probleme avec micro av antivirus

Question

Bonjour,
y'a des fenetres qui sorte pour me dire d'analyser mon pc j'ai utiliser mon antivirus mais sa marche pas aider moi svp

Destrio5 · Answer

Salut,

- Télécharge HijackThis V 2.02 (HijackThis Installer) :
http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

- Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

- Clique sur Install ensuite sur I Accept

- Clique sur Do a scan system and save log file

- Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.

Destrio5 · Answer

Le rapport n'est pas complet.

ouss · Answer

il faire quoi le refaire?

Destrio5 · Answer

Quand tu copies/colles le rapport, fais bien attention de le prendre entièrement.

ouss · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:57:16, on 12/09/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Users\asma\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Windows\System32\YUR2F3A.exe
C:\Windows\System32\YURD1A.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Eset
od32kui.exe
C:\Users\asma\AppData\Roaming\Adobe\Manager.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\igfxext.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Eset
od32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32	askeng.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Destrio5 · Answer

Bon, tant pis.

---> Désactive l'UAC le temps de la désinfection :
https://www.zebulon.fr/astuces/pratique/220-desactiver-l-uac-dans-vista.html

- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) : 
http://siri.urz.free.fr/Fix/SmitfraudFix.exe ou http://www.geekstogo.com/forum/files/file/6-smitfraudfix/ 

- Enregistre-le sur le bureau

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée

- Un rapport sera généré, poste-le dans ta prochaine réponse.

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix

contera · Answer

salut je n'arrive pas à écouter les sons sur mon pc comment faire pour remedier à cela? merci d'avance

ouss · Answer

j'arrive pas a obtenir des analyse je fai 1 mais sa me sort rien

Destrio5 · Answer

Essaie en mode sans échec :
https://blog.sosordi.net/

ouss · Answer

mitFraudFix v2.349

Scan done at 19:40:21,91, 12/09/2008
Run from C:\Users\asma\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ESET
od32kui.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Windows\System32\YUR2F3A.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Users\asma\AppData\Roaming\Adobe\Manager.exe
C:\Program Files\MicroAV\MicroAV.exe
C:\Windows\System32\YURD1A.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\system32\cmd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\ALaunch\ALaunchSvc.exe
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Windows\system32\svchost.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\Acer\Empowering Technology\eNet\eNet Service.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Acer\Mobility Center\MobilityService.exe
C:\Program Files\Eset
od32krn.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Users\asma\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\igfxext.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32

C:\Windows\system32\1.ico FOUND !
C:\Windows\system32\2.ico FOUND !
C:\Windows\system32\MicroAV.cpl FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\asma


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\asma\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\asma\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 

C:\Program Files\PCHealthCenter\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="eNetHook.dll"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Broadcom 802.11g
DNS Server Search Order: 89.2.0.1
DNS Server Search Order: 89.2.0.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{70E7CF6F-28BE-40B9-A8BF-4FFBB19AD06A}: DhcpNameServer=89.2.0.1 89.2.0.2


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

ouss · Answer

C BON J4AI FAIT L'analyse

Destrio5 · Answer

- Redémarre ton ordinateur en mode sans échec :
https://blog.sosordi.net/

- Double-clique sur SmitfraudFix.exe, choisis l'option 2 et Entrée

- Réponds O(oui) à ces deux questions si elles te sont posées

Voulez-vous nettoyer le registre ?
Corriger le fichier infecté ?

- Un rapport sera généré, sauvegarde-le sur le bureau

- Redémarre en mode normal

- Poste le rapport SmitfraudFix

ouss · Answer

SmitFraudFix v2.349

Scan done at 20:03:44,54, 12/09/2008
Run from C:\Users\asma\Desktop\SmitfraudFix
OS: Microsoft Windows [version 6.0.6000] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost
::1             localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix



»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Carte réseau Broadcom 802.11g
DNS Server Search Order: 89.2.0.1
DNS Server Search Order: 89.2.0.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{70E7CF6F-28BE-40B9-A8BF-4FFBB19AD06A}: DhcpNameServer=89.2.0.1 89.2.0.2


»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning not selected.
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End

Destrio5 · Answer

---> Fais un scan rapide avec MBAM, supprime tout ce qu'il trouve et poste le rapport :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

ouss · Answer

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1142
Windows 6.0.6000 

12/09/2008 20:53:07
mbam-log-2008-09-12 (20-53-07).txt

Type de recherche: Examen rapide
Eléments examinés: 43889
Temps écoulé: 15 minute(s), 27 second(s)

Processus mémoire infecté(s): 2
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 28
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 13

