Trojan Vundo versus VShield

Teshune -  
Bonjour,

J'ai énormément de mal à me débarrasser de ce foutu trojan... Puis j'ai surout pas envie de faire d'irrémédiables bétises.

Quelqu'un peut m'aider à le résoudre ? Je l'en remercie d'avance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:52:27, on 4/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\libusbd-nt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\COMMON~1\rwwm\rwwmm.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\MICROS~3\rapimgr.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\PROGRA~1\COMMON~1\rwwm\rwwma.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
C:\Program Files\Network Associates\VirusScan\VsStat.exe
C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\Avconsol.exe
C:\Program Files\Network Associates\VirusScan\Webscanx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
f:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {0026AD90-C86F-4269-97F3-DAB4897C6D06} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SearchUpgrader] C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\VistaCodecPack\rm\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [New.net Startup] rundll32 C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL,ClientStartup -s
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
O4 - HKLM\..\Run: [cc86208a] rundll32.exe "C:\WINDOWS\system32\cdtyxwxy.dll",b
O4 - HKLM\..\Run: [BMcfb51316] Rundll32.exe "C:\WINDOWS\system32\kjilxijr.dll",s
O4 - HKCU\..\Run: [rwwm] C:\PROGRA~1\COMMON~1\rwwm\rwwmm.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [sf] C:\Program Files\sf\sf.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Policies\Explorer\Run: [{CC862025-0BBE-1033-0808-030401050020}] "C:\Program Files\Common Files\{CC862025-0BBE-1033-0808-030401050020}\Update.exe" mc-110-12-0000427
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: http://asia.msi.com.tw
O15 - Trusted Zone: http://global.msi.com.tw
O15 - Trusted Zone: http://www.msi.com.tw
O16 - DPF: ChatSpace Full Java Client 4.0.0.320 - http://irc.everywherechat.com:8000/Java/cfs40320.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} -
O17 - HKLM\System\CCS\Services\Tcpip\..\{35677CAC-6F21-44DC-A175-146B312AD2D7}: NameServer = 192.168.1.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: pceiqf.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - https://sourceforge.net/p/libusb-win32/wiki/Home/ - C:\WINDOWS\system32\libusbd-nt.exe
O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - F:\Program Files\Nvc\BIN\nipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O24 - Desktop Component 0: (no name) - (no file)
O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/Sean/LOCALS~1/Temp/msohtmlclip1/01/clip_image002.jpg

--
End of file - 12574 bytes
Configuration: Windows XP
Internet Explorer 7.0

6 réponses

  • Votes
  • Date
  • Date décroissante
  1. ep44 Contributeur
    Bonjour

    plusieurs infections sont sur ton système
    Ne t'inquiète pas je vais te guider et t'aider à désinfecter ton PC.

    Télécharge combofix.exe (par sUBs) et sauvegarde le sur ton bureau.
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    * Déconnecte toi d'internet et ferme toutes tes applications.
    * Désactive tes protections (antivirus, parefeu,antispyware) provisoirement et seulement le temps de l'utilisation de ComboFix,
    * Double-clic sur combofix.exe, il est possible que ton parefeu te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte.
    * /! Ne touche à rien tant que le scan n'est pas terminé.Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne /!
    * Attends que Combofix ait terminé, un rapport sera créé.
    * réactive ton parefeu, ton antivirus, la garde de ton antispyware
    * copie/colle le rapport, le rapport se trouve dans : C:Combofix.txt
    * Réactive tes protections en temps réel, Antivirus, Antispywares, avant de te reconnecter à internet.

    @+
    1. Teshune
      Je te remercie d'ores et déjà pour ta diligence...

      Voici le log demandé :

      ComboFix 08-09-03.03 - Sean 2008-09-04 15:03:27.1 - [color=red][b]FAT32[/b][/color]x86
      Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.603 [GMT 2:00]
      Running from: C:\Documents and Settings\Sean\Desktop\ComboFix.exe
      * Created a new restore point

      [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
      .

      ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
      .

