MS Antivirus Sécurity center

Question

Bonjour, 

J'ai besoin d'aide... Il y a quelques jours s'est affiché sur mon bureau un panneau fixe "Insecure Internet activity. Threat of virus attack" suivi par deux autres : "MS Antivirus Sécurity center" et "Antivirus warning".

Pour le premier j'ai réussi à le faire disparaître en utilisant ComboFix.exe, mais pour les deux autre ?????

Comment dois-je procéder pour m'en débarrasser ?

J'ai fait un scan avec HijackThis et avec Malwarebytes' Anti-Malware je vous fait suivre les deux rapport.

Je suis perdu et j'ai peur de faire des bêtises en acceptant les suppressions ou les mises en quarantaines qui me sont proposées :((((

Merci pour votre aide

Rapport HijackThis  du 29 août 2008

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:09:44, on 29/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\MioNet\MioNetManager.exe
C:\Program Files\NDAS\System
dassvc.exe
C:\Program Files\MioNet\jvm\bin\MioNet.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Apps\Softex\OmniPass\Omniserv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Apps\Softex\OmniPass\OPXPApp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\WINDOWS\System32\drivers\PhiBtn.exe
C:\WINDOWS\System32\drivers\Tray900.exe
C:\Program Files\MSA\MSA.exe
C:\Windows\System32\VIEC.exe
C:\Windows\System32\VIEE.exe
C:\Windows\System32\VIE10.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\BitComet\BitComet.exe
C:\WINDOWS\explorer.exe
C:\Program Files\PCHealthCenter\1.exe
C:\Program Files\PCHealthCenter\3.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Defenza\pcd-as.exe
C:\Program Files\RogueRemover FREE\RogueRemover.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
D:\Documents and Settings\Anthony Chabrières.DOUCE.000\Bureau\Anti Virus Spyware\SUPERAntiSpyware.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = file://C:\APPS\IE\offline\fr.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: CInterceptor Object - {38D3FE60-3D53-4F37-BB0E-C7A97A26A156} - C:\Program Files\Pando Networks\Pando\PandoIEPlugin.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Pando Toolbar BHO - {E3EA4FD1-CADE-4ae5-84F7-086EEE888BE4} - C:\Program Files\PandoBar\bar\1.bin\PANDOBAR.DLL
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: Pando Toolbar - {E3EA4FD9-CADE-4ae5-84F7-086EEE888BE4} - C:\Program Files\PandoBar\bar\1.bin\PANDOBAR.DLL
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [PhiBtn] %SystemRoot%\System32\drivers\PhiBtn.exe
O4 - HKLM\..\Run: [Traymin900] %SystemRoot%\System32\drivers\Tray900.exe
O4 - HKLM\..\Run: [\VIEC.exe] C:\Windows\System32\VIEC.exe
O4 - HKLM\..\Run: [\VIE13.exe] C:\Windows\System32\VIE13.exe
O4 - HKLM\..\Run: [PCDAS] C:\Program Files\Defenza\pcd-as.exe /10003
O4 - HKLM\..\Run: [\VIE45.exe] C:\Windows\System32\VIE45.exe
O4 - HKLM\..\Run: [\VIE4A.exe] C:\Windows\System32\VIE4A.exe
O4 - HKLM\..\Run: [\VIE51.exe] C:\Windows\System32\VIE51.exe
O4 - HKLM\..\Run: [\VIE56.exe] C:\Windows\System32\VIE56.exe
O4 - HKLM\..\Run: [\VIEBF.exe] C:\Windows\System32\VIEBF.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [\VIEC.exe] C:\Windows\System32\VIEC.exe
O4 - HKCU\..\Run: [\VIE13.exe] C:\Windows\System32\VIE13.exe
O4 - HKCU\..\Run: [\VIE45.exe] C:\Windows\System32\VIE45.exe
O4 - HKCU\..\Run: [\VIE4A.exe] C:\Windows\System32\VIE4A.exe
O4 - HKCU\..\Run: [\VIE51.exe] C:\Windows\System32\VIE51.exe
O4 - HKCU\..\Run: [\VIE56.exe] C:\Windows\System32\VIE56.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] D:\Documents and Settings\Anthony Chabrières.DOUCE.000\Bureau\Anti Virus Spyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [\VIEBF.exe] C:\Windows\System32\VIEBF.exe
O4 - Startup: Yahoo! Widget Engine.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.exe.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
O4 - Global Startup: Lancement rapide d'Adobe Acrobat.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: NDAS Device Management.lnk.disabled
O4 - Global Startup: OFFICE One Clock v6.5.lnk.disabled
O4 - Global Startup: OFFICE One Notes v6.5.lnk.disabled
O4 - Global Startup: Outil de mise à jour Google.lnk.disabled
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Search - ?p=ZNxpt233YYFR
O8 - Extra context menu item: &Winamp Search - D:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbaresources\en-US\local\search.html
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: SmartShopper - Compare travel rates - {3CC3D8FE-F0E0-4dd1-A69A-8C56BCC7BEC0} - C:\Program Files\SmartShopper\Bin\2.5.0\SmrtShpr.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet	ools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\fr.htm
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) - http://support.packardbell.com/files/activex/InfosFinder2.CAB
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - https://driveragent.com/files/driveragent.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC7361F9-FBFE-44CC-822C-DBBEF249FEBB}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.51 85.255.112.97
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - D:\Documents and Settings\Anthony Chabrières.DOUCE.000\Bureau\Anti Virus Spyware\SASWINLO.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.802.22438 (GoogleDesktopManager-022208-143751) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - Unknown owner - C:\Program Files\LogMeIn\x86\RaMaint.exe (file missing)
O23 - Service: LogMeIn - Unknown owner - C:\Program Files\LogMeIn\x86\LogMeIn.exe (file missing)
O23 - Service: MioNet Service (MioNet) - Unknown owner - C:\Program Files\MioNet\MioNetManager.exe
O23 - Service: NDAS Service (ndassvc) - XIMETA, Inc. - C:\Program Files\NDAS\System
dassvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Softex Inc. - C:\Apps\Softex\OmniPass\Omniserv.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: USBDeviceService - Unknown owner - C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

lancelot · Answer

J'ai le meme probleme sous vista Help :'(

jlpjlp · Answer

slt colle le rapport combofix

____________
puis analyse ce fichier sur virus total et colles le rapoort:
https://www.virustotal.com/gui/

C:\Program Files\MioNet\jvm\bin\MioNet.exe 


____________
puis

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
• Redémarre ton ordinateur
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
• Choisis ton compte.
Déroule la liste des instructions ci-dessous :
• Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.
• Appuie sur Y pour commencer le processus de nettoyage.
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
• Appuie sur une touche pour redémarrer le PC.
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum

DaddyToto · Answer

Voila le rapport de ComboFix je fais lre reste tout de suite. Merci ComboFix 08-08-27.05 - Anthony Chabrières 2008-08-28 23:53:26.3 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1411 [GMT 2:00] Endroit: D:\Documents and Settings\Anthony Chabrières.DOUCE.000\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\PCHealthCenter C:\Program Files\PCHealthCenter\[u]0/u.exe C:\Program Files\PCHealthCenter\[u]0/u.gif C:\Program Files\PCHealthCenter\1.exe C:\Program Files\PCHealthCenter\1.gif C:\Program Files\PCHealthCenter\1.ico C:\Program Files\PCHealthCenter\2.exe C:\Program Files\PCHealthCenter\2.gif C:\Program Files\PCHealthCenter\2.ico C:\Program Files\PCHealthCenter\3.exe C:\Program Files\PCHealthCenter\3.gif C:\Program Files\PCHealthCenter\4.exe C:\Program Files\PCHealthCenter\5.exe C:\Program Files\PCHealthCenter\7.exe C:\svchost.exe . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-28 to 2008-08-28 )))))))))))))))))))))))))))))))))))) . 2008-08-28 23:58 . 2008-08-28 15:57 32,768 --a------ C:\WINDOWS\system32\VIE3.exe 2008-08-28 23:58 . 2008-08-28 15:57 31,232 --a------ C:\WINDOWS\system32\VIE4.exe 2008-08-28 23:57 . 54,156 C:\WINDOWS\QTFont.qfn 2008-08-28 23:57 . 1,409 C:\WINDOWS\QTFont.for 2008-08-28 21:56 . 2008-08-25 18:48 106,496 --a------ C:\WINDOWS\system32\VIE13.exe 2008-08-28 17:46 . 2008-08-28 15:57 32,768 --a------ C:\WINDOWS\system32\VIEE.exe 2008-08-28 17:46 . 2008-08-28 15:57 31,232 --a------ C:\WINDOWS\system32\VIE10.exe 2008-08-28 17:45 . 2008-08-25 18:48 106,496 --a------ C:\WINDOWS\system32\VIEC.exe 2008-08-28 12:09 . 2008-08-28 12:09 d-------- D:\Documents and Settings\Anthony Chabrières.DOUCE.000 2008-08-28 12:09 . 2008-08-28 12:09 d-------- D:\Documents and Settings\Anthony Chabrières.DOUCE 2008-08-28 12:09 . D:\Documents and Settings\Anthony ChabriÞres.DOUCE\Local Settings 2008-08-28 12:09 . D:\Documents and Settings\Anthony ChabriÞres.DOUCE.000\Local Settings 2008-08-28 12:09 . D:\Documents and Settings\Anthony ChabriÞres.DOUCE.000\Local Settings 2008-08-28 01:33 . 2008-08-28 15:57 3,262 --a------ C:\WINDOWS\system32\2.ico 2008-08-28 01:29 . 2008-08-28 17:46 d-------- C:\Program Files\MSA 2008-08-28 01:29 . 2008-08-26 17:23 167,424 --a------ C:\WINDOWS\system32\MSA.cpl 2008-08-28 01:29 . 2008-08-28 15:57 3,262 --a------ C:\WINDOWS\system32\1.ico 2008-08-13 23:51 . 2008-08-28 23:13 d-------- C:\Program Files\MioNet 2008-08-13 23:51 . 2008-08-13 23:51 d-------- C:\Program Files\Fichiers communs\Ahead 2008-08-13 23:51 . 2008-08-13 23:51 d-------- C:\Program Files\Ahead 2008-08-13 23:51 . 2005-05-23 01:34 2,920,448 --------- C:\WINDOWS\UNSIPPS.exe 2008-08-13 23:51 . 2005-05-30 23:52 59,113 --------- C:\WINDOWS\UNSIPPS.cfg 2008-08-13 23:50 . 2008-08-13 23:50 d-------- C:\WINDOWS\Options 2008-08-13 22:35 . 2008-08-13 22:35 d-------- C:\Program Files\Ma‹do Production 2008-08-13 16:49 . 2005-08-25 19:41 266,240 --a------ C:\WINDOWS\system32\drivers\Tray900.exe 2008-08-13 16:49 . 2005-08-25 19:41 155,648 --a------ C:\WINDOWS\system32\drivers\PhiBtn.exe 2008-08-13 15:39 . 2008-08-13 15:39 244 --ah----- C:\sqmnoopt19.sqm 2008-08-13 15:39 . 2008-08-13 15:39 232 --ah----- C:\sqmdata19.sqm 2008-08-13 15:13 . 2008-08-13 15:13 d-------- C:\Program Files\Fichiers communs\Skype 2008-08-13 00:17 . 2008-05-01 16:31 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-11 19:18 . 2008-08-28 23:18 d-------- D:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-11 19:18 . 2008-08-11 19:18 d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-10 23:52 . 2008-08-10 23:52 d-------- D:\Documents and Settings\All Users\Application Data\Adobe Systems 2008-08-10 23:52 . 2008-08-10 23:52 d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared 2008-08-07 20:02 . 2008-08-07 20:02 d-------- C:\Program Files\Winamp Toolbar 2008-08-05 09:42 . 2008-08-05 09:42 d-------- D:\Documents and Settings\All Users\Application Data\Fighters 2008-08-05 09:42 . 2008-08-17 17:52 d-------- C:\Program Files\Fighters 2008-08-04 18:18 . 2008-08-04 18:18 d-------- C:\Program Files\Jasc Software Inc 2008-08-04 18:09 . 2008-08-04 18:09 d-------- C:\WINDOWS\system32\Adobe 2008-08-04 18:05 . 1998-11-13 13:16 308,224 --a------ C:\WINDOWS\IsUn040c.exe 2008-07-31 18:26 . 2008-07-31 18:26 d-------- D:\Documents and Settings\All Users\Application Data\Downloaded Installations 2008-07-30 15:48 . 2008-08-13 22:03 d-------- C:\Program Files\LimeWire . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-28 21:38 --------- d-----w C:\Program Files\Arovax AntiSpyware 2008-08-28 11:58 --------- d-----w D:\Documents and Settings\All Users\Application Data\Google Updater 2008-08-15 14:10 --------- d-----w C:\Program Files\eMule 2008-08-14 10:29 --------- d-----w D:\Documents and Settings\All Users\Application Data\WLInstaller 2008-08-13 21:50 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-13 21:50 --------- d-----w C:\Program Files\Fichiers communs\ArcSoft 2008-08-13 20:35 --------- d-----w C:\Program Files\Maïdo Production 2008-08-13 15:17 --------- d-----w C:\Program Files\Windows Live 2008-08-13 13:13 --------- d-----w D:\Documents and Settings\All Users\Application Data\Skype 2008-08-11 17:59 --------- d-----w C:\Program Files\Enigma Software Group 2008-08-10 21:47 --------- d-----w C:\Program Files\Fichiers communs\Adobe 2008-08-10 20:45 --------- d-----w C:\Program Files\DivX 2008-08-07 18:02 --------- d-----w C:\Program Files\Winamp 2008-07-31 02:35 --------- d-----w C:\Program Files\Google 2008-07-30 08:02 --------- d-----w C:\Program Files\Safari 2008-07-22 16:20 --------- d-----w C:\Program Files\Java 2008-07-20 22:13 --------- d-----w D:\Documents and Settings\LocalService.AUTORITE NT.001\Application Data\X10 Commander 2008-07-20 17:35 --------- d-----w C:\Program Files\Fichiers communs\Adobe AIR 2008-07-20 13:53 --------- d-----w C:\Program Files\a-squared Free 2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR 2008-07-17 13:23 --------- d-----w D:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-07-17 13:22 --------- d-----w C:\Program Files\Fichiers communs\Java(2) 2008-07-17 13:22 --------- d-----w C:\Program Files\Fichiers communs\Java 2008-07-17 13:21 --------- d-----w C:\Program Files\Symantec 2008-07-17 13:21 --------- d-----w C:\Program Files\Microsoft IntelliPoint 2008-07-17 13:21 --------- d-----w C:\Program Files\AVG 2008-07-17 13:21 --------- d-----w C:\Program Files\a2 2008-07-17 12:40 --------- d-----w C:\Program Files\Winamp Remote 2008-07-16 07:57 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared 2008-07-12 21:35 --------- d-----w C:\Program Files\AskTBar 2008-07-02 17:22 --------- d-----w C:\Program Files\filehippo.com 2008-07-02 17:01 --------- d-----w D:\Documents and Settings\All Users\Application Data\Avira 2008-07-02 07:09 7,599,856 ----a-w C:\Program Files\Firefox Setup 3.0.exe 2008-06-14 15:50 3,532 ----a-w C:\drmHeader.bin 2008-06-14 10:25 3,310,392 ----a-w C:\Program Files\hotbar.exe 2008-05-30 05:24 3,599,329 ----a-w C:\Program Files\aas_2.1_setup_153.exe 2008-05-28 01:27 22,311,160 ----a-w C:\Program Files\antivir_workstation_winu_en_h.exe 2008-05-16 20:07 382,352 ----a-w C:\Program Files\jre-6u6-windows-i586-p-iftw.exe 2008-05-16 19:47 