Processus mémoire infecté(s):
C:\Windows\System32\YURC6E6.exe (Trojan.FakeAlert) -> Unloaded process successfully.
C:\Users\asma\AppData\Roaming\Adobe\Manager.exe (Trojan.Agent) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
C:\Users\asma\AppData\Local\Temp\fccdbYQh.dll (Trojan.Vundo) -> Delete on reboot.
C:\Windows\System32\mmx55363.dll (Trojan.FakeAlert) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ae0ddef1-8907-46e7-9ab3-5a4a19dde1a0} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{ae0ddef1-8907-46e7-9ab3-5a4a19dde1a0} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\TypeLib\{5a0e9afe-1370-306a-961a-74b9daba606e} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{5610df2f-e68e-3419-9826-60cbc835c0d5} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{209bae3c-528b-369c-b9e8-2264becad722} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{209bae3c-528b-369c-b9e8-2264becad722} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoftdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurc6e6.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurc6e6.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurb856.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurb856.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Runun (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur2f3a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurd1a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurf6ad.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur7edf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur2f3a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurd1a.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9971.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur758c.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur758d.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yure204.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur1756.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur9423.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurda18.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurc042.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur2fb7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yurf6ad.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\yur7edf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\host-domain-lookup.com (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\mysearchnow.com (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.host-domain-lookup.com (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\New Windows\Allow\www.mysearchnow.com (Malware.Trace) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\users\asma\appdata\local	emp\fccdbyqh  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Users\asma\AppData\Local\Temp\fccdbYQh.dll (Trojan.BHO.H) -> Delete on reboot.
C:\Windows\System32\YURC6E6.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\YURB856.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\mmx55363.dll (Trojan.FakeAlert) -> Delete on reboot.
C:\Windows\System32\mx55363.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\MicroAV\MicroAV.cpl (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MicroAV\MicroAV.ooo (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MicroAV\MicroAV0.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Program Files\MicroAV\MicroAV1.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
C:\Users\asma\AppData\Roaming\Adobe\Manager.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\17PHolmes2000206.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Destrio5 · Answer

---> Supprime SmitFraudFix

---> Relance MBAM, va dans Quarantaine et supprime tout

---> Poste un nouveau rapport HijackThis

ouss · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:09:02, on 12/09/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Users\asma\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Windows\system32\igfxext.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] ~"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Bags Else Hole Lite] "C:\ProgramData\Barb Seek Plan.9gstkea"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Free nurb] "C:\ProgramData\Chic Dale Dale.m22eq"
O4 - HKCU\..\Run: [Four file program mode] "C:\ProgramData	ick that bits.s60za"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Destrio5 · Answer

---> Télécharge Lop S&D sur ton Bureau
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2
---> Double-clique dessus pour lancer l'installation
---> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau
---> Séléctionne la langue souhaitée, puis choisis l'option 1 (Recherche)
---> Patiente jusqu'à la fin du scan
---> Poste le rapport généré (C:\lopR.txt)

ouss · Answer

--------------------\  Lop S&D 4.2.4-2   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
   X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) M CPU        520  @ 1.60GHz )
   BIOS : Ver 1.00PARTTBL
   USER : asma ( Administrator )
   BOOT : Normal boot
   Antivirus : Norton Internet Security 2007 (Activated)
   Firewall  : Norton Internet Security 2007 (Activated)

   "C:\Lop SD" ( MAJ : 08-09-2008|21:40 )
   Option : [1] ( 12/09/2008|21:16 )

   [ UAC => 1 ]
 
