de comprendre et de m'en sortir seul si cela se reproduit un jour...

Merci d'avance...
Configuration: Windows XP
Firefox 3.0.1

21 réponses

  • 1
  • 2
  1. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Salut !!

    Télécharge hijackthis à cette adresse, tout est expliqué pour bien l installer et pour savoir s'en servir :

    https://www.androidworld.fr/
    0
  2. meléopoldine Messages postés 10 Date d'inscription   Statut Membre 264
     
    CCM topic similaire tu vas peut etre trouver un début de solution ici mais chaque cas est particulier alors méfiance^^
    0
  3. manbo49 Messages postés 66 Statut Membre 1
     
    VOici le rapport HIJACKTHIS !!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:11:25, on 25/08/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\WINDOWS\system32\sysrest32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\qvevqpor.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\eChanblard\emule.exe
    C:\Program Files\PeerGuardian2\pg2.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Manu\Bureau\cool.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
    O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
    O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
    O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
    O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  4. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Salut !!

    Télécharger sur le bureau malwarebytes à cette adresse :

    https://www.androidworld.fr/

    Voici un tuto pour bien l installer et bien l utiliser :

    https://www.androidworld.fr/

    Après l analyse, redémarrer le pc et poste le rapport !!

    ensuite :

    télécharger sur le bureau Navilog1 à cette adresse (c est le numéro 1 en bas de la page) : https://www.androidworld.fr/

    Si votre antivirus s'affole , le désactiver
    =sous vista : Clic-droit sur le raccourci Navilog1 présent sur le bureau et choisis "Exécuter en tant qu'administrateur
    =sous XP : double-clic dessus pour l'installer et le lancer

    Quand installé
    = taper F
    = Appuyer sur une touche jusqu' arriver aux options
    = Choisir Recherche ( = taper 1 )
    ne pas utiliser les autres sans avis , il peut y avoir des processus légitimes

    un rapport : fixnavi.txt
    dans ==> C :
    le copier et le coller dans la réponse
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. manbo49 Messages postés 66 Statut Membre 1
     
    Bonsoir,

    Voici le rapport de malwarebytes

    Malwarebytes' Anti-Malware 1.25
    Version de la base de données: 1062
    Windows 5.1.2600 Service Pack 3

    21:59:26 25/08/2008
    mbam-log-08-25-2008 (21-59-26).txt

    Type de recherche: Examen complet (C:\|)
    Eléments examinés: 110630
    Temps écoulé: 37 minute(s), 58 second(s)

    Processus mémoire infecté(s): 2
    Module(s) mémoire infecté(s): 0
    Clé(s) du Registre infectée(s): 6
    Valeur(s) du Registre infectée(s): 6
    Elément(s) de données du Registre infecté(s): 2
    Dossier(s) infecté(s): 0
    Fichier(s) infecté(s): 13

    Processus mémoire infecté(s):
    C:\WINDOWS\system32\lphcv2tj0et39.exe (Trojan.FakeAlert) -> Unloaded process successfully.
    C:\WINDOWS\system32\sysrest32.exe (Rootkit.Agent) -> Failed to unload process.

    Module(s) mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Clé(s) du Registre infectée(s):
    HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysrest32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcv2tj0et39 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Dossier(s) infecté(s):
    (Aucun élément nuisible détecté)

    Fichier(s) infecté(s):
    C:\WINDOWS\system32\sysrest32.exe (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\blphcv2tj0et39.scr (Trojan.FakeAlert) -> Delete on reboot.
    C:\WINDOWS\system32\lphcv2tj0et39.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\phcv2tj0et39.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\sysrest.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Manu\Local Settings\temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    0
  7. manbo49 Messages postés 66 Statut Membre 1
     
    et voici le rapport de navilog

    Search Navipromo version 3.6.5 commencé le 25/08/2008 à 22:12:22,03

    !!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
    !!! Postez ce rapport sur le forum pour le faire analyser !!!
    !!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

    Outil exécuté depuis C:\Program Files\navilog1
    Session actuelle : "Manu"

    Mise à jour le 22.08.2008 à 17h30 par IL-MAFIOSO

    Microsoft Windows XP [version 5.1.2600]
    Internet Explorer : 7.0.5730.13
    Système de fichiers : NTFS

    Recherche executé en mode normal

    *** Recherche Programmes installés ***

    *** Recherche dossiers dans "C:\WINDOWS" ***

    *** Recherche dossiers dans "C:\Program Files" ***

    *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***

    *** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\Manu\applic~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\Manu\locals~1\applic~1" ***

    *** Recherche dossiers dans "C:\Documents and Settings\Manu\menudm~1\progra~1" ***

    *** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
    pour + d'infos : http://www.gmer.net

    *** Recherche avec GenericNaviSearch ***
    !!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
    !!! A vérifier impérativement avant toute suppression manuelle !!!

    * Recherche dans "C:\WINDOWS\system32" *

    * Recherche dans "C:\Documents and Settings\Manu\locals~1\applic~1" *

    *** Recherche fichiers ***

    *** Recherche clés spécifiques dans le Registre ***

    *** Module de Recherche complémentaire ***
    (Recherche fichiers spécifiques)

    1)Recherche nouveaux fichiers Instant Access :

    2)Recherche Heuristique :

    * Dans "C:\WINDOWS\system32" :

    * Dans "C:\Documents and Settings\Manu\locals~1\applic~1" :

    3)Recherche Certificats :

    Certificat Egroup absent !
    Certificat Electronic-Group absent !
    Certificat Montorgueil absent !
    Certificat OOO-Favorit absent !
    Certificat Sunny-Day-Design-Ltd absent !

    4)Recherche fichiers connus :

    *** Analyse terminée le 25/08/2008 à 22:15:29,31 ***
    0
  8. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    ok...refais un nouveau rapport hijackthis stp
    0
  9. manbo49 Messages postés 66 Statut Membre 1
     
    Voila

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 23:08:47, on 25/08/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\qvevqpor.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Manu\Bureau\cool.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
    O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
    O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
    O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
    O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
    O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  10. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    télécharge combofix (par sUBs) à cette adresse :

    (c est le numéro 5 en bas de la page) : https://www.androidworld.fr/

    et enregistre le sur le Bureau.

    désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)

    Voici un tuto pour bien l'installer et savoir l utiliser : https://www.androidworld.fr/

    ensuite envois le rapport et ensuite refais un nouveau rapport hijackthis stp
    0
  11. manbo49 Messages postés 66 Statut Membre 1
     
    Voici le rapport de combofix !
    Le virus est toujours la !!!

    ComboFix 08-08-24.03 - Manu 2008-08-26 2:23:24.4 - NTFSx86
    Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1501 [GMT 2:00]
    Endroit: C:\Documents and Settings\Manu\Bureau\ComboFix.exe

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\blphcv2tj0et39.scr
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\WINDOWS\system32\phcv2tj0et39.bmp
    .
    ---- Previous Run -------
    .
    C:\WINDOWS\system32\blphcv2tj0et39.scr
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\WINDOWS\system32\phcv2tj0et39.bmp

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-07-26 to 2008-08-26 ))))))))))))))))))))))))))))))))))))
    .