      C:\Documents and Settings\Guest\Cookies\guest@a[2].txt
      C:\Documents and Settings\Guest\Cookies\guest@abetterinternet[1].txt
      C:\Documents and Settings\Guest\Cookies\guest@bestoffersnetworks[2].txt
      C:\Documents and Settings\Guest\Cookies\guest@beweb[2].txt
      C:\Documents and Settings\Guest\Cookies\guest@cliks[1].txt
      C:\Documents and Settings\Guest\Cookies\guest@hits.gureport.co[1].txt
      C:\Documents and Settings\Guest\Cookies\guest@offeroptimizer[2].txt
      C:\Documents and Settings\Guest\Cookies\guest@revenue[1].txt
      C:\Documents and Settings\Nathalie\Cookies\nathalie@ehg-medtronic.hitbox[2].txt
      C:\Documents and Settings\Nathalie\Cookies\nathalie@ehg-medtronic.hitbox[3].txt
      C:\Documents and Settings\Nathalie\Cookies\nathalie@www.pixmania[3].txt
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\#SharedObjects\48VD5HJF\bin.clearspring.com
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\#SharedObjects\48VD5HJF\bin.clearspring.com\clearspring.sol
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\#SharedObjects\48VD5HJF\www.broadcaster.com
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\#SharedObjects\48VD5HJF\www.broadcaster.com\played_list.sol
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\#SharedObjects\48VD5HJF\www.broadcaster.com\video_queue.sol
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
      C:\Documents and Settings\Sean\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
      C:\Documents and Settings\Sean\Cookies\sean@2o7[2].txt
      C:\Documents and Settings\Sean\Cookies\sean@2o7[3].txt
      C:\Documents and Settings\Sean\Cookies\sean@ad.yieldmanager[1].txt
      C:\Documents and Settings\Sean\Cookies\sean@bluestreak[2].txt
      C:\Documents and Settings\Sean\Cookies\sean@bluestreak[4].txt
      C:\Documents and Settings\Sean\Cookies\sean@erreurchasseur[2].txt
      C:\Documents and Settings\Sean\Cookies\sean@metrixlablw.customers.luna[2].txt
      C:\Documents and Settings\Sean\Cookies\sean@news.fr.be.msn[2].txt
      C:\Documents and Settings\Sean\Cookies\sean@news.fr.be.msn[4].txt
      C:\Documents and Settings\Sean\Cookies\sean@peach.bskyb[2].txt
      C:\Documents and Settings\Sean\Cookies\sean@serving-sys[2].txt
      C:\Documents and Settings\Sean\Cookies\sean@serving-sys[4].txt
      C:\Documents and Settings\Sean\new.txt
      C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
      C:\Program Files\PrintView
      C:\Program Files\printview\printhook030.dll
      C:\Program Files\printview\pvmodule.exe
      C:\Program Files\ToolBar888
      C:\Program Files\toolbar888\MyToolBar.dll_tobedeleted
      C:\Program Files\winupdates
      C:\Program Files\winupdates\a.zip
      C:\WINDOWS\BMcfb51316.txt
      C:\WINDOWS\BMcfb51316.xml
      C:\WINDOWS\cookies.ini
      C:\WINDOWS\NDNuninstall6_22.exe
      C:\WINDOWS\NDNuninstall6_98.exe
      C:\WINDOWS\NDNuninstall7_14.exe
      C:\WINDOWS\NDNuninstall7_48.exe
      C:\WINDOWS\pskt.ini
      C:\WINDOWS\system32\bszip.dll
      C:\WINDOWS\system32\cdtyxwxy.dll
      C:\WINDOWS\system32\cmd.com
      C:\WINDOWS\system32\ewbxltok.dll
      C:\WINDOWS\system32\ewulonra.dll
      C:\WINDOWS\system32\fccdeBrr.dll
      C:\WINDOWS\system32\gkojtpjq.ini
      C:\WINDOWS\system32\hvqotawu.ini
      C:\WINDOWS\system32\iktwhp.dll
      C:\WINDOWS\system32\jgimwscl.ini
      C:\WINDOWS\system32\kjilxijr.dll
      C:\WINDOWS\system32\kmvrmkjf.dll
      C:\WINDOWS\system32\lceebtnr.dll
      C:\WINDOWS\system32\lhaoianl.dll
      C:\WINDOWS\system32\lxstil.dll
      C:\WINDOWS\system32\mcrh.tmp
      C:\WINDOWS\system32\mlJCSjge.dll
      C:\WINDOWS\system32\MSINET.oca
      C:\WINDOWS\system32\nfvybxka.dll
      C:\WINDOWS\system32\owphuwyv.dll
      C:\WINDOWS\system32\pceiqf.dll
      C:\WINDOWS\system32\ping.com
      C:\WINDOWS\system32\qxfsoahi.dll
      C:\WINDOWS\system32\regedit.com
      C:\WINDOWS\system32\rrBedccf.ini
      C:\WINDOWS\system32\rrBedccf.ini2
      C:\WINDOWS\system32\sprrtpnk.ini
      C:\WINDOWS\system32\sxolsufs.dll
      C:\WINDOWS\system32\sxuvqlux.dll
      C:\WINDOWS\system32\tasklist.com
      C:\WINDOWS\system32\tracert.com
      C:\WINDOWS\system32\urqNHATn.dll
      C:\WINDOWS\system32\vtUmNDTl.dll
      C:\WINDOWS\system32\wglcqnlo.ini
      C:\WINDOWS\system32\wsmfeo.dll
      C:\WINDOWS\system32\yayxYqRj.dll
      C:\WINDOWS\system32\yxwxytdc.ini
      C:\WINDOWS\system32\ztjuwq.dll
      C:\WINDOWS\system32\zvjcga.dll
      F:\Autorun.inf