   --------------------\  Listing des dossiers dans Local  

   [17/11/2007|22:39] C:\Users\asma\AppData\Local\Acer Arcade Deluxe
   [17/11/2007|12:09] C:\Users\asma\AppData\Local\acer eNM
   [22/11/2007|14:06] C:\Users\asma\AppData\Local\Adobe
   [17/11/2007|12:07] C:\Users\asma\AppData\Local\Application Data 
   [16/06/2008|18:52] C:\Users\asma\AppData\Local\d3d9caps.dat
   [11/09/2008|18:42] C:\Users\asma\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [17/02/2008|19:56] C:\Users\asma\AppData\Local\eMule
   [25/12/2007|17:13] C:\Users\asma\AppData\Local\ESET
   [14/05/2008|14:25] C:\Users\asma\AppData\Local\GDIPFONTCACHEV1.DAT
   [16/02/2008|20:15] C:\Users\asma\AppData\Local\Google
   [17/11/2007|12:07] C:\Users\asma\AppData\Local\Historique 
   [12/09/2008|20:55] C:\Users\asma\AppData\Local\IconCache.db
   [22/05/2008|14:24] C:\Users\asma\AppData\Local\Microsoft
   [29/12/2007|22:08] C:\Users\asma\AppData\Local\Microsoft Games
   [19/12/2007|15:00] C:\Users\asma\AppData\Local\Microsoft Help
   [23/11/2007|12:46] C:\Users\asma\AppData\Local\MigWiz
   [23/11/2007|12:30] C:\Users\asma\AppData\Local\Mozilla
   [17/11/2007|12:08] C:\Users\asma\AppData\Local\PlayMovie
   [17/11/2007|22:38] C:\Users\asma\AppData\Local\PowerCinema
   [12/09/2008|21:14] C:\Users\asma\AppData\Local\Temp
   [17/11/2007|12:07] C:\Users\asma\AppData\Local\Temporary Internet Files 
   [15/12/2007|11:44] C:\Users\asma\AppData\Local\VirtualStore
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [12/09/2008 20:56][--ah-----] C:\Windows	asks\SA.DAT
   [12/09/2008 20:55][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [18/05/2007|20:25] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [18/05/2007|18:53] C:\ProgramData\Adobe
   [02/11/2006|14:02] C:\ProgramData\Application Data 
   [10/09/2008|09:17] C:\ProgramData\Bags Browse Face
   [13/02/2008|19:44] C:\ProgramData\Barb Seek Plan.9gstkea
   [17/11/2007|12:02] C:\ProgramData\Bureau 
   [01/02/2008|13:22] C:\ProgramData\Chic Dale Dale.653244
   [28/12/2007|22:40] C:\ProgramData\Chic Dale Dale.6gvvh73
   [10/09/2008|09:16] C:\ProgramData\Chic Dale Dale.a6vbcn
   [29/04/2008|18:53] C:\ProgramData\Chic Dale Dale.co1f2
   [12/05/2008|16:29] C:\ProgramData\Chic Dale Dale.fixuhns
   [13/02/2008|19:43] C:\ProgramData\Chic Dale Dale.gel9k08
   [03/01/2008|11:00] C:\ProgramData\Chic Dale Dale.j6gyzz
   [10/09/2008|09:16] C:\ProgramData\Chic Dale Dale.m22eq
   [18/11/2007|15:56] C:\ProgramData\CyberLink
   [02/11/2006|14:02] C:\ProgramData\Desktop 
   [02/11/2006|14:02] C:\ProgramData\Documents 
   [17/02/2008|19:58] C:\ProgramData\eMule
   [25/12/2007|11:27] C:\ProgramData\ESET
   [16/02/2008|20:20] C:\ProgramData\ezsid.dat
   [17/11/2007|12:02] C:\ProgramData\Favoris 
   [02/11/2006|14:02] C:\ProgramData\Favorites 
   [10/09/2008|09:17] C:\ProgramData\Ford drive four file
   [05/05/2008|17:16] C:\ProgramData\Google
   [18/11/2007|16:06] C:\ProgramData\hpzinstall.log
   [24/05/2008|21:08] C:\ProgramData\Iso Web Bags Else
   [25/12/2007|19:00] C:\ProgramData\LUUnInstall.LiveUpdate
   [12/09/2008|20:18] C:\ProgramData\Malwarebytes
   [17/11/2007|12:02] C:\ProgramData\Menu D‚marrer 
   [28/12/2007|22:43] C:\ProgramData\Messenger Plus!
   [14/05/2008|09:54] C:\ProgramData\Microsoft
   [11/09/2008|12:06] C:\ProgramData\Microsoft Help
   [17/11/2007|12:02] C:\ProgramData\ModŠles 
   [16/02/2008|20:15] C:\ProgramData\Skype
   [02/11/2006|14:02] C:\ProgramData\Start Menu 
   [30/04/2008|12:12] C:\ProgramData\SweetIM
   [25/12/2007|19:00] C:\ProgramData\Symantec
   [02/11/2006|14:02] C:\ProgramData\Templates 
   [10/09/2008|09:17] C:\ProgramData	ick that bits.s60za
   [07/05/2008|18:35] C:\ProgramData\WLInstaller
   [08/02/2008|20:29] C:\ProgramData\Yahoo!
   [12/09/2008|19:44] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [21/07/2007|17:44] C:\Program Files\Acer Arcade Deluxe
   [21/07/2007|17:38] C:\Program Files\ACER Crystal Eye webcam
   [18/05/2007|18:52] C:\Program Files\Acer GameZone
   [21/07/2007|17:46] C:\Program Files\Acer Inc
   [18/05/2007|20:25] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [18/05/2007|18:52] C:\Program Files\Adobe
   [20/11/2007|20:37] C:\Program Files\Alwil Software