    2008-08-26 00:31 . 2008-08-26 00:31 102,400 --a------ C:\WINDOWS\system32\xajerwjo.exe
    2008-08-25 23:08 . 2008-08-25 23:08 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
    2008-08-25 22:49 . 2008-08-25 22:49 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-25 22:48 . 2008-08-25 22:48 <REP> d--h----- C:\CanonMP
    2008-08-25 22:48 . 2005-05-06 21:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
    2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
    2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
    2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
    2008-08-25 22:48 . 2005-05-06 21:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
    2008-08-25 22:11 . 2008-08-25 22:17 <REP> d-------- C:\Program Files\Navilog1
    2008-08-25 22:10 . 2008-08-25 22:10 102,400 --a------ C:\WINDOWS\system32\idylsvmz.exe
    2008-08-25 01:13 . 2008-08-25 01:13 <REP> d-------- C:\Program Files\RogueRemover FREE
    2008-08-24 17:04 . 2008-08-24 17:04 90,112 --a------ C:\WINDOWS\system32\byhuxone.exe
    2008-08-23 19:23 . 2008-08-23 19:23 102,400 --a------ C:\WINDOWS\system32\ehmfezwp.exe
    2008-08-23 15:46 . 2008-08-23 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\upszslwp
    2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Program Files\ptigbqe
    2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\qrgfqvuj
    2008-08-23 15:45 . 2008-08-23 15:45 106,496 --a------ C:\WINDOWS\system32\qvevqpor.exe
    2008-08-21 01:19 . 2008-08-21 01:19 <REP> d-------- C:\Program Files\Camfrog
    2008-08-18 13:11 . 2008-08-24 17:17 <REP> d-------- C:\WINDOWS\BDOSCAN8
    2008-08-18 04:54 . 2008-08-19 01:52 <REP> d-------- C:\Documents and Settings\Manu\Application Data\gtk-2.0
    2008-08-18 04:54 . 2008-08-18 04:54 <REP> d-------- C:\Documents and Settings\Manu\.thumbnails
    2008-08-18 04:54 . 2008-08-19 02:14 <REP> d-------- C:\Documents and Settings\Manu\.gimp-2.4
    2008-08-18 04:51 . 2008-08-18 04:51 <REP> d-------- C:\Program Files\GIMP-2.0
    2008-08-17 23:58 . 2008-08-26 01:01 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity
    2008-08-17 23:52 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-08-17 23:52 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-08-17 23:52 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-08-17 23:52 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-08-17 23:52 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-08-17 23:52 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-08-17 23:52 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-08-17 23:52 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-08-17 23:52 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-08-17 00:42 . 2008-08-17 00:42 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Malwarebytes
    2008-08-17 00:41 . 2008-08-25 21:16 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-17 00:41 . 2008-08-17 00:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-17 00:41 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-17 00:41 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-17 00:35 . 2008-08-17 00:35 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Grisoft
    2008-08-17 00:34 . 2008-08-17 00:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-08-17 00:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-08-16 04:38 . 2006-12-26 16:50 91,547 --a------ C:\Documents and Settings\Manu\EasyBanner_3.0.zip
    2008-08-16 04:35 . 2008-08-16 04:35 <REP> d-------- C:\Program Files\EasyBanner 4
    2008-08-16 04:35 . 2006-06-28 14:24 509,920 --a------ C:\WINDOWS\system32\SEGOEUI.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 490,852 --a------ C:\WINDOWS\system32\SEGOEUIB.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 393,068 --a------ C:\WINDOWS\system32\SEGOEUIZ.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 380,456 --a------ C:\WINDOWS\system32\SEGOEUII.TTF
    2008-08-15 18:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-08-15 18:57 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-08-13 22:22 . 2008-08-13 22:22 <REP> d-------- C:\Program Files\Windows Media Connect 2
    2008-08-13 22:21 . 2008-08-13 22:21 <REP> d-------- C:\WINDOWS\system32\LogFiles
    2008-08-13 22:21 . 2008-08-13 22:22 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-08-13 22:16 . 2008-08-13 22:16 <REP> d-------- C:\Documents and Settings\Manu\Application Data\DivX
    2008-08-13 22:15 . 2008-08-13 22:15 <REP> d-------- C:\Program Files\DivX
    2008-08-13 18:26 . 2008-08-22 18:42 69 --a------ C:\WINDOWS\NeroDigital.ini
    2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Program Files\eBay
    2008-08-13 15:54 . 2008-08-17 23:49 <REP> d-------- C:\Documents and Settings\Manu\Application Data\WholeSecurity
    2008-08-13 15:54 . 2008-08-17 05:55 <REP> d-------- C:\Documents and Settings\Manu\Application Data\eBay
    2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\eBay
    2008-08-13 15:53 . 2008-08-13 15:53 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield
    2008-08-13 15:34 . 2008-08-13 15:34 <REP> d-------- C:\Program Files\MAGIX
    2008-08-13 15:34 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
    2008-08-10 23:44 . 2008-08-10 23:44 <REP> d-------- C:\WINDOWS\Downloaded Installations
    2008-08-10 23:26 . 2008-08-26 00:35 51 --a------ C:\WINDOWS\npornap.INI
    2008-08-10 23:24 . 2008-08-10 23:24 <REP> d-------- C:\Program Files\Orange
    2008-08-09 16:17 . 2008-08-09 16:17 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield Installation Information
    2008-08-09 16:07 . 2008-08-09 16:07 <REP> d-------- C:\Program Files\Unreal Tournament 3
    2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\WINDOWS\system32\AGEIA
    2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\Program Files\AGEIA Technologies
    2008-08-09 14:35 . 2008-08-09 14:35 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
    2008-08-08 16:51 . 2008-08-08 16:51 <REP> d-------- C:\Program Files\IK Multimedia
    2008-08-08 14:15 . 2008-08-08 14:15 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Nero
    2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Program Files\Nero
    2008-08-08 14:12 . 2008-08-08 14:14 <REP> d-------- C:\Program Files\Fichiers communs\Nero
    2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-08-07 20:34 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
    2008-08-07 20:34 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
    2008-08-07 20:34 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
    2008-08-07 20:27 . 2008-08-07 20:27 <REP> d-------- C:\Program Files\Microsoft.NET
    2008-08-07 20:25 . 2008-08-07 20:25 <REP> d-------- C:\WINDOWS\SHELLNEW
    2008-08-07 20:25 . 2008-08-07 20:25 <REP> dr-h----- C:\MSOCache
    2008-08-07 20:25 . 2008-08-15 23:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-08-07 20:19 . 2008-08-07 20:19 <REP> d-------- C:\Documents and Settings\Manu\Application Data\MAGIX
    2008-08-07 14:22 . 2005-07-25 08:13 1,201,664 -ra------ C:\WINDOWS\system32\xgusb.cpl
    2008-08-07 14:22 . 2005-07-25 08:13 14,464 -ra------ C:\WINDOWS\system32\drivers\ymidusb.sys
    2008-08-06 18:21 . 2008-08-06 18:21 101,376 --a------ C:\WINDOWS\system32\drivers\ACEDRV07.sys
    2008-08-06 18:21 . 2008-08-22 18:19 951 --a------ C:\WINDOWS\MusicStudio.INI
    2008-08-06 18:17 . 2004-08-11 20:53 38,912 --a------ C:\WINDOWS\system32\mgxasio.dll
    2008-08-06 18:16 . 2008-08-13 15:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
    2008-08-06 18:14 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
    2008-08-06 18:14 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
    2008-08-06 18:12 . 2008-08-06 18:12 <REP> d-------- C:\Program Files\Fichiers communs\MAGIX Shared
    2008-08-06 18:09 . 2008-08-13 15:34 <REP> d-------- C:\WINDOWS\system32\MAGIX
    2008-08-06 18:09 . 2008-08-09 16:09 <REP> d-------- C:\MAGIX
    2008-08-06 18:09 . 2002-09-21 00:33 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
    2008-08-06 18:09 . 2007-07-11 11:53 697,560 --a------ C:\WINDOWS\system32\mgxoschk.dll
    2008-08-06 18:09 . 1998-10-15 17:28 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
    2008-08-06 18:09 . 1999-01-28 14:44 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll
    2008-08-06 18:09 . 2008-08-13 15:34 6,768 --a------ C:\WINDOWS\mgxoschk.ini
    2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
    2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a--c--- C:\WINDOWS\system32\dllcache\usbohci.sys
    2008-08-05 18:34 . 2008-08-17 23:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\fr
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\bits
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\l2schemas
    2008-08-05 18:33 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\ServicePackFiles
    2008-08-05 16:58 . 2008-08-05 16:58 <REP> d-------- C:\WINDOWS\Sun
    2008-08-05 16:44 . 2008-08-05 16:44 <REP> d-------- C:\Program Files\MSXML 4.0
    2008-08-05 16:44 . 2008-08-05 16:44 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-08-05 14:58 . 2008-08-05 14:58 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Codemasters
    2008-08-05 14:57 . 2008-08-05 14:57 <REP> d-------- C:\Program Files\OpenAL
    2008-08-05 14:57 . 2008-08-05 14:57 444,952 --a------ C:\WINDOWS\system32\wrap_oal.dll
    2008-08-05 14:57 . 2008-08-05 14:57 109,080 --a------ C:\WINDOWS\system32\OpenAL32.dll
    2008-08-05 14:42 . 2008-08-05 14:42 <REP> d-------- C:\Program Files\Codemasters
    2008-08-05 02:01 . 2008-08-05 02:20 <REP> d-------- C:\UT2004
    2008-08-04 16:23 . 2008-08-04 16:23 360,320 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
    2008-08-04 14:59 . 2008-08-04 14:59 <REP> d-------- C:\Program Files\Java
    2008-08-04 14:59 . 2008-08-04 14:59 <REP> d-------- C:\Program Files\Fichiers communs\Java