11,526,300 ----a-w C:\Program Files\FreeMind-Windows-Installer-0.9.0_Beta_16-max.exe 2008-05-16 19:38 5,831,160 ----a-w C:\Program Files\rminstall.exe 2008-05-12 23:50 47,787,248 ----a-w C:\Program Files\avg_free_stf_en_8_100a1295.exe 2008-05-12 22:12 19,417 ----a-w C:\Program Files\Microsoft_Publisher_2007___Code.torrent 2008-05-08 07:07 29,017,528 ----a-w C:\Program Files\FileFormatConverters.exe 2008-05-06 13:00 15,324,232 ----a-w C:\Program Files\winampremote.exe 2008-05-05 13:42 5,438,448 ----a-w C:\Program Files\bitcomet_setup.exe 2008-04-13 21:46 2,751,368 ----a-w C:\Program Files\ccsetup206.exe 2008-04-09 08:00 15,113,215 ----a-w C:\Program Files\Install_AnnuCapt.exe 2008-04-06 22:02 197,415,200 ----a-w C:\Program Files\Nero-8.3.2.1_fra_trial.exe 2008-04-06 21:58 197,415,200 ----a-w C:\Program Files\nero-8_nero_8.3.2.1_francais_45172.exe 2008-04-06 20:18 190,292,880 ----a-w C:\Program Files\Nero810_eval01net.exe 2008-03-22 10:04 304 ----a-w C:\Program Files\robots.txt 2008-03-22 10:03 605 ----a-w C:\Program Files\index2.php 2008-03-22 10:03 4,345 ----a-w C:\Program Files\INSTALL.php 2008-03-22 10:03 30,703 ----a-w C:\Program Files\LICENSES.php 2008-03-22 10:03 3,362 ----a-w C:\Program Files\configuration.php-dist 2008-03-22 10:03 2,662 ----a-w C:\Program Files\htaccess.txt 2008-03-22 10:03 2,134 ----a-w C:\Program Files\index.php 2008-03-22 10:03 17,816 ----a-w C:\Program Files\LICENSE.php 2008-03-22 10:03 12,301 ----a-w C:\Program Files\CREDITS.php 2008-03-22 10:03 1,170 ----a-w C:\Program Files\COPYRIGHT.php 2008-03-22 10:02 25,477 ----a-w C:\Program Files\CHANGELOG.php 2008-03-05 16:05 300,159 ----a-w C:\Program Files\Winamp_Essentials.exe 2008-02-23 13:50 9,085,384 ----a-w C:\Program Files\winamp552_full_emusic-7plus_fr-fr.exe 2007-12-21 19:53 5,843,256 ----a-w C:\Program Files\Firefox Setup 2.0.0.11.exe 2007-08-18 10:42 956 ----a-w C:\Program Files\Couleurs.ini 2006-12-13 13:39 39,424 ----a-w D:\Documents and Settings\Language\pcwl0009.dll 2006-12-13 13:38 38,400 ----a-w D:\Documents and Settings\Language\pcwl000c.dll 2006-12-03 09:52 8,704 ----a-w D:\Documents and Settings\Data\pcwpdf.dll 2006-12-03 09:52 45,056 ----a-w D:\Documents and Settings\Data\settings.exe 2006-10-25 00:13 1,953,480 ----a-w C:\Program Files\PPVIEWER.EXE 2006-10-23 16:36 12,220,440 ----a-w C:\Program Files\setupfre.exe 2006-10-16 09:29 175,104 ----a-w D:\Documents and Settings\Extras\pcwdx9bk.dll 2006-06-25 08:48 32,768 ----a-w D:\Documents and Settings\Web\webupdt.exe 2006-03-12 08:22 82,944 ----a-w D:\Documents and Settings\Language\pcwl0419.dll 2006-02-22 17:28 38,400 ----a-w D:\Documents and Settings\Language\pcwl081a.dll 2006-02-22 17:26 40,960 ----a-w D:\Documents and Settings\Language\pcwl041b.dll 2006-01-10 11:17 25,555 ----a-w D:\Documents and Settings\Extras\pcw7.dat 2005-11-22 08:48 33,192 ----a-w D:\Documents and Settings\Extras\pcw5.dat 2005-11-22 08:48 28,673 ----a-w D:\Documents and Settings\Extras\pcw4.dat 2005-11-22 08:48 27,436 ----a-w D:\Documents and Settings\Extras\pcw3.dat 2005-11-22 08:48 26,244 ----a-w D:\Documents and Settings\Extras\pcw6.dat 2005-11-22 08:48 24,519 ----a-w D:\Documents and Settings\Extras\pcw1.dat 2005-11-22 08:48 10,939 ----a-w D:\Documents and Settings\Extras\pcw2.dat 2004-04-24 08:14 21,797 ----a-w D:\Documents and Settings\Data\pcwiz16.exe 2001-04-12 19:02 164,498 ----a-w C:\Program Files\palette.exe 1993-05-11 23:00 398,416 ----a-w C:\Program Files\Vbrun300.dll 1993-04-27 23:00 22,528 ----a-w C:\Program Files\Spin.vbx . ------- Sigcheck ------- 2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe . ((((((((((((((((((((((((((((( snapshot@2008-08-28_12.09.27.89 ))))))))))))))))))))))))))))))))))))))))) . + 2008-08-28 21:56:37 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_694.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 22:51 1266992] "{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL" [2008-04-06 19:28 57344] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{E3EA4FD9-CADE-4ae5-84F7-086EEE888BE4}"= "C:\Program Files\PandoBar\bar\1.bin\PANDOBAR.DLL" [2008-06-04 13:04 266240] [HKEY_CLASSES_ROOT\clsid\{e3ea4fd9-cade-4ae5-84f7-086eee888be4}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{E3EA4FD9-CADE-4AE5-84F7-086EEE888BE4}"= "C:\Program Files\PandoBar\bar\1.bin\PANDOBAR.DLL" [2008-06-04 13:04 266240] [HKEY_CLASSES_ROOT\clsid\{e3ea4fd9-cade-4ae5-84f7-086eee888be4}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 14:00 15360] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184] "BitComet"="C:\Program Files\BitComet\BitComet.exe" [2008-03-25 08:38 2196280] "\VIEC.exe"="C:\Windows\System32\VIEC.exe" [2008-08-25 18:48 106496] "\VIEE.exe"="C:\Windows\System32\VIEE.exe" [2008-08-28 15:57 32768] "\VIE10.exe"="C:\Windows\System32\VIE10.exe" [2008-08-28 15:57 31232] "\VIE13.exe"="C:\Windows\System32\VIE13.exe" [2008-08-25 18:48 106496] "\VIE3.exe"="C:\Windows\System32\VIE3.exe" [2008-08-28 15:57 32768] "\VIE4.exe"="C:\Windows\System32\VIE4.exe" [2008-08-28 15:57 31232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 18:22 7618560] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-12-22 15:40 185896] "Antivirus"="C:\Program Files\MSA\MSA.exe" [2008-08-26 17:22 416768] "\VIEC.exe"="C:\Windows\System32\VIEC.exe" [2008-08-25 18:48 106496] "\VIEE.exe"="C:\Windows\System32\VIEE.exe" [2008-08-28 15:57 32768] "\VIE10.exe"="C:\Windows\System32\VIE10.exe" [2008-08-28 15:57 31232] "\VIE13.exe"="C:\Windows\System32\VIE13.exe" [2008-08-25 18:48 106496] "\VIE3.exe"="C:\Windows\System32\VIE3.exe" [2008-08-28 15:57 32768] "\VIE4.exe"="C:\Windows\System32\VIE4.exe" [2008-08-28 15:57 31232] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina] 2006-01-30 08:53 49152 C:\APPS\Softex\OmniPass\OPXPGina.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit] 2008-05-28 12:32 87352 C:\WINDOWS\system32\LMIinit.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\Vio\Dvacm.acm "msacm.mpegacm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\mpegacm.acm "msacm.ulmp3acm"= C:\PROGRA~1\FICHIE~1\ULEADS~1\MPEG\ulmp3acm.acm [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "BitComet"="C:\Program Files\BitComet\BitComet.exe" /tray "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] ""= "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" "ACTIVBOARD"=c:\apps\ABoard\ABoard.exe "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" "DetectorApp"=C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe "EPSON Stylus DX6000 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_SAD.tmp" /EF "HKLM" "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup "HotbarSA"="C:\Program Files\Hotbar\bin\10.2.217.0\HotbarSA.exe" "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" "KernelFaultCheck"=%systemroot%\system32\dumprep 0 -k "My Web Search Bar Search Scope Monitor"="C:\PROGRA~1\MYWEBS~1\bar\3.bin\m3SrchMn.exe" /m=2 /w "ehTray"=C:\WINDOWS\ehome\ehtray.exe "MyWebSearch Email Plugin"=C:\PROGRA~1\MYWEBS~1\bar\3.bin\mwsoemon.exe "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" "NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup "NvMediaCenter"=RunDLL32.exe NvMCTray.dll,NvTaskbarInit "nwiz"=nwiz.exe /install "OoPDFSettingsv6.exe"=C:\Program Files\OFFICE One6.5\OFFICE One PDF Manager\OoPDFSettingsv6.exe "PhiBtn"=%SystemRoot%\System32\drivers\PhiBtn.exe "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" -atboottime "SkyTel"=SkyTel.EXE "spywarefighterguard"=C:\Program Files\Fighters\spywarefighter\SpywarefighterUser.exe "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" "SweetIM"=C:\Program Files\Macrogaming\SweetIM\SweetIM.exe "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot "TomTomHOME.exe"="C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s "Traymin900"=%SystemRoot%\System32\drivers\Tray900.exe "UserFaultCheck"=%systemroot%\system32\dumprep 0 -u "Vade Retro Outlook Express"="C:\PROGRA~1\GOTOSO~1\VADERE~1\Vaderetro_oe.exe" "RTHDCPL"=RTHDCPL.EXE [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%ProgramFiles%\AOL 9.0\aol.exe"= "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe"= "%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe"= "%windir%\system32\sessmgr.