   [21/07/2007|17:39] C:\Program Files\Apoint2K
   [18/05/2007|18:36] C:\Program Files\Broadcom
   [23/04/2008|16:01] C:\Program Files\CambridgeSoft
   [12/09/2008|17:05] C:\Program Files\CCleaner
   [23/04/2008|16:21] C:\Program Files\chemoffice
   [28/12/2007|22:39] C:\Program Files\Circle Developement
   [23/04/2008|11:59] C:\Program Files\Common Files
   [18/05/2007|18:36] C:\Program Files\CONEXANT
   [18/05/2007|18:43] C:\Program Files\CyberLink
   [17/02/2008|19:56] C:\Program Files\eMule
   [12/09/2008|18:04] C:\Program Files\ESET
   [17/11/2007|12:02] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [05/05/2008|19:02] C:\Program Files\Google
   [14/03/2008|21:00] C:\Program Files\InstallShield Installation Information
   [18/05/2007|18:33] C:\Program Files\Intel
   [11/09/2008|12:06] C:\Program Files\Internet Explorer
   [23/04/2008|15:30] C:\Program Files\ISIS Draw 2.3
   [31/03/2008|21:59] C:\Program Files\Java
   [18/05/2007|18:38] C:\Program Files\Launch Manager
   [12/09/2008|20:18] C:\Program Files\Malwarebytes' Anti-Malware
   [10/09/2008|21:37] C:\Program Files\Messenger Plus! Live
   [02/11/2006|13:37] C:\Program Files\Microsoft Games
   [14/05/2008|09:55] C:\Program Files\Microsoft Office
   [14/05/2008|09:56] C:\Program Files\Microsoft Visual Studio
   [14/05/2008|09:46] C:\Program Files\Microsoft Visual Studio 8
   [10/09/2008|09:23] C:\Program Files\Microsoft Works
   [18/05/2007|20:22] C:\Program Files\Microsoft.NET
   [02/11/2006|13:42] C:\Program Files\Movie Maker
   [11/09/2008|22:16] C:\Program Files\Mozilla Firefox
   [14/05/2008|09:57] C:\Program Files\MSBuild
   [02/11/2006|13:37] C:\Program Files\MSN
   [26/11/2007|22:02] C:\Program Files\MSXML 4.0
   [18/05/2007|18:42] C:\Program Files\NewTech Infosystems
   [19/12/2007|15:26] C:\Program Files\OpenOffice.org 2.3
   [29/12/2007|18:07] C:\Program Files\Real
   [18/05/2007|18:34] C:\Program Files\Realtek
   [02/11/2006|13:37] C:\Program Files\Reference Assemblies
   [16/02/2008|20:15] C:\Program Files\Skype
   [21/07/2007|17:38] C:\Program Files\SUYIN
   [05/05/2008|17:22] C:\Program Files\SweetIM
   [25/12/2007|18:59] C:\Program Files\Symantec
   [12/09/2008|16:47] C:\Program Files\Trend Micro
   [02/11/2006|14:01] C:\Program Files\Uninstall Information
   [11/09/2008|20:03] C:\Program Files\uTorrent
   [26/11/2007|22:20] C:\Program Files\Windows Calendar
   [02/11/2006|13:42] C:\Program Files\Windows Collaboration
   [26/11/2007|22:20] C:\Program Files\Windows Defender
   [02/11/2006|13:42] C:\Program Files\Windows Journal
   [15/12/2007|11:41] C:\Program Files\Windows Live
   [11/09/2008|11:47] C:\Program Files\Windows Mail
   [26/11/2007|22:20] C:\Program Files\Windows Media Player
   [17/11/2007|12:02] C:\Program Files\Windows NT
   [02/11/2006|13:42] C:\Program Files\Windows Photo Gallery
   [13/01/2008|12:24] C:\Program Files\Windows Sidebar
   [24/12/2007|21:51] C:\Program Files\WinRAR
   [08/02/2008|18:01] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [18/05/2007|18:53] C:\Program Files\Common Files\Adobe
   [18/05/2007|20:22] C:\Program Files\Common Files\DESIGNER
   [18/05/2007|18:41] C:\Program Files\Common Files\InstallShield
   [19/12/2007|15:23] C:\Program Files\Common Files\Java
   [18/05/2007|18:42] C:\Program Files\Common Files\LightScribe
   [23/04/2008|11:59] C:\Program Files\Common Files\MDL Shared
   [14/05/2008|09:57] C:\Program Files\Common Files\microsoft shared
   [18/05/2007|18:42] C:\Program Files\Common Files\muvee Technologies
   [18/05/2007|18:42] C:\Program Files\Common Files\NewTech Infosystems
   [18/05/2007|18:49] C:\Program Files\Common Files\Oberon Media
   [29/12/2007|18:08] C:\Program Files\Common Files\Real
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [16/02/2008|20:15] C:\Program Files\Common Files\Skype
   [21/07/2007|17:38] C:\Program Files\Common Files\snp2uvc
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [25/12/2007|19:23] C:\Program Files\Common Files\Symantec Shared
   [14/05/2008|09:45] C:\Program Files\Common Files\System
   [15/12/2007|11:40] C:\Program Files\Common Files\WindowsLiveInstaller
   [29/12/2007|18:08] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 90 Processes )