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-13 13:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-10 21:44 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
    2008-08-03 14:00 --------- d-----w C:\Program Files\ASUS
    2008-08-03 13:55 --------- d-----w C:\Program Files\Attansic
    2008-08-03 13:52 --------- d-----w C:\Program Files\Realtek
    2008-08-03 13:50 --------- d-----w C:\Program Files\Intel
    2008-08-03 13:38 --------- d-----w C:\Program Files\microsoft frontpage
    2008-08-03 13:37 --------- d-----w C:\Program Files\Services en ligne
    2008-08-03 13:34 --------- d-----w C:\Program Files\Windows Plus
    2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
    2006-06-22 23:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-08-26_ 0.05.03.42 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-08-26 00:21:01 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5d4.dat
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
    "MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2008-04-14 04:34 1695232]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
    "UtilCmd"="C:\WINDOWS\system32\qvevqpor.exe" [2008-08-23 15:45 106496]
    "hlpcfg"="C:\WINDOWS\system32\ehmfezwp.exe" [2008-08-23 19:23 102400]
    "ComCfgChk"="C:\WINDOWS\system32\byhuxone.exe" [2008-08-24 17:04 90112]
    "mntgen"="C:\WINDOWS\system32\idylsvmz.exe" [2008-08-25 22:10 102400]
    "CfgMsgCom"="C:\WINDOWS\system32\xajerwjo.exe" [2008-08-26 00:31 102400]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
    "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
    "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
    "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-08-06 16:41 652528]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
    "lphcv2tj0et39"="C:\WINDOWS\system32\lphcv2tj0et39.exe" [BU]
    "inrhcr2tj0et39"="C:\Documents and Settings\Manu\Local Settings\temp\.tt6.tmp.exe" [2008-08-26 00:31 1612958]
    "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2006-09-12 10:58 16264192 C:\WINDOWS\RTHDCPL.exe]
    "nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-10-12 04:03 439568]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "zBXnjZhEwz"="C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe" [2008-08-23 15:45 65536]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "ComMntWin"= {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll [2008-08-23 15:45 131072]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=ksdorg.dll esrlyl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "midi4"= xgusb.cpl

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\eChanblard\\emule.exe"=
    "C:\\UT2004\\System\\UT2004.exe"=
    "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
    "C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
    R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-08-22 07:36]
    S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37]
    S3 US122;US122 Driver;C:\WINDOWS\system32\Drivers\US122.sys [2007-08-29 15:50]
    S3 US122DL;US122 Firmware Downloader;C:\WINDOWS\system32\Drivers\US122DL.sys [2007-08-29 15:50]
    S3 Us122WdmService;US122 Wdm Audio;C:\WINDOWS\system32\Drivers\US122Wdm.sys [2007-08-29 15:50]
    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Manu\Application Data\Mozilla\Firefox\Profiles\sic4estv.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fr
    FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\ma-config.com\nphardwaredetection.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npornap.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-26 02:37:59
    Windows 5.1.2600 Service Pack 3 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-08-26 2:57:01
    ComboFix-quarantined-files.txt 2008-08-26 00:56:12

    Pre-Run: 137,074,212,864 octets libres
    Post-Run: 137,068,539,904 octets libres

    275 --- E O F --- 2008-08-20 12:15:19
    0
  12. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Salut !!

    on continue...

    Option 1 - Recherche :

    télécharge smitfraudfix et enregistre le sur le bureau à cette adresse (c est le numéro 2 en bas de la page) :

    https://www.androidworld.fr/

    Ensuite double clique sur smitfraudfix puis exécuter

    Sélectionner 1 pour créer un rapport des fichiers responsables de l'infection.

    copier/coller le rapport dans la réponse.
    0
  13. manbo49 Messages postés 66 Statut Membre 1
     
    Voici le rapport smitfraudfix !

    SmitFraudFix v2.339

    Rapport fait à 21:03:23,42, 26/08/2008
    Executé à partir de C:\Documents and Settings\Manu\Bureau\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode normal

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\qvevqpor.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Manu\Bureau\SmitfraudFix\Policies.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    »»»»»»»»»»»»»»»»»»»»»»»» C:\

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Manu

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Manu\Application Data

    »»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer

    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Manu\Favoris

    »»»»»»»»»»»»»»»»»»»»»»»» Bureau

    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

    »»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues

    »»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="Ma page d'accueil"

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    AntiXPVSTFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    [!] Malware.Win32.EncPk-DA.gen
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe (Running)

    [!] Suspicious file
    C:\WINDOWS\system32\phcv2tj0et39.bmp

    [!] Suspicious file
    C:\WINDOWS\system32\blphcv2tj0et39.scr

    [!] Malware.Win32.EncPk-CZ.gen
    O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe (Running)

    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"="ksdorg.dll esrlyl.dll"

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: Attansic L1 Gigabit Ethernet 10/100/1000Base-T Adapter - Miniport d'ordonnancement de paquets
    DNS Server Search Order: 212.27.53.252
    DNS Server Search Order: 212.27.54.252

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252

    »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin
    0
  14. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    ok maintenant :

    Option 2 - Nettoyage :

    Redémarrer l'ordinateur en mode sans échec (tapoter F8 au boot pour obtenir le menu de démarrage).

    Double cliquer sur smitfraudfix

    Sélectionner 2 pour supprimer les fichiers responsables de l'infection.

    A la question Voulez-vous nettoyer le registre ? répondre O (oui) afin de débloquer le fond d'écran et supprimer les clés de démarrage automatique de l'infection.

    Le fix déterminera si le fichier wininet.dll est infecté. A la question Corriger le fichier infecté ? répondre O (oui) pour remplacer le fichier corrompu.