      .
      ((((((((((((((((((((((((( Files Created from 2008-08-04 to 2008-09-04 )))))))))))))))))))))))))))))))
      .

      2008-09-04 13:48 . 2008-09-04 13:48 <DIR> d-------- C:\!KillBox
      2008-08-25 12:44 . 2008-08-25 12:44 <DIR> d-------- C:\Program Files\C-Media
      2008-08-23 18:45 . 2008-08-23 18:45 <DIR> d-------- C:\Program Files\MSI
      2008-08-19 15:47 . 2008-08-19 15:47 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
      2008-08-15 16:53 . 2008-08-15 16:53 <DIR> d-------- C:\music
      2008-08-15 01:21 . 2008-05-01 16:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll

      .
      (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
      2008-07-07 20:32 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
      2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
      2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
      2008-06-24 08:57 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
      2008-06-23 09:20 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
      2008-06-23 09:20 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
      2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
      2008-06-21 05:23 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
      2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
      2008-06-20 17:41 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
      2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
      2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
      2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
      2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
      2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
      .

      ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
      .
      .
      *Note* empty entries & legit default entries are not shown
      REGEDIT4

      [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "rwwm"="C:\PROGRA~1\COMMON~1\rwwm\rwwmm.exe" [2006-07-19 9216]
      "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
      "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-20 68856]
      "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
      "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
      "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

      [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
      "UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [X]
      "NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 155648]
      "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-03-09 7561216]
      "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-03-09 86016]
      "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
      "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
      "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 385024]
      "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-22 620152]
      "Samsung PanelMgr"="C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe" [2007-10-23 524288]
      "nwiz"="nwiz.exe" [2006-03-09 C:\WINDOWS\system32\nwiz.exe]
      "BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 C:\WINDOWS\system32\bthprops.cpl]

      [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
      "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]

      C:\Documents and Settings\Nathalie\Start Menu\Programs\Startup\
      OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 101784]

      C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
      BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2004-11-29 569405]
      Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe [2008-04-18 295606]
      Adobe Acrobat Synchronizer.lnk - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-23 734872]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
      "DisableRegedit"= 0 (0x0)
      "NoFind"= 0 (0x0)
      "NoRun"= 0 (0x0)
      "NoDesktop"= 0 (0x0)
      "NoClose"= 0 (0x0)
      "StartMenuLogOff"= 0 (0x0)
      "HideClock"= 0 (0x0)