   iexplore.exe ~ [PID:2280]
   iexplore.exe ~ [PID:2292]

   --------------------\  Recherche avec S_Lop

   C:\ProgramData\Chic Dale Dale.co1f2
   C:\ProgramData\Chic Dale Dale.m22eq
   C:\ProgramData	ick that bits.s60za
   C:\ProgramData\Chic Dale Dale.653244
   C:\ProgramData\Chic Dale Dale.a6vbcn
   C:\ProgramData\Chic Dale Dale.j6gyzz
   C:\ProgramData\Barb Seek Plan.9gstkea
   C:\ProgramData\Chic Dale Dale.6gvvh73
   C:\ProgramData\Chic Dale Dale.fixuhns
   C:\ProgramData\Chic Dale Dale.gel9k08
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\ProgramData\Bags Browse Face
   C:\ProgramData\Bags Browse Face\audiosafedebug.exe
   C:\ProgramData\Bags Browse Face\eksdibmq.exe
   C:\ProgramData\Bags Browse Face\jwmgccns.exe
   C:\ProgramData\Bags Browse Face\pekygtuw.exe
   C:\ProgramData\Bags Browse Face\RectExtraAmokVga.exe
   C:\ProgramData\Bags Browse Face\xhwsmhwg.exe
   C:\ProgramData\Bags Browse Face\ygksryct.exe
   C:\ProgramData\Bags Browse Face\zbldhuvl.exe
   C:\ProgramData\Bags Browse Face\zrhnbnfk.exe
   C:\ProgramData\Ford drive four file
   C:\ProgramData\Ford drive four file\anti tool.exe
   C:\ProgramData\Iso Web Bags Else
   C:\ProgramData\Iso Web Bags Else\glue roam.exe
   C:\Program Files\Circle Developement
   C:\Program Files\Circle Developement\Uninstall.exe
   C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@bigpoint[1].txt
   C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@fr.xblaster.bigpoint[1].txt
   C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@adopt.euroclick[1].txt
   C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@32vegas[1].txt
   C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@banner.32vegas[2].txt
 
   --------------------\  Verification du Registre

   [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
   "Free nurb"="\"C:\ProgramData\Chic Dale Dale.m22eq\""
   "Four file program mode"="\"C:\ProgramData\tick that bits.s60za\""
   "Bags Else Hole Lite"="\"C:\ProgramData\Barb Seek Plan.9gstkea\""

   [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-09-12 21:16:32
   Windows 6.0.6000  NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 126
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\asma\AppData\Roaming\uTorrent\BitDefender.Total.Security.2009.v12.0.10.Incl.Keygen.torrent


   [F:98][D:16]-> C:\Users\asma\AppData\Local\Temp
   [F:38][D:1]-> C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:470][D:5]-> C:\Users\asma\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:30][D:8]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 12/09/2008|21:15 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 12/09/2008|21:17 - Option : [1]

   --------------------\  Fin du rapport a 21:17:43
   [ UAC => 1 ]

Destrio5 · Answer

---> Relance Lop S&D
---> Choisis cette fois-ci l'option 2 (Suppression)
---> Ne ferme pas la fenêtre lors de la suppression !
---> Poste le rapport généré (C:\lopR.txt)

ouss · Answer

--------------------\  Lop S&D 4.2.4-2   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6000 ) 
   X86-based PC ( Multiprocessor Free : Intel(R) Celeron(R) M CPU        520  @ 1.60GHz )
   BIOS : Ver 1.00PARTTBL
   USER : asma ( Administrator )
   BOOT : Normal boot
   Antivirus : Norton Internet Security 2007 (Activated)
   Firewall  : Norton Internet Security 2007 (Activated)

   "C:\Lop SD" ( MAJ : 08-09-2008|21:40 )
   Option : [2] ( 13/09/2008|15:57 )

   [ UAC => 1 ]