    Redémarrer en mode normal et poster le rapport.

    ensuite refais un nouveau rapport hijackthis stp
    0
  15. manbo49 Messages postés 66 Statut Membre 1
     
    Bonsoir, Et tout d'abord merci pour toute votre aide !!!
    Le virus ne semble plus etre la, du moins il n'y aplus de fentres intempestives pour acheter un antivirus !! ce qui est un tres bon point !!!!

    voici les rapports :

    CELUI DE SMITFRAUDFIX :

    SmitFraudFix v2.339

    Rapport fait à 2:03:21,17, 27/08/2008
    Executé à partir de C:\Documents and Settings\Manu\Bureau\SmitfraudFix
    OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
    Le type du système de fichiers est NTFS
    Fix executé en mode sans echec

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» VACFix

    VACFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» 404Fix

    404Fix
    Credits: Malware Analysis & Diagnostic
    Code: S!Ri

    »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

    »»»»»»»»»»»»»»»»»»»»»»»» RK

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{3A9CCFF0-3123-4863-A28B-AD565155218A}: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=212.27.53.252 212.27.54.252

    »»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires

    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""

    »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

    Nettoyage terminé.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
    !!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Fin

    CELUI DE HIJACKTHIS :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 02:14:54, on 27/08/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\byhuxone.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Manu\Bureau\cool.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
    O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
    O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
    O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
    O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
    O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
    O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
    O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
    O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  16. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    ok...c est déjà bien mais y a encore des infections...fais ceci stp :

    télécharge combofix (par sUBs) à cette adresse :

    (c est le numéro 5 en bas de la page) : https://www.androidworld.fr/

    et enregistre le sur le Bureau.

    désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware)

    Voici un tuto pour bien l'installer et savoir l utiliser : https://www.androidworld.fr/

    ensuite envois le rapport et refais un nouveau rapport hijackthis stp
    0
  17. manbo49 Messages postés 66 Statut Membre 1
     
    Effectivement il est toujours la.... :'(

    rapport combofix

    ComboFix 08-08-26.02 - Manu 2008-08-27 2:48:11.5 - NTFSx86
    Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1521 [GMT 2:00]
    Endroit: C:\Documents and Settings\Manu\Bureau\ComboFix.exe
    * Création d'un nouveau point de restauration

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
    .

    ((((((((((((((((((((((((((((( Fichiers créés 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
    .

    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
    2008-08-27 02:01 . 2008-08-03 15:32 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
    2008-08-27 02:01 . 2008-08-27 02:09 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
    2008-08-27 02:01 . 2008-08-27 02:01 <REP> d-------- C:\Documents and Settings\Administrateur
    2008-08-26 21:03 . 2008-08-27 02:09 2,318 --a------ C:\WINDOWS\system32\tmp.reg
    2008-08-26 03:11 . 2008-08-26 03:11 102,400 --a------ C:\WINDOWS\system32\dkfqdszm.exe
    2008-08-26 00:31 . 2008-08-26 00:31 102,400 --a------ C:\WINDOWS\system32\xajerwjo.exe
    2008-08-25 23:08 . 2008-08-25 23:08 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
    2008-08-25 22:49 . 2008-08-25 22:49 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-25 22:48 . 2008-08-25 22:48 <REP> d--h----- C:\CanonMP
    2008-08-25 22:48 . 2005-05-06 21:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
    2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
    2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
    2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
    2008-08-25 22:48 . 2005-05-06 21:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
    2008-08-25 22:11 . 2008-08-25 22:17 <REP> d-------- C:\Program Files\Navilog1
    2008-08-25 22:10 . 2008-08-25 22:10 102,400 --a------ C:\WINDOWS\system32\idylsvmz.exe
    2008-08-25 01:13 . 2008-08-25 01:13 <REP> d-------- C:\Program Files\RogueRemover FREE
    2008-08-24 17:04 . 2008-08-24 17:04 90,112 --a------ C:\WINDOWS\system32\byhuxone.exe
    2008-08-23 19:23 . 2008-08-23 19:23 102,400 --a------ C:\WINDOWS\system32\ehmfezwp.exe
    2008-08-23 15:46 . 2008-08-23 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\upszslwp
    2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Program Files\ptigbqe
    2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\qrgfqvuj
    2008-08-23 15:45 . 2008-08-23 15:45 106,496 --a------ C:\WINDOWS\system32\qvevqpor.exe
    2008-08-21 01:19 . 2008-08-21 01:19 <REP> d-------- C:\Program Files\Camfrog
    2008-08-18 13:11 . 2008-08-24 17:17 <REP> d-------- C:\WINDOWS\BDOSCAN8
    2008-08-18 04:54 . 2008-08-19 01:52 <REP> d-------- C:\Documents and Settings\Manu\Application Data\gtk-2.0
    2008-08-18 04:54 . 2008-08-18 04:54 <REP> d-------- C:\Documents and Settings\Manu\.thumbnails
    2008-08-18 04:54 . 2008-08-19 02:14 <REP> d-------- C:\Documents and Settings\Manu\.gimp-2.4
    2008-08-18 04:51 . 2008-08-18 04:51 <REP> d-------- C:\Program Files\GIMP-2.0
    2008-08-17 23:58 . 2008-08-27 02:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity
    2008-08-17 23:52 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-08-17 23:52 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-08-17 23:52 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-08-17 23:52 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-08-17 23:52 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-08-17 23:52 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-08-17 23:52 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-08-17 23:52 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-08-17 23:52 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-08-17 00:42 . 2008-08-17 00:42 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Malwarebytes
    2008-08-17 00:41 . 2008-08-25 21:16 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-17 00:41 . 2008-08-17 00:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-17 00:41 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-17 00:41 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-17 00:35 . 2008-08-17 00:35 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Grisoft
    2008-08-17 00:34 . 2008-08-17 00:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-08-17 00:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-08-16 04:38 . 2006-12-26 16:50 91,547 --a------ C:\Documents and Settings\Manu\EasyBanner_3.0.zip
    2008-08-16 04:35 . 2008-08-16 04:35 <REP> d-------- C:\Program Files\EasyBanner 4
    2008-08-16 04:35 . 2006-06-28 14:24 509,920 --a------ C:\WINDOWS\system32\SEGOEUI.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 490,852 --a------ C:\WINDOWS\system32\SEGOEUIB.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 393,068 --a------ C:\WINDOWS\system32\SEGOEUIZ.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 380,456 --a------ C:\WINDOWS\system32\SEGOEUII.TTF
    2008-08-15 18:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-08-15 18:57 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-08-13 22:22 . 2008-08-13 22:22 <REP> d-------- C:\Program Files\Windows Media Connect 2
    2008-08-13 22:21 . 2008-08-13 22:21 <REP> d-------- C:\WINDOWS\system32\LogFiles
    2008-08-13 22:21 . 2008-08-13 22:22 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-08-13 22:16 . 2008-08-13 22:16 <REP> d-------- C:\Documents and Settings\Manu\Application Data\DivX
    2008-08-13 22:15 . 2008-08-13 22:15 <REP> d-------- C:\Program Files\DivX
    2008-08-13 18:26 . 2008-08-26 18:02 69 --a------ C:\WINDOWS\NeroDigital.ini
    2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Program Files\eBay
    2008-08-13 15:54 . 2008-08-17 23:49 <REP> d-------- C:\Documents and Settings\Manu\Application Data\WholeSecurity
    2008-08-13 15:54 . 2008-08-17 05:55 <REP> d-------- C:\Documents and Settings\Manu\Application Data\eBay
    2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\eBay
    2008-08-13 15:53 . 2008-08-13 15:53 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield
    2008-08-13 15:34 . 2008-08-13 15:34 <REP> d-------- C:\Program Files\MAGIX
    2008-08-13 15:34 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
    2008-08-10 23:44 . 2008-08-10 23:44 <REP> d-------- C:\WINDOWS\Downloaded Installations
    2008-08-10 23:26 . 2008-08-26 00:35 51 --a------ C:\WINDOWS\npornap.INI
    2008-08-10 23:24 . 2008-08-10 23:24 <REP> d-------- C:\Program Files\Orange
    2008-08-09 16:17 . 2008-08-09 16:17 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield Installation Information
    2008-08-09 16:07 . 2008-08-09 16:07 <REP> d-------- C:\Program Files\Unreal Tournament 3
    2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\WINDOWS\system32\AGEIA
    2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\Program Files\AGEIA Technologies
    2008-08-09 14:35 . 2008-08-09 14:35 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
    2008-08-08 16:51 . 2008-08-08 16:51 <REP> d-------- C:\Program Files\IK Multimedia
    2008-08-08 14:15 . 2008-08-08 14:15 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Nero
    2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Program Files\Nero
    2008-08-08 14:12 . 2008-08-08 14:14 <REP> d-------- C:\Program Files\Fichiers communs\Nero
    2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-08-07 20:34 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
    2008-08-07 20:34 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
    2008-08-07 20:34 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
    2008-08-07 20:27 . 2008-08-07 20:27 <REP> d-------- C:\Program Files\Microsoft.NET
    2008-08-07 20:25 . 2008-08-07 20:25 <REP> d-------- C:\WINDOWS\SHELLNEW
    2008-08-07 20:25 . 2008-08-07 20:25 <REP> dr-h----- C:\MSOCache
    2008-08-07 20:25 . 2008-08-15 23:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-08-07 20:19 . 2008-08-07 20:19 <REP> d-------- C:\Documents and Settings\Manu\Application Data\MAGIX
    2008-08-07 14:22 . 2005-07-25 08:13 1,201,664 -ra------ C:\WINDOWS\system32\xgusb.cpl
    2008-08-07 14:22 . 2005-07-25 08:13 14,464 -ra------ C:\WINDOWS\system32\drivers\ymidusb.sys
    2008-08-06 18:21 . 2008-08-06 18:21 101,376 --a------ C:\WINDOWS\system32\drivers\ACEDRV07.sys
    2008-08-06 18:21 . 2008-08-22 18:19 951 --a------ C:\WINDOWS\MusicStudio.INI
    2008-08-06 18:17 . 2004-08-11 20:53 38,912 --a------ C:\WINDOWS\system32\mgxasio.dll
    2008-08-06 18:16 . 2008-08-13 15:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
    2008-08-06 18:14 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
    2008-08-06 18:14 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
    2008-08-06 18:12 . 2008-08-06 18:12 <REP> d-------- C:\Program Files\Fichiers communs\MAGIX Shared
    2008-08-06 18:09 . 2008-08-13 15:34 <REP> d-------- C:\WINDOWS\system32\MAGIX
    2008-08-06 18:09 . 2008-08-09 16:09 <REP> d-------- C:\MAGIX
    2008-08-06 18:09 . 2002-09-21 00:33 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
    2008-08-06 18:09 . 2007-07-11 11:53 697,560 --a------ C:\WINDOWS\system32\mgxoschk.dll
    2008-08-06 18:09 . 1998-10-15 17:28 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
    2008-08-06 18:09 . 1999-01-28 14:44 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll
    2008-08-06 18:09 . 2008-08-13 15:34 6,768 --a------ C:\WINDOWS\mgxoschk.ini
    2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
    2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a--c--- C:\WINDOWS\system32\dllcache\usbohci.sys
    2008-08-05 18:34 . 2008-08-17 23:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\fr
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\bits
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\l2schemas
    2008-08-05 18:33 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\ServicePackFiles
    2008-08-05 16:58 . 2008-08-05 16:58 <REP> d-------- C:\WINDOWS\Sun
    2008-08-05 16:44 . 2008-08-05 16:44 <REP> d-------- C:\Program Files\MSXML 4.0