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "C:\Program Files\IncrediMail\bin\IMApp.exe"= "C:\Program Files\IncrediMail\bin\IncMail.exe"= "C:\Program Files\IncrediMail\bin\ImpCnt.exe"= "C:\Program Files\BitComet\BitComet.exe"= "C:\Program Files\Pando Networks\Pando\pando.exe"= "C:\Program Files\Magentic\bin\MgImp.exe"= "C:\Program Files\Magentic\bin\Magentic.exe"= "C:\Program Files\Magentic\bin\MgApp.exe"= "D:\Downloads\eMule\emule.exe"= "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"= "C:\Program Files\Yahoo!\Messenger\YServer.exe"= "C:\Program Files\Real\RealPlayer\realplay.exe"= "C:\Program Files\Mozilla Firefox\firefox.exe"= "C:\Program Files\Winamp Remote\bin\Orb.exe"= "C:\Program Files\Winamp Remote\bin\OrbTray.exe"= "C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"= "C:\Program Files\iTunes\iTunes.exe"= "D:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe"= "C:\Program Files\Jaman Player\jamdownloader.exe"= "C:\Program Files\Jaman Player\jaman-updater.exe"= "D:\Downloads\eMule2\emule.exe"= "C:\Program Files\eMule\emule.exe"= "C:\Program Files\LimeWire\LimeWire.exe"= "C:\Downloads\eMule 0.47c\eMule\emule.exe"= "C:\WINDOWS\system32\dpvsetup.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Ahead\SIPPS\SIPPS.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\APPS\skype\phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "1700:TCP"= 1700:TCP:MioNet Remote Drive Access "1641:TCP"= 1641:TCP:MioNet Remote Drive Verification "8361:TCP"= 8361:TCP:BitComet 8361 TCP "8361:UDP"= 8361:UDP:BitComet 8361 UDP "4662:TCP"= 4662:TCP:eMule TCP "27202:TCP"= 27202:TCP:BitComet 27202 TCP "27202:UDP"= 27202:UDP:BitComet 27202 UDP "18736:TCP"= 18736:TCP:BitComet 18736 TCP "18736:UDP"= 18736:UDP:BitComet 18736 UDP "17335:TCP"= 17335:TCP:BitComet 17335 TCP "17335:UDP"= 17335:UDP:BitComet 17335 UDP "16714:TCP"= 16714:TCP:BitComet 16714 TCP "16714:UDP"= 16714:UDP:BitComet 16714 UDP "13277:TCP"= 13277:TCP:NortonAV "13641:TCP"= 13641:TCP:NortonAV "15668:TCP"= 15668:TCP:NortonAV "15935:TCP"= 15935:TCP:NortonAV "14951:TCP"= 14951:TCP:eMule_TCP "5884:UDP"= 5884:UDP:eMule_UDP "7915:TCP"= 7915:TCP:BitComet 7915 TCP "7915:UDP"= 7915:UDP:BitComet 7915 UDP R0 lfsfilt;Lean File Sharing;C:\WINDOWS\system32\DRIVERS\lfsfilt.sys [2007-06-29 18:32] R0 lpx;LPX Protocol;C:\WINDOWS\system32\DRIVERS\lpx.sys [2007-06-29 18:32] R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 16:35] R1 ndasfat;NDAS FAT;C:\WINDOWS\system32\DRIVERS\ndasfat.sys [2007-06-29 18:32] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 16:37] R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-03-07 13:39] R2 MioNet;MioNet Service;C:\Program Files\MioNet\MioNetManager.exe [2005-07-15 22:38] R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2005-05-03 12:25] R3 camvid40;Philips SPC 900NC PC Camera;C:\WINDOWS\system32\DRIVERS\camdrv41.sys [2005-08-25 12:28] R3 ndasbus;NDAS Bus Driver;C:\WINDOWS\system32\DRIVERS\ndasbus.sys [2007-06-29 18:32] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 23:08] R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 10:45] S2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [] S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-05-04 00:54] S3 ICDUSB2;Sony IC Recorder (P);C:\WINDOWS\system32\Drivers\ICDUSB2.sys [2002-11-28 22:23] S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2006-05-09 17:50] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58] . - - - - ORPHANS REMOVED - - - - HKCU-Run-\VIED.exe - C:\Windows\System32\VIED.exe HKCU-Run-\VIEF.exe - C:\Windows\System32\VIEF.exe HKCU-Run-\VIE12.exe - C:\Windows\System32\VIE12.exe HKLM-Run-\VIED.exe - C:\Windows\System32\VIED.exe HKLM-Run-\VIEF.exe - C:\Windows\System32\VIEF.exe HKLM-Run-\VIE12.exe - C:\Windows\System32\VIE12.exe . ------- Supplementary Scan ------- . FireFox -: Profile - D:\Documents and Settings\Anthony Chabrières.DOUCE.000\Application Data\Mozilla\Firefox\Profiles\8ir9adxf.default\ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-28 23:58:26 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... Scan termin‚ avec succŠs Les fichiers cach‚s: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run] "\VIED.exe"="C:\Windows\System32\VIED.exe" "\VIEF.exe"="C:\Windows\System32\VIEF.exe" "\VIE12.exe"="C:\Windows\System32\VIE12.exe" "\VIEC.exe"="C:\Windows\System32\VIEC.exe" "\VIEE.exe"="C:\Windows\System32\VIEE.exe" "\VIE10.exe"="C:\Windows\System32\VIE10.exe" "\VIE13.exe"="C:\Windows\System32\VIE13.exe" "\VIE3.exe"="C:\Windows\System32\VIE3.exe" "\VIE4.exe"="C:\Windows\System32\VIE4.exe" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "\VIED.exe"="C:\Windows\System32\VIED.exe" "\VIEF.exe"="C:\Windows\System32\VIEF.exe" "\VIE12.exe"="C:\Windows\System32\VIE12.exe" "\VIEC.exe"="C:\Windows\System32\VIEC.exe" "\VIEE.exe"="C:\Windows\System32\VIEE.exe" "\VIE10.exe"="C:\Windows\System32\VIE10.exe" "\VIE13.exe"="C:\Windows\System32\VIE13.exe" "\VIE3.exe"="C:\Windows\System32\VIE3.exe" "\VIE4.exe"="C:\Windows\System32\VIE4.exe" . --------------------- DLLs a charg‚ sous des processus courants --------------------- PROCESS: C:\WINDOWS\system32\winlogon.exe -> C:\Apps\Softex\OmniPass\opxpgina.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\a-squared Free\a2service.exe C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\ehome\ehrecvr.exe C:\WINDOWS\ehome\ehSched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\NDAS\System\ndassvc.exe C:\Program Files\MioNet\jvm\bin\MioNet.exe C:\WINDOWS\system32\nvsvc32.exe C:\APPS\Softex\OmniPass\OmniServ.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe C:\PROGRA~1\COMMON~1\X10\Common\X10nets.exe C:\WINDOWS\ehome\mcrdsvc.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\APPS\Softex\OmniPass\OPXPApp.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\drivers\PhiBtn.exe C:\WINDOWS\system32\drivers\Tray900.exe . ************************************************************************** . Temps d'accomplissement: 2008-08-29 0:03:45 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-28 22:03:40 ComboFix2.txt 2008-08-28 15:43:37 ComboFix3.txt 2008-08-28 10:09:55 Pre-Run: 7,051,956,224 octets libres Post-Run: 7,031,906,304 octets libres 413 --- E O F --- 2008-08-13 01:08:49