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\ProgramData\Bags Browse Face\audiosafedebug.exe
   Supprime! - C:\ProgramData\Bags Browse Face\eksdibmq.exe
   Supprime! - C:\ProgramData\Bags Browse Face\jwmgccns.exe
   Supprime! - C:\ProgramData\Bags Browse Face\pekygtuw.exe
   Supprime! - C:\ProgramData\Bags Browse Face\RectExtraAmokVga.exe
   Supprime! - C:\ProgramData\Bags Browse Face\xhwsmhwg.exe
   Supprime! - C:\ProgramData\Bags Browse Face\ygksryct.exe
   Supprime! - C:\ProgramData\Bags Browse Face\zbldhuvl.exe
   Supprime! - C:\ProgramData\Bags Browse Face\zrhnbnfk.exe
   Supprime! - C:\ProgramData\Ford drive four file\anti tool.exe
   Supprime! - C:\ProgramData\Iso Web Bags Else\glue roam.exe
   Supprime! - C:\Program Files\Circle Developement\Uninstall.exe
   Supprime! - C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@bigpoint[1].txt
   Supprime! - C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@fr.xblaster.bigpoint[1].txt
   Supprime! - C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@adopt.euroclick[1].txt
   Supprime! - C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@32vegas[1].txt
   Supprime! - C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies\asma@banner.32vegas[2].txt
   Supprime! - C:\ProgramData\Chic Dale Dale.co1f2
   Supprime! - C:\ProgramData\Chic Dale Dale.m22eq
   Supprime! - C:\ProgramData	ick that bits.s60za
   Supprime! - C:\ProgramData\Chic Dale Dale.653244
   Supprime! - C:\ProgramData\Chic Dale Dale.a6vbcn
   Supprime! - C:\ProgramData\Chic Dale Dale.j6gyzz
   Supprime! - C:\ProgramData\Barb Seek Plan.9gstkea
   Supprime! - C:\ProgramData\Chic Dale Dale.6gvvh73
   Supprime! - C:\ProgramData\Chic Dale Dale.fixuhns
   Supprime! - C:\ProgramData\Chic Dale Dale.gel9k08
   Supprime! - C:\ProgramData\Bags Browse Face
   Supprime! - C:\ProgramData\Ford drive four file
   Supprime! - C:\ProgramData\Iso Web Bags Else
   Supprime! - C:\Program Files\Circle Developement
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans Local  