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-13 13:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-10 21:44 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
    2008-08-03 14:00 --------- d-----w C:\Program Files\ASUS
    2008-08-03 13:55 --------- d-----w C:\Program Files\Attansic
    2008-08-03 13:52 --------- d-----w C:\Program Files\Realtek
    2008-08-03 13:50 --------- d-----w C:\Program Files\Intel
    2008-08-03 13:38 --------- d-----w C:\Program Files\microsoft frontpage
    2008-08-03 13:37 --------- d-----w C:\Program Files\Services en ligne
    2008-08-03 13:34 --------- d-----w C:\Program Files\Windows Plus
    2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
    2006-06-22 23:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-08-26_ 0.05.03.42 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2008-08-27 00:42:37 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5c8.dat
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
    "MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2008-04-14 04:34 1695232]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
    "UtilCmd"="C:\WINDOWS\system32\qvevqpor.exe" [2008-08-23 15:45 106496]
    "hlpcfg"="C:\WINDOWS\system32\ehmfezwp.exe" [2008-08-23 19:23 102400]
    "ComCfgChk"="C:\WINDOWS\system32\byhuxone.exe" [2008-08-24 17:04 90112]
    "mntgen"="C:\WINDOWS\system32\idylsvmz.exe" [2008-08-25 22:10 102400]
    "CfgMsgCom"="C:\WINDOWS\system32\xajerwjo.exe" [2008-08-26 00:31 102400]
    "StrHlpUtil"="C:\WINDOWS\system32\dkfqdszm.exe" [2008-08-26 03:11 102400]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
    "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
    "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
    "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-08-06 16:41 652528]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
    "lphcv2tj0et39"="C:\WINDOWS\system32\lphcv2tj0et39.exe" [BU]
    "inrhcr2tj0et39"="C:\Documents and Settings\Manu\Local Settings\temp\.tt9.tmp.exe" [BU]
    "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2006-09-12 10:58 16264192 C:\WINDOWS\RTHDCPL.exe]
    "nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-10-12 04:03 439568]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "zBXnjZhEwz"="C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe" [2008-08-23 15:45 65536]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "ComMntWin"= {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll [2008-08-23 15:45 131072]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=ksdorg.dll esrlyl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "midi4"= xgusb.cpl

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\eChanblard\\emule.exe"=
    "C:\\UT2004\\System\\UT2004.exe"=
    "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
    "C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=

    .
    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Manu\Application Data\Mozilla\Firefox\Profiles\sic4estv.default\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.fr
    FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\ma-config.com\nphardwaredetection.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npornap.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-27 03:36:54
    Windows 5.1.2600 Service Pack 3 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    --------------------- DLLs a chargé sous des processus courants ---------------------

    PROCESS: C:\WINDOWS\explorer.exe
    -> C:\Program Files\ptigbqe\ComMntWin.dll
    .
    Temps d'accomplissement: 2008-08-27 4:33:12
    ComboFix-quarantined-files.txt 2008-08-27 02:28:25
    ComboFix2.txt 2008-08-26 00:57:44

    Pre-Run: 136,975,536,128 octets libres
    Post-Run: 137,007,779,840 octets libres

    263 --- E O F --- 2008-08-20 12:15:19

    RAPPORRT HIJACKTHIS

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 09:54:31, on 27/08/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\qvevqpor.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\ehgpavyx.exe
    C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\system32\qvevqpor.exe
    C:\Documents and Settings\Manu\Bureau\cool.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
    O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
    O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
    O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
    O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
    O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
    O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
    O4 - HKCU\..\Run: [dsccfg] C:\WINDOWS\system32\ovixohaj.exe
    O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
    O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  18. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Salut !!

    Copie le texte ci-dessous :

    File::
    c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe

    Folder::

    Registry::

    Ouvre le Bloc-Notes puis colle le texte copié.
    (Démarrer\Tous les programmes\Accessoires\Bloc notes.)
    Sauvegarde ce fichier sous le nom de CFScript.txt.

    Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

    http://sd-1.archive-host.com/membres/up/1366464061/CFScript.gif

    Cela va relancer Combofix,

    Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

    Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

    Ne touche à rien tant que le scan n'est pas terminé.

    Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

    S'il n'y a pas de rédémarrage, poste quand même les rapports.

    ensuite refais un nouveau rapport hijackthis pour vérifier stp
    0
  19. manbo49 Messages postés 66 Statut Membre 1
     
    Rapport combofix :

    ComboFix 08-08-26.02 - Manu 2008-08-28 1:14:44.8 - NTFSx86
    Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.1540 [GMT 2:00]
    Endroit: C:\Documents and Settings\Manu\Bureau\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Manu\Bureau\CFScript.txt
    * Création d'un nouveau point de restauration

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

    FILE ::
    c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run -------
    .
    c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe
    C:\WINDOWS\system32\blphcv2tj0et39.scr
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\WINDOWS\system32\phcv2tj0et39.bmp

    .
    ((((((((((((((((((((((((((((( Fichiers créés 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
    .

    2008-08-27 09:43 . 2008-08-27 09:43 90,112 --a------ C:\WINDOWS\system32\ovixohaj.exe
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
    2008-08-27 02:01 . 2008-08-03 15:32 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
    2008-08-27 02:01 . 2008-08-03 17:27 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
    2008-08-27 02:01 . 2008-08-27 02:09 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
    2008-08-27 02:01 . 2008-08-27 02:01 <REP> d-------- C:\Documents and Settings\Administrateur
    2008-08-26 21:03 . 2008-08-27 02:09 2,318 --a------ C:\WINDOWS\system32\tmp.reg
    2008-08-26 03:11 . 2008-08-26 03:11 102,400 --a------ C:\WINDOWS\system32\dkfqdszm.exe
    2008-08-26 00:31 . 2008-08-26 00:31 102,400 --a------ C:\WINDOWS\system32\xajerwjo.exe
    2008-08-25 23:08 . 2008-08-25 23:08 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
    2008-08-25 22:49 . 2008-08-25 22:49 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-25 22:48 . 2008-08-25 22:48 <REP> d--h----- C:\CanonMP
    2008-08-25 22:48 . 2005-05-06 21:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7K.DLL
    2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2008-08-25 22:48 . 2008-04-13 20:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
    2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
    2008-08-25 22:48 . 2008-04-13 20:45 15,104 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
    2008-08-25 22:48 . 2005-05-06 21:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7K.DLL
    2008-08-25 22:11 . 2008-08-25 22:17 <REP> d-------- C:\Program Files\Navilog1
    2008-08-25 22:10 . 2008-08-25 22:10 102,400 --a------ C:\WINDOWS\system32\idylsvmz.exe
    2008-08-25 01:13 . 2008-08-25 01:13 <REP> d-------- C:\Program Files\RogueRemover FREE
    2008-08-24 17:04 . 2008-08-24 17:04 90,112 --a------ C:\WINDOWS\system32\byhuxone.exe
    2008-08-23 19:23 . 2008-08-23 19:23 102,400 --a------ C:\WINDOWS\system32\ehmfezwp.exe
    2008-08-23 15:46 . 2008-08-23 15:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\upszslwp
    2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Program Files\ptigbqe
    2008-08-23 15:45 . 2008-08-23 15:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\qrgfqvuj
    2008-08-23 15:45 . 2008-08-23 15:45 106,496 --a------ C:\WINDOWS\system32\qvevqpor.exe
    2008-08-21 01:19 . 2008-08-21 01:19 <REP> d-------- C:\Program Files\Camfrog
    2008-08-18 13:11 . 2008-08-24 17:17 <REP> d-------- C:\WINDOWS\BDOSCAN8
    2008-08-18 04:54 . 2008-08-19 01:52 <REP> d-------- C:\Documents and Settings\Manu\Application Data\gtk-2.0
    2008-08-18 04:54 . 2008-08-18 04:54 <REP> d-------- C:\Documents and Settings\Manu\.thumbnails
    2008-08-18 04:54 . 2008-08-19 02:14 <REP> d-------- C:\Documents and Settings\Manu\.gimp-2.4
    2008-08-18 04:51 . 2008-08-18 04:51 <REP> d-------- C:\Program Files\GIMP-2.0
    2008-08-17 23:58 . 2008-08-28 01:11 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WholeSecurity
    2008-08-17 23:52 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-08-17 23:52 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-08-17 23:52 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-08-17 23:52 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-08-17 23:52 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-08-17 23:52 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-08-17 23:52 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-08-17 23:52 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-08-17 23:52 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-08-17 00:42 . 2008-08-17 00:42 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Malwarebytes
    2008-08-17 00:41 . 2008-08-25 21:16 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-17 00:41 . 2008-08-17 00:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-17 00:41 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-17 00:41 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-17 00:35 . 2008-08-17 00:35 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Grisoft
    2008-08-17 00:34 . 2008-08-17 00:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-08-17 00:34 . 2007-05-30 14:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-08-16 04:38 . 2006-12-26 16:50 91,547 --a------ C:\Documents and Settings\Manu\EasyBanner_3.0.zip
    2008-08-16 04:35 . 2008-08-16 04:35 <REP> d-------- C:\Program Files\EasyBanner 4
    2008-08-16 04:35 . 2006-06-28 14:24 509,920 --a------ C:\WINDOWS\system32\SEGOEUI.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 490,852 --a------ C:\WINDOWS\system32\SEGOEUIB.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 393,068 --a------ C:\WINDOWS\system32\SEGOEUIZ.TTF
    2008-08-16 04:35 . 2006-06-28 14:24 380,456 --a------ C:\WINDOWS\system32\SEGOEUII.TTF
    2008-08-15 18:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-08-15 18:57 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-08-13 22:22 . 2008-08-13 22:22 <REP> d-------- C:\Program Files\Windows Media Connect 2
    2008-08-13 22:21 . 2008-08-13 22:21 <REP> d-------- C:\WINDOWS\system32\LogFiles
    2008-08-13 22:21 . 2008-08-13 22:22 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-08-13 22:16 . 2008-08-13 22:16 <REP> d-------- C:\Documents and Settings\Manu\Application Data\DivX
    2008-08-13 22:15 . 2008-08-13 22:15 <REP> d-------- C:\Program Files\DivX
    2008-08-13 18:26 . 2008-08-26 18:02 69 --a------ C:\WINDOWS\NeroDigital.ini
    2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Program Files\eBay
    2008-08-13 15:54 . 2008-08-17 23:49 <REP> d-------- C:\Documents and Settings\Manu\Application Data\WholeSecurity
    2008-08-13 15:54 . 2008-08-17 05:55 <REP> d-------- C:\Documents and Settings\Manu\Application Data\eBay
    2008-08-13 15:54 . 2008-08-13 15:54 <REP> d-------- C:\Documents and Settings\All Users\Application Data\eBay
    2008-08-13 15:53 . 2008-08-13 15:53 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield
    2008-08-13 15:34 . 2008-08-13 15:34 <REP> d-------- C:\Program Files\MAGIX
    2008-08-13 15:34 . 2007-04-27 10:43 120,200 --a------ C:\WINDOWS\system32\DLLDEV32i.dll
    2008-08-10 23:44 . 2008-08-10 23:44 <REP> d-------- C:\WINDOWS\Downloaded Installations
    2008-08-10 23:26 . 2008-08-26 00:35 51 --a------ C:\WINDOWS\npornap.INI
    2008-08-10 23:24 . 2008-08-10 23:24 <REP> d-------- C:\Program Files\Orange
    2008-08-09 16:17 . 2008-08-09 16:17 <REP> d-------- C:\Documents and Settings\Manu\Application Data\InstallShield Installation Information
    2008-08-09 16:07 . 2008-08-09 16:07 <REP> d-------- C:\Program Files\Unreal Tournament 3
    2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\WINDOWS\system32\AGEIA
    2008-08-09 14:36 . 2008-08-09 14:36 <REP> d-------- C:\Program Files\AGEIA Technologies
    2008-08-09 14:35 . 2008-08-09 14:35 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
    2008-08-08 16:51 . 2008-08-08 16:51 <REP> d-------- C:\Program Files\IK Multimedia
    2008-08-08 14:15 . 2008-08-08 14:15 <REP> d-------- C:\Documents and Settings\Manu\Application Data\Nero
    2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Program Files\Nero
    2008-08-08 14:12 . 2008-08-08 14:14 <REP> d-------- C:\Program Files\Fichiers communs\Nero
    2008-08-08 14:12 . 2008-08-08 14:12 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
    2008-08-07 20:34 . 2004-05-14 16:53 462,848 --a------ C:\WINDOWS\system32\ltkrn13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 450,560 --a------ C:\WINDOWS\system32\ltimg13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 401,408 --a------ C:\WINDOWS\system32\lfcmp13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 299,008 --a------ C:\WINDOWS\system32\ltdis13n.dll
    2008-08-07 20:34 . 2004-01-12 02:09 206,336 --a------ C:\WINDOWS\system32\ltefx13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 163,840 --a------ C:\WINDOWS\system32\ltfil13n.dll
    2008-08-07 20:34 . 2003-11-04 15:10 69,632 --a------ C:\WINDOWS\system32\lfgif13n.dll
    2008-08-07 20:34 . 2004-05-14 16:53 57,344 --a------ C:\WINDOWS\system32\lfbmp13n.dll
    2008-08-07 20:27 . 2008-08-07 20:27 <REP> d-------- C:\Program Files\Microsoft.NET
    2008-08-07 20:25 . 2008-08-07 20:25 <REP> d-------- C:\WINDOWS\SHELLNEW
    2008-08-07 20:25 . 2008-08-07 20:25 <REP> dr-h----- C:\MSOCache
    2008-08-07 20:25 . 2008-08-15 23:30 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-08-07 20:19 . 2008-08-07 20:19 <REP> d-------- C:\Documents and Settings\Manu\Application Data\MAGIX
    2008-08-07 14:22 . 2005-07-25 08:13 1,201,664 -ra------ C:\WINDOWS\system32\xgusb.cpl
    2008-08-07 14:22 . 2005-07-25 08:13 14,464 -ra------ C:\WINDOWS\system32\drivers\ymidusb.sys
    2008-08-06 18:21 . 2008-08-06 18:21 101,376 --a------ C:\WINDOWS\system32\drivers\ACEDRV07.sys
    2008-08-06 18:21 . 2008-08-22 18:19 951 --a------ C:\WINDOWS\MusicStudio.INI
    2008-08-06 18:17 . 2004-08-11 20:53 38,912 --a------ C:\WINDOWS\system32\mgxasio.dll
    2008-08-06 18:16 . 2008-08-13 15:34 <REP> d-------- C:\Documents and Settings\All Users\Application Data\MAGIX
    2008-08-06 18:14 . 2001-05-11 13:18 420,240 --a------ C:\WINDOWS\system32\mpg4c32.dll
    2008-08-06 18:14 . 2001-03-26 04:41 245,760 --a------ C:\WINDOWS\system32\mp4sds32.ax
    2008-08-06 18:12 . 2008-08-06 18:12 <REP> d-------- C:\Program Files\Fichiers communs\MAGIX Shared
    2008-08-06 18:09 . 2008-08-13 15:34 <REP> d-------- C:\WINDOWS\system32\MAGIX
    2008-08-06 18:09 . 2008-08-09 16:09 <REP> d-------- C:\MAGIX
    2008-08-06 18:09 . 2002-09-21 00:33 1,089,536 --a------ C:\WINDOWS\system32\ROBOEX32.DLL
    2008-08-06 18:09 . 2007-07-11 11:53 697,560 --a------ C:\WINDOWS\system32\mgxoschk.dll
    2008-08-06 18:09 . 1998-10-15 17:28 85,504 --a------ C:\WINDOWS\system32\HtmlWH.dll
    2008-08-06 18:09 . 1999-01-28 14:44 49,152 --a------ C:\WINDOWS\system32\INETWH32.dll
    2008-08-06 18:09 . 2008-08-13 15:34 6,768 --a------ C:\WINDOWS\mgxoschk.ini
    2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a------ C:\WINDOWS\system32\drivers\usbohci.sys
    2008-08-05 21:18 . 2008-04-13 20:45 17,152 --a--c--- C:\WINDOWS\system32\dllcache\usbohci.sys
    2008-08-05 18:34 . 2008-08-17 23:53 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\fr
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\system32\bits
    2008-08-05 18:34 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\l2schemas
    2008-08-05 18:33 . 2008-08-05 18:34 <REP> d-------- C:\WINDOWS\ServicePackFiles
    2008-08-05 16:58 . 2008-08-05 16:58 <REP> d-------- C:\WINDOWS\Sun