DaddyToto · Answer

Je n'y comprends rien ??? j'ai lancé l'analyse du fichier C:\Program Files\MioNet\jvm\bin\MioNet.exe avec Virus Total à 16h42 et j'avais toujours  :

Fichier MioNet.exe reçu le 2008.08.29 16:42:34 (CET)
Situation actuelle:  en cours d'analyse
Votre fichier est, en ce moment, en cours d'analyse par VirusTotal,
les résultats seront affichés au fur et à mesure de leur génération. 

J'ai voulu relancer l'analyse et j'ai eu le message comme quoi elle avait déjà été réalisée et terminée ?????

Voila ci-dessous le résultat obtenu :

Fichier MioNet.exe reçu le 2008.08.29 16:42:34 (CET)
Situation actuelle: terminé
Résultat: 0/36 (0.00%)
Antivirus 	                  Version 	     Dernière mise à jour 	Résultat
AhnLab-V3 	      2008.8.29.0 	 2008.08.29 	        -
AntiVir 	                 7.8.1.23 	         2008.08.29 	        -
Authentium 	          5.1.0.4 	         2008.08.29 	        -
Avast 	               4.8.1195.0 	         2008.08.29 	        -
AVG 	                        8.0.0.161 	         2008.08.29 	        -
BitDefender 	           7.2 	         2008.08.29 	        -
CAT-QuickHeal 	           9.50 	         2008.08.29 	        -
ClamAV 	                  0.93.1 	         2008.08.29 	        -
DrWeb 	             4.44.0.09170 	 2008.08.29 	        -
eSafe 	                7.0.17.0 	         2008.08.28 	        -
eTrust-Vet 	      31.6.6056 	         2008.08.29 	        -
Ewido 	                  4.0 	                 2008.08.29 	        -
F-Prot 	               4.4.4.56 	         2008.08.29 	        -
F-Secure 	            7.60.13501.0          2008.08.29 	        -
Fortinet 	               3.14.0.0 	         2008.08.29 	        -
GData 	                   19 	                 2008.08.29 	        -
Ikarus 	             T3.1.1.34.0 	         2008.08.29 	        -
K7AntiVirus 	        7.10.432 	         2008.08.29 	        -
Kaspersky 	                7.0.0.125 	         2008.08.29 	        -
McAfee 	                    5372 	         2008.08.28 	        -
Microsoft 	                  1.3807 	         2008.08.25 	        -
NOD32v2 	                    3399 	         2008.08.29 	        -
Norman 	                  5.80.02 	         2008.08.29 	        -
Panda 	                  9.0.0.4 	         2008.08.29 	        -
PCTools 	                  4.4.2.0 	         2008.08.29 	        -
Prevx1 	                     V2 	         2008.08.29 	        -
Rising 	               20.59.41.00 	 2008.08.29 	        - 
Sophos 	                   4.33.0 	         2008.08.29 	        -
Sunbelt 	                3.1.1592.1 	 2008.08.29 	        -
Symantec 	                     10 	         2008.08.29 	        -
TheHacker 	        6.3.0.6.064 	 2008.08.27 	        -
TrendMicro 	     8.700.0.1004 	 2008.08.29 	        -
VBA32 	                 3.12.8.4 	         2008.08.29 	        -
ViRobot 	           2008.8.29.1355 	 2008.08.29 	        -
VirusBuster 	         4.5.11.0 	         2008.08.29 	        - 
Webwasher-Gateway 	    6.6.2 	         2008.08.29 	        -

Information additionnelle

File size: 45161 bytes
MD5...: c07d173e49c3f99a34f97d2614315e8a
SHA1..: f79307661481853abdc0afb9344baf7ef866e8a2
SHA256: 106d4a1aa458058e0a587cbcc62d92aa5c55363d4364a121f79b2715ef67ad4b
SHA512: 792848f7f2a72a82035db7457205973016e215d228acc7f3fc2ee1bfea4a865f
db4e83921e342ebf81891ba53df49306dbe826626ce96bb4436f402ce0b909b2
PEiD..: Armadillo v1.71
TrID..: File type identification
Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x40616a
timedatestamp.....: 0x40bff5ea (Fri Jun 04 04:09:14 2004)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x52b0 0x6000 6.06 ebe0d5b16417a482a6b80e8619293da5
.rdata 0x7000 0x7be 0x1000 2.49 0141d84c7f926437d28763e3c930ee14
.data 0x8000 0x2b9c 0x3000 4.33 8e32f21db925f599af108b2a3db01130

( 3 imports )
> ADVAPI32.dll: RegOpenKeyExA, RegQueryValueExA, RegEnumKeyA, RegCloseKey
> MSVCRT.dll: perror, malloc, fclose, fwrite, free, strncmp, fread, strspn, strcspn, fgets, strchr, strrchr, _putenv, fopen, exit, printf, getenv, __mb_cur_max, calloc, sprintf, _XcptFilter, __p___initenv, __getmainargs, _initterm, __setusermatherr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, _iob, fprintf, _pctype, _isctype, memmove, strpbrk, _exit, _strdup, _stat, _spawnv, _strnicmp, _stricmp, _close, _open, _read, _lseek
> KERNEL32.dll: QueryPerformanceFrequency, GetModuleHandleA, GetModuleFileNameA, LoadLibraryA, GetProcAddress, QueryPerformanceCounter

( 0 exports )


Maintenant je réalise la phase avec SDFix.exe

A plus
Merci

jlpjlp · Answer

ok fais sdfix

___________



télécharge OTMoveIt
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe (de Old_Timer) sur ton Bureau. Ou sur https://www.luanagames.com/index.fr.html
double-clique sur OTMoveIt.exe pour le lancer.
copie la liste qui se trouve en citation ci-dessous,
et colle-la dans le cadre de gauche de OTMoveIt :Paste List of Files/Folders to be moved.

Citation :

C:\Program Files\Arovax AntiSpyware
C:\Program Files\AskTBar
C:\Program Files\hotbar.exe

clique sur MoveIt! pour lancer la suppression.
le résultat apparaitra dans le cadre "Results".
clique sur Exit pour fermer.
poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.