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
      "AppInit_DLLs"=pceiqf.dll

      [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
      "vidc.DIVF"= DivX412.dll
      "msacm.avis"= ff_acm.acm

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
      "EnableFirewall"= 0 (0x0)

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
      "%windir%\\system32\\sessmgr.exe"=
      "F:\\games\\Empire earth\\Empire Earth.exe"=
      "G:\\Wolfenstein - Enemy Territory\\ET.exe"=
      "G:\\Program Files\\Warcraft3FT\\Warcraft III.exe"=
      "G:\\Program Files\\Warcraft3FT\\War3.exe"=
      "G:\\Program Files\\BF2\\Bf2_w32ded.exe"=
      "C:\\WINDOWS\\System32\\mmc.exe"=
      "C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
      "C:\\Program Files\\Xfire\\Xfire.exe"=
      "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
      "C:\\Program Files\\Real\\RealPlayer\\TRUEPLAY.EXE"=
      "G:\\Program Files\\BF2\\BF2.exe"=
      "G:\\Program Files\\eMule\\emule.exe"=
      "F:\\games\\Q3\\quake3.exe"=
      "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
      "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
      "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
      "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
      "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
      "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
      "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
      "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

      [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
      "3724:TCP"= 3724:TCP:Blizzard Downloader
      "6112:TCP"= 6112:TCP:Blizzard Downloader
      "4672:TCP"= 4672:TCP:e-mule
      "4662:TCP"= 4662:TCP:e-mule
      "27960:TCP"= 27960:TCP:Quake3
      "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
      "1720:TCP"= 1720:TCP:1720 port opening for Phone Dialer

      R0 NaiFsRec;NaiFsRec;C:\WINDOWS\system32\drivers\NaiFsRec.sys [2001-04-30 4512]
      R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2003-09-22 97530]
      R2 AvSynMgr;AVSync Manager;C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe [2001-11-26 155665]
      R2 ithsgt;ithsgt;C:\WINDOWS\system32\DRIVERS\ithsgt.sys [2005-12-23 162432]
      R2 lilsgt;lilsgt;C:\WINDOWS\system32\DRIVERS\lilsgt.sys [2005-12-23 12032]
      R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;C:\WINDOWS\system32\drivers\libusb0.sys [2005-03-09 33792]
      S2 SSPORT;SSPORT;C:\WINDOWS\system32\Drivers\SSPORT.sys [ ]
      S3 DVDACCSS;DVDACCSS;C:\Program Files\DVDAccess\DVDAX.SYS [ ]
      S3 jnv4_mib;jnv4_mib;C:\DOCUME~1\Sean\LOCALS~1\Temp\jnv4_mib.sys [ ]
      S3 ZD1201U;ZyDAS ZD1201 IEEE 802.11b Wireless LAN Driver (USB);C:\WINDOWS\system32\DRIVERS\zd1201u.sys [2003-05-15 38656]
      S3 ZDNDIS5;ZDNDIS5 Protocol Driver;C:\WINDOWS\System32\ZDNDIS5.SYS [ ]

      [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41c68fde-c103-11db-a916-000129242e7e}]
      \Shell\AutoRun\command - H:\FahrenheitAutoRun.exe
      .
      - - - - ORPHANS REMOVED - - - -

      HKCU-Run-sf - C:\Program Files\sf\sf.exe
      HKLM-Run-SearchUpgrader - C:\Program Files\Common files\SearchUpgrader\SearchUpgrader.exe
      HKLM-Run-TkBellExe - C:\Program Files\VistaCodecPack\rm\Update_OB\realsched.exe
      HKLM-Run-cc86208a - C:\WINDOWS\system32\cdtyxwxy.dll
      HKLM-Run-BMcfb51316 - C:\WINDOWS\system32\kjilxijr.dll
      HKLM-Run-Cmaudio - cmicnfg.cpl
      HKCU-Explorer_Run-{CC862025-0BBE-1033-0808-030401050020} - C:\Program Files\Common Files\{CC862025-0BBE-1033-0808-030401050020}\Update.exe