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-13 13:54 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-10 21:44 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
    2008-08-03 14:00 --------- d-----w C:\Program Files\ASUS
    2008-08-03 13:55 --------- d-----w C:\Program Files\Attansic
    2008-08-03 13:52 --------- d-----w C:\Program Files\Realtek
    2008-08-03 13:50 --------- d-----w C:\Program Files\Intel
    2008-08-03 13:38 --------- d-----w C:\Program Files\microsoft frontpage
    2008-08-03 13:37 --------- d-----w C:\Program Files\Services en ligne
    2008-08-03 13:34 --------- d-----w C:\Program Files\Windows Plus
    2008-07-25 08:36 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
    2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-07-23 16:48 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
    2008-07-23 16:48 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
    2008-07-23 16:46 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
    2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
    2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
    2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
    2006-06-22 23:48 32,768 ----a-r C:\WINDOWS\inf\UpdateUSB.exe
    .

    ((((((((((((((((((((((((((((( snapshot@2008-08-26_ 0.05.03.42 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2007-03-06 01:34:38 216,800 -c----w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe
    + 2007-03-06 01:35:47 394,976 -c----w C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\updspapi.dll
    + 2007-08-13 16:54:10 765,952 -c----w C:\WINDOWS\ie7updates\KB938127-v2-IE7\vgx.dll
    - 2007-08-13 16:54:10 765,952 -c----w C:\WINDOWS\system32\dllcache\VGX.dll
    + 2008-05-27 17:25:06 765,952 -c----w C:\WINDOWS\system32\dllcache\vgx.dll
    + 2008-08-27 23:10:51 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5c8.dat
    .
    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 04:33 15360]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
    "DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-07-24 17:02 490952]
    "MSMSGS"="C:\PROGRA~1\MESSEN~1\msmsgs.exe" [2008-04-14 04:34 1695232]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-08-03 12:51 202024]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]
    "UtilCmd"="C:\WINDOWS\system32\qvevqpor.exe" [2008-08-23 15:45 106496]
    "hlpcfg"="C:\WINDOWS\system32\ehmfezwp.exe" [2008-08-23 19:23 102400]
    "ComCfgChk"="C:\WINDOWS\system32\byhuxone.exe" [2008-08-24 17:04 90112]
    "mntgen"="C:\WINDOWS\system32\idylsvmz.exe" [2008-08-25 22:10 102400]
    "CfgMsgCom"="C:\WINDOWS\system32\xajerwjo.exe" [2008-08-26 00:31 102400]
    "StrHlpUtil"="C:\WINDOWS\system32\dkfqdszm.exe" [2008-08-26 03:11 102400]
    "dsccfg"="C:\WINDOWS\system32\ovixohaj.exe" [2008-08-27 09:43 90112]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:34 64512]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-16 14:01 13529088]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-16 14:01 86016]
    "LogitechCommunicationsManager"="C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
    "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
    "NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
    "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-08-08 09:25 1828136]
    "eBayToolbar"="C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe" [2008-08-06 16:41 652528]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25 6731312]
    "lphcv2tj0et39"="C:\WINDOWS\system32\lphcv2tj0et39.exe" [BU]
    "inrhcr2tj0et39"="C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp.exe" [BU]
    "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2006-09-12 10:58 16264192 C:\WINDOWS\RTHDCPL.exe]
    "nwiz"="nwiz.exe" [2008-05-16 14:01 1630208 C:\WINDOWS\system32\nwiz.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 04:33 15360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "WUAppSetup"="C:\Program Files\Fichiers communs\logishrd\WUApp32.exe" [2007-10-12 04:03 439568]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
    "zBXnjZhEwz"="C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe" [2008-08-23 15:45 65536]