_____________


puis analyse aussi ceci sur virus total et dis si inféctés:

C:\WINDOWS\system32\VIE3.exe
 C:\WINDOWS\system32\VIE4.exe
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
 C:\WINDOWS\system32\VIE13.exe
C:\WINDOWS\system32\VIEE.exe
C:\WINDOWS\system32\VIE10.exe
 C:\WINDOWS\system32\VIEC.exe

DaddyToto · Answer

Voila le rapport de SDFix

Ca n'a pas été aussi simple que je le croyais...........Je m'attaque au reste

Merci a+

[b]SDFix: Version 1.220 [/b]
Run by Anthony ChabriŠres on 29/08/2008 at 19:42

Microsoft Windows XP [version 5.1.2600]
Running From: D:\Documents and Settings\Anthony ChabriŠres.DOUCE.000\Bureau\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\VIE45.exe - Deleted
C:\WINDOWS\system32\VIE4A.exe - Deleted
C:\WINDOWS\system32\VIE51.exe - Deleted
C:\WINDOWS\system32\VIE56.exe - Deleted
C:\WINDOWS\system32\VIEBF.exe - Deleted
C:\WINDOWS\system32\VIEFF.exe - Deleted
C:\WINDOWS\system32\VIE139.exe - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 19:49:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services	dssserv]
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=str(2):"\systemroot\system32\drivers	dssserv.sys"

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710
"appinit_dlls"=""

scanning hidden files ...

folder error: D:\Documents and Settings\Anthony Chabrières.DOUCE.000

[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%ProgramFiles%\AOL 9.0\aol.exe"="%ProgramFiles%\AOL 9.0\aol.exe:*:Enabled:AOL"
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
"%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe"="%ProgramFiles%\UBISOFT\Splinter Cell Pandora Tomorrow\pandora.exe:*:Enabled:PANDORA"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\IncrediMail\bin\IMApp.exe"="C:\Program Files\IncrediMail\bin\IMApp.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\IncMail.exe"="C:\Program Files\IncrediMail\bin\IncMail.exe:*:Enabled:IncrediMail"
"C:\Program Files\IncrediMail\bin\ImpCnt.exe"="C:\Program Files\IncrediMail\bin\ImpCnt.exe:*:Enabled:IncrediMail"
"C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\Program Files\Pando Networks\Pando\pando.exe"="C:\Program Files\Pando Networks\Pando\pando.exe:*:Enabled:pando"
"C:\Program Files\Magentic\bin\MgImp.exe"="C:\Program Files\Magentic\bin\MgImp.exe:*:Enabled:Magentic"
"C:\Program Files\Magentic\bin\Magentic.exe"="C:\Program Files\Magentic\bin\Magentic.exe:*:Enabled:Magentic"
"C:\Program Files\Magentic\bin\MgApp.exe"="C:\Program Files\Magentic\bin\MgApp.exe:*:Enabled:Magentic"
"D:\Downloads\eMule\emule.exe"="D:\Downloads\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\Winamp Remote\bin\Orb.exe"="C:\Program Files\Winamp Remote\bin\Orb.exe:*:Enabled:Orb"
"C:\Program Files\Winamp Remote\bin\OrbTray.exe"="C:\Program Files\Winamp Remote\bin\OrbTray.exe:*:Enabled:OrbTray"
"C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe"="C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"D:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe"="D:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.325\French\setup.exe:*:Disabled:Programme d'installation de Kaspersky Internet Security 7.0"
"C:\Program Files\Jaman Player\jamdownloader.exe"="C:\Program Files\Jaman Player\jamdownloader.exe:*:Enabled:Jaman Downloader"
"C:\Program Files\Jaman Player\jaman-updater.exe"="C:\Program Files\Jaman Player\jaman-updater.exe:*:Enabled:Jaman Updater"
"D:\Downloads\eMule2\emule.exe"="D:\Downloads\eMule2\emule.exe:*:Enabled:eMule"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Downloads\eMule 0.47c\eMule\emule.exe"="C:\Downloads\eMule 0.47c\eMule\emule.exe:*:Enabled:eMule"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Ahead\SIPPS\SIPPS.exe"="C:\Program Files\Ahead\SIPPS\SIPPS.exe:*:Enabled:SIPPS"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\APPS\skype\phone\Skype.exe"="C:\APPS\skype\phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - D:\DOCUME~1\ANTHON~1.000\Bureau\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 11 Sep 2006           208 A.SHR --- "C:\BOOT.BAK"
Sun  4 May 2008     6,104,632 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Mon  7 Jul 2008     1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon  7 Jul 2008     4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon  7 Jul 2008     2,156,368 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Thu 28 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP0\A0000015.sys"
Thu 28 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP1\A0000140.sys"
Thu 28 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP1\A0000231.sys"
Thu 28 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP3\A0000400.sys"
Fri 29 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP3\A0000409.sys"
Fri 29 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP3\A0000417.sys"
Fri 29 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP3\A0000425.sys"
Fri 29 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP3\A0000434.sys"
Fri 29 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP4\A0000466.sys"
Fri 29 Aug 2008            96 A..H. --- "C:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP4\A0000498.sys"
Fri 29 Aug 2008            96 A..H. --- "C:\Program Files\Common Files\X10\Common\x10prod.sys"
Wed 16 Jul 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0c909c63b4fa217757574b9dcdd658c3\BIT6.tmp"
Wed 16 Jul 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\BIT9.tmp"
Wed 16 Jul 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7779524ce1b472c62f1b0f1a192676ad\BIT7.tmp"
Wed 16 Jul 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9664ff6405d9e0e32778ca8618d4be26\BIT5.tmp"
Wed 16 Jul 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\97de84be36b27af6e66a0586433cda52\BIT3.tmp"
Wed 16 Jul 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9ec3943a72ea4aa7fb7b808e2b7554c8\BIT4.tmp"
Wed 16 Jul 2008             0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cb1cc7c8ed3868a5a32ffb677fe0fde8\BIT8.tmp"

[b]Finished![/b]

DaddyToto · Answer

Pour info, les fichiers suivants sont introuvables.....ont-ils disparus avec l'utilisation de SDFix ?

C:\WINDOWS\system32\VIE3.exe
C:\WINDOWS\system32\VIE4.exe
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\system32\VIE13.exe
C:\WINDOWS\system32\VIEE.exe
C:\WINDOWS\system32\VIE10.exe
C:\WINDOWS\system32\VIEC.exe

Je poursuis les actions prescrites

A+

DaddyToto · Answer

Ca y est voila le rapport de OTMoveIt, il se trouvait dans D:\_OTMoveIt\MovedFiles.....j'ai deux disques durs.....

C:\Program Files\Arovax AntiSpyware\Lang moved successfully.
C:\Program Files\Arovax AntiSpyware moved successfully.
C:\Program Files\AskTBar\SrchAstt\1.bin moved successfully.
C:\Program Files\AskTBar\SrchAstt moved successfully.
C:\Program Files\AskTBar\PopSwatr\History moved successfully.
C:\Program Files\AskTBar\PopSwatr moved successfully.
C:\Program Files\AskTBar\bar\Settings moved successfully.
C:\Program Files\AskTBar\bar\History moved successfully.
C:\Program Files\AskTBar\bar\Cache moved successfully.
C:\Program Files\AskTBar\bar\1.bin moved successfully.
C:\Program Files\AskTBar\bar moved successfully.
C:\Program Files\AskTBar moved successfully.
C:\Program Files\hotbar.exe moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08292008_205148

Merci.

J'attends la suite de ce qu'il y a à faire, si il y a encore quelque chose à faire.....

A+

jlpjlp · Answer

bau boulot

recolle un hijackthis et combofix pour verifer et dis si encore des soucis



 colle le rapport d'un scan en ligne 
avec un des suivants: 


bitdefender en ligne : 
http://www.bitdefender.fr/scan_fr/scan8/ie.html 

Panda en ligne : 
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

DaddyToto · Answer

Voila un moment que les fenêtres "MS Antivirus Sécurity center" et "Antivirus warning" n'apparaissent plus, le problème est donc réglé.

Merci infiniment jlpjlp, je ne m'en serai pas sorti tout seul ou alors en ayant probablement commis quelques erreurs voir des erreurs fatales.