   [17/11/2007|22:39] C:\Users\asma\AppData\Local\Acer Arcade Deluxe
   [17/11/2007|12:09] C:\Users\asma\AppData\Local\acer eNM
   [22/11/2007|14:06] C:\Users\asma\AppData\Local\Adobe
   [17/11/2007|12:07] C:\Users\asma\AppData\Local\Application Data 
   [16/06/2008|18:52] C:\Users\asma\AppData\Local\d3d9caps.dat
   [11/09/2008|18:42] C:\Users\asma\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [17/02/2008|19:56] C:\Users\asma\AppData\Local\eMule
   [25/12/2007|17:13] C:\Users\asma\AppData\Local\ESET
   [14/05/2008|14:25] C:\Users\asma\AppData\Local\GDIPFONTCACHEV1.DAT
   [16/02/2008|20:15] C:\Users\asma\AppData\Local\Google
   [17/11/2007|12:07] C:\Users\asma\AppData\Local\Historique 
   [13/09/2008|12:56] C:\Users\asma\AppData\Local\IconCache.db
   [22/05/2008|14:24] C:\Users\asma\AppData\Local\Microsoft
   [29/12/2007|22:08] C:\Users\asma\AppData\Local\Microsoft Games
   [19/12/2007|15:00] C:\Users\asma\AppData\Local\Microsoft Help
   [23/11/2007|12:46] C:\Users\asma\AppData\Local\MigWiz
   [23/11/2007|12:30] C:\Users\asma\AppData\Local\Mozilla
   [17/11/2007|12:08] C:\Users\asma\AppData\Local\PlayMovie
   [17/11/2007|22:38] C:\Users\asma\AppData\Local\PowerCinema
   [13/09/2008|15:59] C:\Users\asma\AppData\Local\Temp
   [17/11/2007|12:07] C:\Users\asma\AppData\Local\Temporary Internet Files 
   [15/12/2007|11:44] C:\Users\asma\AppData\Local\VirtualStore
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [13/09/2008 15:44][--ah-----] C:\Windows	asks\SA.DAT
   [13/09/2008 12:57][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [18/05/2007|20:25] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [18/05/2007|18:53] C:\ProgramData\Adobe
   [02/11/2006|14:02] C:\ProgramData\Application Data 
   [17/11/2007|12:02] C:\ProgramData\Bureau 
   [18/11/2007|15:56] C:\ProgramData\CyberLink
   [02/11/2006|14:02] C:\ProgramData\Desktop 
   [02/11/2006|14:02] C:\ProgramData\Documents 
   [17/02/2008|19:58] C:\ProgramData\eMule
   [25/12/2007|11:27] C:\ProgramData\ESET
   [16/02/2008|20:20] C:\ProgramData\ezsid.dat
   [17/11/2007|12:02] C:\ProgramData\Favoris 
   [02/11/2006|14:02] C:\ProgramData\Favorites 
   [05/05/2008|17:16] C:\ProgramData\Google
   [18/11/2007|16:06] C:\ProgramData\hpzinstall.log
   [25/12/2007|19:00] C:\ProgramData\LUUnInstall.LiveUpdate
   [12/09/2008|20:18] C:\ProgramData\Malwarebytes
   [17/11/2007|12:02] C:\ProgramData\Menu D‚marrer 
   [28/12/2007|22:43] C:\ProgramData\Messenger Plus!
   [14/05/2008|09:54] C:\ProgramData\Microsoft
   [11/09/2008|12:06] C:\ProgramData\Microsoft Help
   [17/11/2007|12:02] C:\ProgramData\ModŠles 
   [16/02/2008|20:15] C:\ProgramData\Skype
   [02/11/2006|14:02] C:\ProgramData\Start Menu 
   [30/04/2008|12:12] C:\ProgramData\SweetIM
   [25/12/2007|19:00] C:\ProgramData\Symantec
   [02/11/2006|14:02] C:\ProgramData\Templates 
   [07/05/2008|18:35] C:\ProgramData\WLInstaller
   [08/02/2008|20:29] C:\ProgramData\Yahoo!
   [12/09/2008|19:44] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [21/07/2007|17:44] C:\Program Files\Acer Arcade Deluxe
   [21/07/2007|17:38] C:\Program Files\ACER Crystal Eye webcam
   [18/05/2007|18:52] C:\Program Files\Acer GameZone
   [21/07/2007|17:46] C:\Program Files\Acer Inc
   [18/05/2007|20:25] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [18/05/2007|18:52] C:\Program Files\Adobe
   [20/11/2007|20:37] C:\Program Files\Alwil Software
   [21/07/2007|17:39] C:\Program Files\Apoint2K
   [18/05/2007|18:36] C:\Program Files\Broadcom
   [23/04/2008|16:01] C:\Program Files\CambridgeSoft
   [12/09/2008|17:05] C:\Program Files\CCleaner
   [23/04/2008|16:21] C:\Program Files\chemoffice
   [23/04/2008|11:59] C:\Program Files\Common Files
   [18/05/2007|18:36] C:\Program Files\CONEXANT
   [18/05/2007|18:43] C:\Program Files\CyberLink
   [17/02/2008|19:56] C:\Program Files\eMule
   [12/09/2008|18:04] C:\Program Files\ESET
   [17/11/2007|12:02] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [05/05/2008|19:02] C:\Program Files\Google
   [14/03/2008|21:00] C:\Program Files\InstallShield Installation Information
   [18/05/2007|18:33] C:\Program Files\Intel
   [11/09/2008|12:06] C:\Program Files\Internet Explorer
   [23/04/2008|15:30] C:\Program Files\ISIS Draw 2.3
   [31/03/2008|21:59] C:\Program Files\Java
   [18/05/2007|18:38] C:\Program Files\Launch Manager
   [12/09/2008|20:18] C:\Program Files\Malwarebytes' Anti-Malware
   [10/09/2008|21:37] C:\Program Files\Messenger Plus! Live
   [02/11/2006|13:37] C:\Program Files\Microsoft Games
   [14/05/2008|09:55] C:\Program Files\Microsoft Office
   [14/05/2008|09:56] C:\Program Files\Microsoft Visual Studio
   [14/05/2008|09:46] C:\Program Files\Microsoft Visual Studio 8
   [10/09/2008|09:23] C:\Program Files\Microsoft Works
   [18/05/2007|20:22] C:\Program Files\Microsoft.NET
   [02/11/2006|13:42] C:\Program Files\Movie Maker
   [11/09/2008|22:16] C:\Program Files\Mozilla Firefox
   [14/05/2008|09:57] C:\Program Files\MSBuild
   [02/11/2006|13:37] C:\Program Files\MSN
   [26/11/2007|22:02] C:\Program Files\MSXML 4.0
   [18/05/2007|18:42] C:\Program Files\NewTech Infosystems
   [19/12/2007|15:26] C:\Program Files\OpenOffice.org 2.3
   [29/12/2007|18:07] C:\Program Files\Real
   [18/05/2007|18:34] C:\Program Files\Realtek
   [02/11/2006|13:37] C:\Program Files\Reference Assemblies
   [16/02/2008|20:15] C:\Program Files\Skype
   [21/07/2007|17:38] C:\Program Files\SUYIN
   [05/05/2008|17:22] C:\Program Files\SweetIM
   [25/12/2007|18:59] C:\Program Files\Symantec
   [12/09/2008|16:47] C:\Program Files\Trend Micro
   [02/11/2006|14:01] C:\Program Files\Uninstall Information
   [11/09/2008|20:03] C:\Program Files\uTorrent
   [26/11/2007|22:20] C:\Program Files\Windows Calendar
   [02/11/2006|13:42] C:\Program Files\Windows Collaboration
   [26/11/2007|22:20] C:\Program Files\Windows Defender
   [02/11/2006|13:42] C:\Program Files\Windows Journal
   [15/12/2007|11:41] C:\Program Files\Windows Live
   [11/09/2008|11:47] C:\Program Files\Windows Mail
   [26/11/2007|22:20] C:\Program Files\Windows Media Player
   [17/11/2007|12:02] C:\Program Files\Windows NT
   [02/11/2006|13:42] C:\Program Files\Windows Photo Gallery
   [13/01/2008|12:24] C:\Program Files\Windows Sidebar
   [24/12/2007|21:51] C:\Program Files\WinRAR
   [08/02/2008|18:01] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [18/05/2007|18:53] C:\Program Files\Common Files\Adobe
   [18/05/2007|20:22] C:\Program Files\Common Files\DESIGNER
   [18/05/2007|18:41] C:\Program Files\Common Files\InstallShield
   [19/12/2007|15:23] C:\Program Files\Common Files\Java
   [18/05/2007|18:42] C:\Program Files\Common Files\LightScribe
   [23/04/2008|11:59] C:\Program Files\Common Files\MDL Shared
   [14/05/2008|09:57] C:\Program Files\Common Files\microsoft shared
   [18/05/2007|18:42] C:\Program Files\Common Files\muvee Technologies
   [18/05/2007|18:42] C:\Program Files\Common Files\NewTech Infosystems
   [18/05/2007|18:49] C:\Program Files\Common Files\Oberon Media
   [29/12/2007|18:08] C:\Program Files\Common Files\Real
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [16/02/2008|20:15] C:\Program Files\Common Files\Skype
   [21/07/2007|17:38] C:\Program Files\Common Files\snp2uvc
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [25/12/2007|19:23] C:\Program Files\Common Files\Symantec Shared
   [14/05/2008|09:45] C:\Program Files\Common Files\System
   [15/12/2007|11:40] C:\Program Files\Common Files\WindowsLiveInstaller
   [29/12/2007|18:08] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 93 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-09-13 16:01:31
   Windows 6.0.6000  NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 126
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\asma\AppData\Roaming\uTorrent\BitDefender.Total.Security.2009.v12.0.10.Incl.Keygen.torrent