    C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "ComMntWin"= {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll [2008-08-23 15:45 131072]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=ksdorg.dll esrlyl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "midi4"= xgusb.cpl

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\eChanblard\\emule.exe"=
    "C:\\UT2004\\System\\UT2004.exe"=
    "C:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\Unreal Tournament 3\\Binaries\\UT3.exe"=
    "C:\\Program Files\\Camfrog\\Camfrog Video Chat\\Camfrog Video Chat.exe"=

    R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35]
    R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37]
    R3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-08-22 07:36]
    S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;C:\MAGIX\Common\Database\bin\fbserver.exe [2005-11-17 15:18]
    S3 LVPrcMon;Logitech LVPrcMon Driver;C:\WINDOWS\system32\drivers\LVPrcMon.sys [2005-12-09 15:37]
    S3 maconfservice;Ma-Config Service;C:\Program Files\ma-config.com\maconfservice.exe [2008-07-25 20:57]
    S3 MBAMSwissArmy;MBAMSwissArmy;C:\WINDOWS\system32\drivers\mbamswissarmy.sys [2008-08-17 15:01]
    S3 US122;US122 Driver;C:\WINDOWS\system32\Drivers\US122.sys [2007-08-29 15:50]
    S3 US122DL;US122 Firmware Downloader;C:\WINDOWS\system32\Drivers\US122DL.sys [2007-08-29 15:50]
    S3 Us122WdmService;US122 Wdm Audio;C:\WINDOWS\system32\Drivers\US122Wdm.sys [2007-08-29 15:50]
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-28 01:26:23
    Windows 5.1.2600 Service Pack 3 NTFS

    Balayage processus cachés ...

    Balayage caché autostart entries ...

    Balayage des fichiers cachés ...

    Scan terminé avec succès
    Les fichiers cachés: 0

    **************************************************************************
    .
    Temps d'accomplissement: 2008-08-28 1:31:35
    ComboFix-quarantined-files.txt 2008-08-27 23:31:17
    ComboFix2.txt 2008-08-27 02:34:05
    ComboFix3.txt 2008-08-26 00:57:44

    Pre-Run: 136,903,290,880 octets libres
    Post-Run: 136,906,137,600 octets libres

    280 --- E O F --- 2008-08-27 22:36:15

    Et celui d'hikjackthis :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 01:35:04, on 28/08/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\WINDOWS\system32\byhuxone.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Documents and Settings\Manu\Bureau\cool.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
    O4 - HKLM\..\Run: [inrhcr2tj0et39] C:\Documents and Settings\Manu\Local Settings\temp\.tt5.tmp.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
    O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
    O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
    O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
    O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
    O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
    O4 - HKCU\..\Run: [dsccfg] C:\WINDOWS\system32\ovixohaj.exe
    O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
    O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  20. geoffrey5 Messages postés 14008 Statut Contributeur sécurité 10
     
    Salut !!

    ca devrait partir en faisant ceci :

    télécharge OtMoveIt

    Télécharge OTMoveIt (de Old_Timer) sur ton Bureau à cette adresse :

    (c est le numéro 7 en bas de la page) : https://www.androidworld.fr/

    Double-clique sur OTMoveIt.exe pour le lancer.
    Assure toi que la case Unregister Dll's and Ocx's soit bien cochée.
    Copie la liste qui se trouve en gras dans la citation ci-dessous et colle-la dans le cadre de gauche de OTMoveIt sous Paste List of Files/Folders to move.

    c:\documents and settings\all users\application data\qrgfqvuj\spmdyzah.exe
    c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe

    clique sur MoveIt! pour lancer la suppression.
    Le résultat apparaitra dans le cadre "Results".
    Clique sur Exit pour fermer.
    Poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

    Il te sera peut-être demandé de redémarrer le pc pour achever la suppression. Si c'est le cas accepte par Yes.

    ensuite :

    Fix.reg

    Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisi nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en gras dans la citation ci-dessous (copie tout d'un trait sans les barres(x)) :

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

    REGEDIT4

    [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
    "inrhcr2tj0et39"=-

    XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
    Note : Regedit4 est sur la premiere ligne dans le bloc note et il y a une ligne blanche a la fin.
    Puis click sur "fichier"/"enregistrer sous" :
    dans : sur le bureau
    Nom du fichier : fix.reg
    Type de fichier : "tous les fichiers"
    clique sur "enregistrer"

    ca doit ressembler à ca une fois enregistré :

    http://img520.imageshack.us/img520/4251/screenshot005ps2.png

    double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
    Si c'est bien le cas, clique sur "oui"

    ensuite redémarre le pc et refais un nouveau rapport hijackthis stp
    0
  21. manbo49 Messages postés 66 Statut Membre 1
     
    RE !!

    j'ai tout fait mais c'est encore la !!

    Rapport ot move it !

    c:\documents and settings\all users\application data\qrgfqvuj\spmdyzah.exe moved successfully.
    c:\documents and settings\manu\local settings\temp\.tt5.tmp.exe moved successfully.

    OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08282008_020421

    rapport hijackthis :

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 02:16:05, on 28/08/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe
    C:\Program Files\Logitech\QuickCam\Quickcam.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\lphcv2tj0et39.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\DAEMON Tools Lite\daemon.exe
    C:\PROGRA~1\MESSEN~1\msmsgs.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\ehmfezwp.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Fichiers communs\Logishrd\LQCVFX\COCIManager.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Manu\Bureau\cool.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
    O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [lphcv2tj0et39] C:\WINDOWS\system32\lphcv2tj0et39.exe
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
    O4 - HKCU\..\Run: [MSMSGS] "C:\PROGRA~1\MESSEN~1\msmsgs.exe" /background
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [UtilCmd] C:\WINDOWS\system32\qvevqpor.exe
    O4 - HKCU\..\Run: [hlpcfg] C:\WINDOWS\system32\ehmfezwp.exe
    O4 - HKCU\..\Run: [ComCfgChk] C:\WINDOWS\system32\byhuxone.exe
    O4 - HKCU\..\Run: [mntgen] C:\WINDOWS\system32\idylsvmz.exe
    O4 - HKCU\..\Run: [CfgMsgCom] C:\WINDOWS\system32\xajerwjo.exe
    O4 - HKCU\..\Run: [StrHlpUtil] C:\WINDOWS\system32\dkfqdszm.exe
    O4 - HKCU\..\Run: [dsccfg] C:\WINDOWS\system32\ovixohaj.exe
    O4 - HKCU\..\Run: [uichk] C:\WINDOWS\system32\lspipqxg.exe
    O4 - HKLM\..\Policies\Explorer\Run: [zBXnjZhEwz] C:\Documents and Settings\All Users\Application Data\qrgfqvuj\spmdyzah.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] C:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x092e -f video -m logitech -d 11.5.0.1145 (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Recherche sur eBay - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
    O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/...
    O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
    O20 - AppInit_DLLs: ksdorg.dll esrlyl.dll
    O21 - SSODL: ComMntWin - {0E25291A-674C-BC90-9700-0A8EE42EBD69} - C:\Program Files\ptigbqe\ComMntWin.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\MAGIX\Common\Database\bin\fbserver.exe
    O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe
    O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe
    O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe
    O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    0
  • 1
  • 2

Discussions similaires

Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
Google Chrome "  Échec de l'analyse antivirus "
jmpower -
RBmoon -

18 réponses