DaddyToto · Answer

Il y a encore quelque chose ????

Quand je redémarre l'ordinateur, sur le bureau j'ai un "panneau" qui me dit : 

An error has occured 
No licence files were found on this computer. 
Please try to run the installation again before using this program.

????????????

Quand je clic sur "continue" il disparaît, et tout fonctionne normalement, mais est ce que cela ne va pas me poser de problèmes à l'usage ?

Merci de me dire ce dont il s'agit.

A+

jlpjlp · Answer

recolle un hijackthis et combofix pour verifer et dis si encore des soucis



colle le rapport d'un scan en ligne
avec un des suivants:


bitdefender en ligne :
http://www.bitdefender.fr/scan_fr/scan8/ie.html

Panda en ligne :
http://pandasoftware.fr

Kaspersky en ligne
https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr

leouch · Answer

Réponse à tous 

j'aime bien votre site qui m'a déjà bien rendu service :)

je tombe sur le vôtre pour le m prob' ...

COOOOOOOOOOL a tous :-D

laissez pisser ce morveux !!!! vous risquez RIEN DU TOUT. Point 1

Planquer la  première fenêtre en bas à droite de votre écran ( tout con ...non ...?). Point 2

Puis ... la deuxième... Point 3

Et... en attendant au lieu de vous faire peur ...lol ....
attendez que le web vous donne une solution moins chiée que celles qu'on vous propose ...

Ce truc est inoffensif !!!!!

c'est un fake de spyware qui vous engage à payer un max poiur vous en débarasser.....

ne répondez pas .
ne foutez rien en l'air dans votre ordi' avec des manip' trés utiles mais...
réservées aux balèzes  de l'info'
restez bien cool 
et téléchargez ou mettez à jour votre anti-spyware gratos ...

ET SURTOUT SURTOUT PAS DE PANIQUE LES LOULOUS !!!!!!!!

Cette attaque est ridicule.....:):):):):):):):):):))

Quand et si :-( je m'en suis débarassé je vous dit comment ... ;););)

leouch

megalolo · Answer

A priori il est relativement facile de  s'en débarrasser : coupez le processus MSA.exe dans le gestionnaire des taches et supprimez le dossier c:\program files\MSA avant que le processus se relance ; vous avez environ 10 secondes ce qui est amplement suffisant si vous ouvrez les fenêtres avant.

C'était tellement simple que j'ai mis pas mal de temps à trouver.
Et du coup ce truc est tellement mal goupillé que la plupart des outils de désinfection antispywares l'ignorent tellement il n'est pas dangereux :)

Avec msconfig vous pouvez aussi supprimer la clé qui lance le msa.exe à chaque démarrage.