      .
      ------- Supplementary Scan -------
      .
      FireFox -: Profile - C:\Documents and Settings\Sean\Application Data\Mozilla\Firefox\Profiles\ager15rc.default\
      FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.veosearch.com/
      FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
      FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
      FF -: plugin - C:\Program Files\VistaCodecPack\rm\browser\plugins\nppl3260.dll
      FF -: plugin - C:\Program Files\VistaCodecPack\rm\browser\plugins\nprpjplug.dll
      FF -: plugin - F:\Mozilla\plugins\npnul32.dll
      FF -: plugin - F:\Mozilla\plugins\NPOFF12.DLL
      FF -: plugin - F:\Mozilla\plugins\nppdf32.dll
      FF -: plugin - F:\Mozilla\plugins\npqtplugin.dll
      FF -: plugin - F:\Mozilla\plugins\npqtplugin2.dll
      FF -: plugin - F:\Mozilla\plugins\npqtplugin3.dll
      .

      **************************************************************************

      catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
      Rootkit scan 2008-09-04 15:27:31
      Windows 5.1.2600 Service Pack 2 FAT NTAPI

      scanning hidden processes ...

      scanning hidden autostart entries ...

      scanning hidden files ...

      **************************************************************************
      .
      --------------------- DLLs Loaded Under Running Processes ---------------------

      PROCESS: C:\WINDOWS\system32\winlogon.exe
      -> C:\WINDOWS\system32\Ati2evxx.dll

      PROCESS: C:\WINDOWS\explorer.exe
      -> C:\Program Files\Network Associates\VirusScan\Wbhook32.dll
      -> C:\Program Files\Network Associates\VirusScan\Res09\WbhkRes.dll
      -> C:\Program Files\Network Associates\VirusScan\VsUtil.dll
      -> C:\Program Files\Network Associates\VirusScan\Res09\VsutlRes.dll
      -> C:\Program Files\Network Associates\VirusScan\NTClient.dll
      -> C:\Program Files\Network Associates\VirusScan\Syncutil.dll
      -> C:\Program Files\Network Associates\VirusScan\Res09\resdll.dll
      .
      ------------------------ Other Running Processes ------------------------
      .
      C:\PROGRAM FILES\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXE
      C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE
      C:\PROGRAM FILES\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE
      C:\WINDOWS\SYSTEM32\LIBUSBD-NT.EXE
      C:\WINDOWS\SYSTEM32\NVSVC32.EXE
      C:\WINDOWS\SYSTEM32\HPZIPM12.EXE
      C:\WINDOWS\SYSTEM32\PNKBSTRA.EXE
      C:\WINDOWS\SYSTEM32\MSPMSPSV.EXE
      C:\Program Files\Network Associates\VirusScan\VsStat.exe
      C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
      C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
      C:\Program Files\Network Associates\VirusScan\Avconsol.exe
      C:\Program Files\Network Associates\VirusScan\Webscanx.exe
      C:\WINDOWS\system32\wscntfy.exe
      C:\WINDOWS\SYSTEM32\RUNDLL32.EXE
      C:\PROGRA~1\COMMON~1\rwwm\rwwma.exe
      C:\PROGRA~1\MICROS~3\rapimgr.exe
      C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
      C:\PROGRA~1\COMMON~1\rwwm\rwwml.exe
      C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
      C:\WINDOWS\system32\imapi.exe
      .
      **************************************************************************
      .
      Completion time: 2008-09-04 15:31:36 - machine was rebooted
      ComboFix-quarantined-files.txt 2008-09-04 13:30:26