   [F:436][D:22]-> C:\Users\asma\AppData\Local\Temp
   [F:55][D:1]-> C:\Users\asma\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:327][D:6]-> C:\Users\asma\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:30][D:8]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 12/09/2008|21:15 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 12/09/2008|21:17 - Option : [1]
   3 - "C:\Lop SD\LopR_3.txt" - 13/09/2008|16:06 - Option : [2]

   --------------------\  Fin du rapport a 16:06:26
   [ UAC => 1 ]

ouss · Answer

t'es encore la destrio 5

Destrio5 · Answer

---> Désinstalle Lop S&D

---> Poste un nouveau rapport HijackThis

ouss · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:09:02, on 12/09/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Acer\Empowering Technology\eDataSecurity\eDSLoader.exe
C:\Acer\Empowering Technology\eAudio\eAudio.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OBealsched.exe
C:\Program Files\SweetIM\Messenger\SweetIM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Acer\Empowering Technology\ENET\ENMTRAY.EXE
C:\Acer\Empowering Technology\EPOWER\EPOWER_DMC.EXE
C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE
C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE
C:\Users\asma\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Windows\system32\igfxext.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*https://fr.search.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://home.sweetim.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.rd.yahoo.com/customize/ie/defaults/su/msgr8/*https://fr.search.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe
O4 - HKLM\..\Run: [eAudio] "C:\Acer\Empowering Technology\eAudio\eAudio.exe"
O4 - HKLM\..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [PLFSet] rundll32.exe C:\Windows\PLFSet.dll,PLFDefSetting
O4 - HKLM\..\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\Play Movie\PMVService.exe"
O4 - HKLM\..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SweetIM] C:\Program Files\SweetIM\Messenger\SweetIM.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] ~"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Bags Else Hole Lite] "C:\ProgramData\Barb Seek Plan.9gstkea"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Free nurb] "C:\ProgramData\Chic Dale Dale.m22eq"
O4 - HKCU\..\Run: [Four file program mode] "C:\ProgramData	ick that bits.s60za"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Empowering Technology Launcher.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: eNetHook.dll
O23 - Service: ALaunch Service (ALaunchService) - Unknown owner - C:\Acer\ALaunch\ALaunchSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe
O23 - Service: eLock Service (eLockService) - Acer Inc. - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: eNet Service - Acer Inc. - C:\Acer\Empowering Technology\eNet\eNet Service.exe
O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe
O23 - Service: eSettings Service (eSettingsService) - Unknown owner - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MobilityService - Unknown owner - C:\Acer\Mobility Center\MobilityService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: Planificateur LiveUpdate automatique - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ePower Service (WMIService) - acer - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

Destrio5 · Answer

Installe le SP1 de Vista :
http://www.microsoft.com/downloads/details.aspx?FamilyID=b0c7136d-5ebb-413b-89c9-cb3d06d12674&displaylang=fr

Destrio5 · Answer

jennyfouz ---> Merci de créer ton sujet.

Probleme avec micro av antivirus - Page 2

Discussions similaires

Newsletters