ahmed · Answer

hheeeeeeeeeeeeeeeeeeeeeeeeeeeeelllllpppppppp je suis attaqué par MS antivirus c le raport decombofix ComboFix 08-09-05.12 - user 2008-09-10 0:32:36.3 - NTFSx86 Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.1565 [GMT 2:00] Endroit: C:\Documents and Settings\user\Bureau\ComboFix.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\PCHealthCenter . ((((((((((((((((((((((((((((( Fichiers créés 2008-08-09 to 2008-09-09 )))))))))))))))))))))))))))))))))))) . 2008-09-09 23:17 . 2008-09-09 23:17 d-------- C:\Program Files\Enigma Software Group 2008-09-09 19:23 . 2008-09-08 17:32 3,262 --a------ C:\WINDOWS\system32\2.ico 2008-09-09 19:15 . 2008-09-09 19:15 d-------- C:\Program Files\MSA 2008-09-09 19:15 . 2008-09-09 19:15 581,120 ---hs---- C:\Documents and Settings\user\css.exe 2008-09-09 19:15 . 2008-09-08 16:50 165,888 --a------ C:\WINDOWS\system32\MSa.cpl 2008-09-09 19:15 . 2008-09-08 17:32 31,232 --a------ C:\x 2008-09-09 19:15 . 2008-09-08 17:32 3,262 --a------ C:\WINDOWS\system32\1.ico 2008-09-09 19:14 . 2008-09-09 19:15 519,168 ---hs---- C:\Documents and Settings\user\intelOP.exe 2008-09-09 19:14 . 2008-09-09 19:14 73,728 ---hs---- C:\Documents and Settings\user\MediaTubeCodec_ver1.1463.0.exe 2008-09-09 19:07 . 2008-09-09 19:33 d-------- C:\Program Files\CONVERT 2008-09-09 19:07 . 2008-09-09 19:08 294,912 --------- C:\WINDOWS\Setup1.exe 2008-09-09 19:07 . 2008-09-09 19:08 73,216 --a------ C:\WINDOWS\ST6UNST.EXE 2008-09-09 17:31 . 2008-09-09 17:41 d-------- C:\Documents and Settings\user\Application Data\REAPER 2008-09-08 18:51 . 2008-09-08 18:51 d-------- C:\Downloads 2008-09-08 18:51 . 2008-09-08 18:57 d-------- C:\Documents and Settings\user\Application Data\GetRightToGo 2008-09-08 14:13 . 2008-09-08 14:24 d-------- C:\djp 2008-09-08 14:03 . 2008-09-08 14:03 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2008-09-08 13:42 . 2008-09-08 13:42 d-------- C:\Program Files\Messenger Plus! Live 2008-09-08 13:42 . 2008-09-08 13:42 d-------- C:\Program Files\Circle Developement 2008-09-08 13:02 . 2008-09-08 13:42 d-------- C:\Program Files\Audacity 2008-09-08 12:36 . 2008-09-08 16:55 23,392 --a------ C:\WINDOWS\system32 scompat.tlb 2008-09-08 12:36 . 2008-09-08 16:55 16,832 --a------ C:\WINDOWS\system32\amcompat.tlb 2008-09-08 12:27 . 2008-09-08 16:51 d-------- C:\Program Files\The KMPlayer FR 2008-09-07 17:29 . 2008-09-07 17:29 268 --ah----- C:\sqmdata05.sqm 2008-09-07 17:29 . 2008-09-07 17:29 244 --ah----- C:\sqmnoopt05.sqm 2008-09-05 15:09 . 2008-09-09 17:53 d-------- C:\Program Files\AskTBar 2008-09-05 13:37 . 2008-09-08 13:32 d-------- C:\Program Files\Windows Media Connect 2 2008-09-05 13:36 . 2008-09-05 13:36 d-------- C:\WINDOWS\system32\LogFiles 2008-09-05 13:36 . 2008-09-08 13:32 d-------- C:\WINDOWS\system32\drivers\UMDF 2008-09-02 16:20 . 2008-09-02 16:20 d-------- C:\Documents and Settings\user\Application Data\FaxCtr 2008-09-02 14:51 . 2008-09-02 14:51 d-------- C:\Program Files\Lexmark Fax Solutions 2008-09-02 14:51 . 2008-09-02 14:51 d-------- C:\Documents and Settings\All Users\Application Data\FaxCtr 2008-09-02 14:51 . 2006-04-28 11:16 339,968 --a------ C:\WINDOWS\system32\IMGMAN32.DLL 2008-09-02 14:51 . 2006-04-28 11:16 98,345 --a------ C:\WINDOWS\system32\IMHOST32.DLL 2008-09-02 14:51 . 2006-04-28 11:16 98,304 --a------ C:\WINDOWS\system32\IM31XPNG.DEL 2008-09-02 14:51 . 2006-04-28 11:16 69,632 --a------ C:\WINDOWS\system32\IM31XTIF.DEL 2008-09-02 14:51 . 2006-04-28 11:16 49,152 --a------ C:\WINDOWS\system32\IM31IMG.DIL 2008-09-02 14:51 . 2006-11-22 15:51 45,056 --a------ C:\WINDOWS\system32\LXPRMON.DLL 2008-09-02 14:51 . 2006-11-22 15:50 32,768 --a------ C:\WINDOWS\system32\LXPMONUI.DLL 2008-09-02 14:51 . 2006-11-22 16:08 12,288 --a------ C:\WINDOWS\system32\LXPMONRC.DLL 2008-09-02 14:50 . 2008-09-09 22:55 d-------- C:\Program Files\Abbyy FineReader 6.0 Sprint 2008-09-02 14:47 . 2008-09-02 14:51 d-------- C:\Program Files\Lexmark 1200 Series 2008-09-02 14:46 . 2006-12-21 00:06 1,224,704 --a------ C:\WINDOWS\system32\lxczserv.dll 2008-09-01 19:15 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-09-01 19:15 . 2006-09-28 16:05 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2008-09-01 19:15 . 2007-01-24 15:27 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2008-09-01 19:15 . 2006-12-08 12:02 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2008-09-01 19:15 . 2006-09-28 16:05 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2008-09-01 19:15 . 2006-09-28 16:04 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2008-09-01 19:15 . 2007-01-08 15:30 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2008-09-01 17:32 . 2008-09-01 17:32 307 --a------ C:\WINDOWS\game.ini 2008-09-01 17:06 . 2008-09-01 17:06 d--hs---- C:\WINDOWS\ftpcache 2008-08-31 21:13 . 2008-08-31 21:14 d-------- C:\Program Files\Ares 2008-08-27 15:44 . 2008-08-30 21:03 d-------- C:\WINDOWS\system32\CatRoot_bak 2008-08-24 16:29 . 2008-08-24 16:29 268 --ah----- C:\sqmdata04.sqm 2008-08-24 16:29 . 2008-08-24 16:29 244 --ah----- C:\sqmnoopt04.sqm 2008-08-10 21:45 . 2008-08-10 21:45 d-------- C:\Program Files\Free Audio Pack 2008-08-10 21:45 . 1998-06-17 01:00 516,173 --a------ C:\WINDOWS\system32\MSVCP60D.DLL 2008-08-10 21:45 . 1998-06-17 01:00 385,100 --a------ C:\WINDOWS\system32\MSVCRTD.DLL 2008-08-10 21:45 . 2003-08-07 17:01 237,568 --a------ C:\WINDOWS\system32\lame_enc.dll 2008-08-09 16:54 . 2008-08-09 16:54 268 --ah----- C:\sqmdata03.sqm 2008-08-09 16:54 . 2008-08-09 16:54 244 --ah----- C:\sqmnoopt03.sqm 2008-08-09 16:12 . 2008-08-09 16:12 268 --ah----- C:\sqmdata02.sqm 2008-08-09 16:12 . 2008-08-09 16:12 244 --ah----- C:\sqmnoopt02.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-09 16:58 --------- d-----w C:\Program Files\VideoLAN 2008-09-06 18:50 --------- d-----w C:\Documents and Settings\user\Application Data\skypePM 2008-09-06 18:50 --------- d-----w C:\Documents and Settings\user\Application Data\Skype 2008-09-05 13:02 --------- d-----w C:\Program Files\dBpowerAMP 2008-09-01 15:32 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-08-27 22:00 --------- d-----w C:\Program Files\Dealio 2008-08-10 19:48 --------- d-----w C:\Program Files\Search Settings 2008-08-10 14:01 --------- d-----w C:\Documents and Settings\user\Application Data\gtk-2.0 2008-07-27 19:09 --------- d-----w C:\Program Files\BearShare Applications 2008-07-26 21:33 --------- d-----w C:\Documents and Settings\user\Application Data\BearShare 2008-07-24 00:14 --------- d-----w C:\Documents and Settings\user\Application Data\Media Live Each 2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 20:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 20:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:40 663,552 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:37 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-04-11 17:25 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat . ((((((((((((((((((((((((((((( snapshot@2008-09-10_ 0.27.22.04 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-09 22:31:50 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_5ec.dat . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{9CB65206-89C4-402c-BA80-02D8C59F9B1D}"= "C:\Program Files\AskTBar\SrchAstt\2.bin\A5SRCHAS.DLL" [2008-09-05 57344] [HKEY_CLASSES_ROOT\clsid\{9cb65206-89c4-402c-ba80-02d8c59f9b1d}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ares"="C:\Program Files\Ares\Ares.exe" [2008-08-21 888832] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208] "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 36975] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-12-19 135168] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-12-19 159744] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-12-19 131072] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-18 8523776] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-18 81920] "FixCamera"="C:\WINDOWS\FixCamera.exe" [2007-02-10 20480] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 159744] "tsnpstd3"="C:\WINDOWS snpstd3.exe" [2007-07-10 270336] "snpstd3"="C:\WINDOWS\vsnpstd3.exe" [2007-05-10 835584] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2008-05-15 185896] "SearchSettings"="C:\Program Files\Search Settings\SearchSettings.exe" [2008-06-12 991584] "lxczbmgr.exe"="C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-09 74672] "FaxCenterServer"="C:\Program Files\Lexmark Fax Solutions\fm3032.exe" [2007-02-09 295856] "ANTIVIRUS"="C:\Program Files\MSA\MSA.exe" [2008-09-08 396800] "Raccourci vers la page des propriétés de High Definition Audio"="HDAShCut.exe" [2005-01-07 C:\WINDOWS\system32\HdAShCut.exe] "VTTimer"="VTTimer.exe" [2006-09-21 C:\WINDOWS\system32\VTTimer.exe] "S3Trayp"="S3trayp.exe" [2006-10-10 C:\WINDOWS\system32\S3Trayp.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-10-30 C:\WINDOWS\RTHDCPL.EXE] "SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-05 15360] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Program Files\Windows Live\Messenger\livecall.exe"= "C:\Program Files\Ares\Ares.exe"= "C:\WINDOWS\system32\lxczcoms.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "443:TCP"= 443:TCP:TCP port 443 ooVoo "443:UDP"= 443:UDP:UDP port 443 ooVoo "37674:TCP"= 37674:TCP:TCP port 37674 ooVoo "37674:UDP"= 37674:UDP:UDP port 37674 ooVoo "37675:UDP"= 37675:UDP:UDP port 37675 ooVoo R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 lxcz_device;lxcz_device;C:\WINDOWS\system32\lxczcoms.exe [2007-02-09 537520] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2006-11-15 634880] S3 SMCWGU(SMC);SMCWUSB-G 802.11g Wireless USB 2.0 Adapter(SMC);C:\WINDOWS\system32\DRIVERS\SMCWGU.sys [ ] S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c96241e-30be-11dd-b972-001bb9fb5961}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3c96241f-30be-11dd-b972-001bb9fb5961}] \Shell\AutoRun\command - 1.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8641beff-d0d2-11dc-ba79-001bb9f98ae1}] \Shell\AutoRun\command - ylr.exe \Shell\explore\Command - ylr.exe \Shell\open\Command - ylr.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{95afa69c-32ed-11dd-b983-001bb9fb5961}] \Shell\AutoRun\command - ntde1ect.com \Shell\explore\Command - ntde1ect.com \Shell\open\Command - ntde1ect.com . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' . - - - - ORPHANS REMOVED - - - - URLSearchHooks-{E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file) . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\3wirqhko.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://fr.search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:fr:official FF -: plugin - C:\Program Files\Java\jre1.5.0_05\bin\NPJava11.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_05\bin\NPJava12.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_05\bin\NPJava13.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_05\bin\NPJava14.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_05\bin\NPJava32.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_05\bin\NPJPI150_05.dll FF -: plugin - C:\Program Files\Java\jre1.5.0_05\bin\NPOJI610.dll FF -: plugin - C:\Program Files\ma-config.com phardwaredetection.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-10 00:34:09 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-09-10 0:35:05 ComboFix-quarantined-files.txt 2008-09-09 22:34:54 ComboFix2.txt 2008-09-09 22:27:42 Pre-Run: 346,549,559,296 octets libres Post-Run: 346,535,546,880 octets libres 219 --- E O F --- 2008-09-08 15:31:17

jlpjlp · Answer

il serait préférable que tu cré ton propre message

MS Antivirus Sécurity center

16 réponses

Discussions similaires

Newsletters