      Pre-Run: 496,762,880 bytes free
      Post-Run: 1,526,710,272 bytes free

      294 --- E O F --- 2008-08-20 10:35:05
  3. Teshune
    Voilà voilà...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:13:20, on 5/09/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\WINDOWS\system32\libusbd-nt.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\WINDOWS\system32\PnkBstrA.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\MsPMSPSv.exe
    C:\Program Files\Network Associates\VirusScan\VsStat.exe
    C:\Program Files\Network Associates\VirusScan\Vshwin32.exe
    C:\Program Files\Network Associates\VirusScan\Avconsol.exe
    C:\Program Files\Network Associates\VirusScan\Webscanx.exe
    C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe
    C:\PROGRA~1\COMMON~1\rwwm\rwwmm.exe
    C:\PROGRA~1\COMMON~1\rwwm\rwwma.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\MICROS~3\rapimgr.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
    C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    F:\Mozilla\firefox.exe
    F:\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\ssmmgr.exe /autorun
    O4 - HKCU\..\Run: [rwwm] C:\PROGRA~1\COMMON~1\rwwm\rwwmm.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BTTray.lnk = ?
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
    O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O15 - Trusted Zone: http://asia.msi.com.tw
    O15 - Trusted Zone: http://global.msi.com.tw
    O15 - Trusted Zone: http://www.msi.com.tw
    O16 - DPF: ChatSpace Full Java Client 4.0.0.320 - http://irc.everywherechat.com:8000/Java/cfs40320.cab
    O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - https://www.linkedin.com/cab/LinkedInContactFinderControl.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
    O16 - DPF: {8167C273-DF59-4416-B647-C8BB2C7EE83E} (WebSDev Control) - http://liveupdate.msi.com.tw/autobios/LOnline/install.cab
    O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{35677CAC-6F21-44DC-A175-146B312AD2D7}: NameServer = 192.168.1.1
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O20 - AppInit_DLLs: pceiqf.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVSync Manager (AvSynMgr) - Unknown owner - C:\Program Files\Network Associates\VirusScan\Avsynmgr.exe
    O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - https://sourceforge.net/p/libusb-win32/wiki/Home/ - C:\WINDOWS\system32\libusbd-nt.exe
    O23 - Service: McShield - Unknown owner - C:\Program Files\Common Files\Network Associates\McShield\Mcshield.exe
    O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - F:\Program Files\Nvc\BIN\nipsvc.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O24 - Desktop Component 0: (no name) - (no file)
    O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/Sean/LOCALS~1/Temp/msohtmlclip1/01/clip_image002.jpg
    1. Teshune
      Alors je ne sais pas si c'est lié au nettoyage mais j'ai mon pc qui plante totalement, à présent.

      L'écran qui se fige et plus rien qui ne répond.

      Après un hard reset, il ne boot même pas... et aucun signal n'arrive à mon moniteur. J'en pleure...
  4. ep44 Contributeur
    Bonsoir

    Ton PC est lourdement infecté
    Mais on devrais avoir du meilleur
    essaye de démarrer en mode sans échec 

    Relance le Pc et tapote la touche F8 ( ou F5 pour certains) , jusqu’à l’apparition des inscriptions avec choix de démarrage
   Avec les touches « flèches », sélectionne Mode sans échec ==> entrée ==>nom utilisateur habituel

    Dit moi si tu y arrive
    2. Teshune
      Nope... Il ne se passe rien.

      Je commence à me demander si ce n'est pas hardware.

      Les symptômes sont les suivants :

      La led du HD reste allumée et l'écran n'affiche rien à part "absence de signal"

      Par contre, la led de mise sous tension reste éteinte.

      Tous les ventilos tournent.
      1. ep44 Contributeur
        Bonsoir

        oui en effet bizarre que ce soit arrivé juste après le nettoyage
        as tu essayé de booter sur un cd ?

        Discussions similaires

        Aide pour un virus
        cerise92700

        41 réponses
        Trojan impossible à supprimer!
        Gridouu

        12 réponses
        Comment supprimer le virus Trojan
        vitsou

        18 réponses
        Quelle est la différence entre les GO et GB ?
        badour

        37 réponses
        Cheval de Troie- e.tre456.worm.windows
        Ninou037

        13 réponses