Sujet Précédent Sujet Suivant

Problème virus !! Virtumonde !!

Origin -  
sKe69 Messages postés 21955 Statut Contributeur sécurité -
Bonjour,

J'ai un problème avec le virus nommé "Virtumonde" , spybot le detecte , le supprime mais il revient a chaque démarage.

J'aimerai de l'aide S.V.P

Cordialement.
A voir également:

49 réponses

Précédent
Réponse 21 / 49
Origin
 
Bonjour , j'espere que tu as passez une bonne nuit , voici les rapport ;)

ComboFix 08-09-14.02 - Propriétaire 2008-09-15 7:34:39.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1538 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Propriétaire\Bureau\C-Fix.exe
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bvoaoqih.ini
C:\WINDOWS\system32\qbbouamx.ini

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV

((((((((((((((((((((((((((((( Fichiers cr‚‚s du 2008-08-15 au 2008-09-15 ))))))))))))))))))))))))))))))))))))
.

2008-09-14 20:23 . 2008-09-14 20:24 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-14 20:23 . 2008-09-14 20:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-14 20:23 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-14 20:23 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-14 20:21 . 2008-09-14 20:21 5,208 --a------ C:\WINDOWS\system32\pid.PNF
2008-09-14 17:50 . 2008-09-14 17:50 <REP> d-------- C:\VundoFix Backups
2008-09-14 16:56 . 2008-09-14 17:05 <REP> d-------- C:\SDFix
2008-09-14 16:51 . 2008-09-14 16:51 <REP> d-------- C:\Program Files\CCleaner
2008-09-14 15:32 . 2008-09-14 16:29 5,012 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-14 15:31 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-09-14 15:31 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-09-14 15:31 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-14 15:31 . 2008-09-02 16:51 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-09-14 15:31 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-09-14 15:31 . 2008-09-13 18:10 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-09-14 15:31 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-09-14 15:31 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-09-14 15:31 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-09-14 15:31 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-09-14 15:11 . 2008-09-14 15:11 <REP> d-------- C:\Program Files\Trend Micro
2008-09-13 17:45 . 2008-09-13 17:45 <REP> d-------- C:\WINDOWS\system32\AlertModule
2008-09-13 17:45 . 2004-08-23 13:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
2008-09-13 17:45 . 2005-10-06 13:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
2008-09-13 17:45 . 2004-08-23 13:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-09-13 17:43 . 2008-09-15 07:40 <REP> d-------- C:\Program Files\Wanadoo
2008-09-13 17:40 . 2008-09-13 17:40 <REP> d-------- C:\Program Files\Securitoo
2008-09-13 17:40 . 2008-09-13 17:40 <REP> d-------- C:\Program Files\Inventel
2008-09-13 17:00 . 2008-09-13 17:00 <REP> d-------- C:\Program Files\ASUS
2008-09-13 16:46 . 2008-09-13 16:46 <REP> d-------- C:\WINDOWS\JM
2008-09-13 16:46 . 2008-09-13 16:46 <REP> d-------- C:\JM
2008-09-13 16:46 . 2006-10-30 14:44 1,953,792 -r------- C:\WINDOWS\system32\JMRaidSetup.exe
2008-09-13 16:46 . 2006-09-13 14:32 139,264 -r------- C:\WINDOWS\system32\JMRaidAPI.dll
2008-09-13 16:46 . 2006-10-30 05:31 43,648 -ra------ C:\WINDOWS\system32\drivers\jraid.sys
2008-09-13 16:46 . 2006-02-07 13:52 6,912 -ra------ C:\WINDOWS\system32\drivers\JGOGO.sys
2008-09-13 16:42 . 2008-09-13 16:42 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-09-13 16:42 . 2008-09-13 16:42 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-09-13 16:41 . 2008-09-13 16:41 <REP> d-------- C:\WINDOWS\system32\Lang
2008-09-13 16:39 . 2006-08-01 09:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2008-09-13 16:38 . 2008-09-13 16:38 <REP> d-------- C:\Program Files\Realtek
2008-09-13 16:37 . 2006-09-12 08:34 499,712 -r------- C:\WINDOWS\RtlExUpd.dll
2008-09-13 16:30 . 2008-09-13 16:30 <REP> d-------- C:\WINDOWS\ASUSInstAll
2008-09-13 16:27 . 2006-06-21 11:24 810,056 -ra------ C:\WINDOWS\system32\Alert.bmp
2008-09-13 16:27 . 2006-09-27 03:44 495,616 -ra------ C:\WINDOWS\system32\AsusSetup.exe
2008-09-13 16:27 . 2006-12-12 09:25 907 -ra------ C:\WINDOWS\system32\AsusSetup.ini
2008-09-13 16:27 . 2006-06-21 18:32 263 -ra------ C:\WINDOWS\system32\raidmgmt.ini
2008-09-13 16:25 . 2008-09-13 16:47 13,423 --a------ C:\WINDOWS\Ascd_log.ini
2008-09-13 16:25 . 2008-09-13 16:59 13,174 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-09-13 16:25 . 2006-10-11 05:33 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-09-13 16:25 . 2004-08-13 04:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-09-13 16:04 . 2008-06-25 06:57 189,001 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-09-13 14:03 . 2008-09-13 14:03 <REP> d-------- C:\Program Files\Lavalys
2008-09-13 04:46 . 2008-09-13 11:58 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-09-13 04:37 . 54,156 C:\WINDOWS\QTFont.qfn
2008-09-13 04:37 . 1,409 C:\WINDOWS\QTFont.for
2008-09-13 04:26 . 2008-04-13 20:46 61,696 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2008-09-13 04:26 . 2008-04-13 20:46 61,696 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2008-09-13 04:26 . 2008-04-13 20:46 53,376 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2008-09-13 04:26 . 2008-04-13 20:46 53,376 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2008-09-13 04:26 . 2001-08-17 21:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-09-13 04:26 . 2001-08-17 21:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2008-09-12 18:38 . 2008-09-12 18:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-12 08:13 . 2008-09-12 08:13 <REP> d-------- C:\Program Files\Yahoo!
2008-09-12 00:31 . 2008-09-12 00:34 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-12 00:31 . 2008-09-14 16:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-12 00:06 . 2008-09-12 00:06 7,601,152 --a------ C:\Program Files\Firefox Setup 3.0.1.exe
2008-09-11 21:16 . 2008-04-14 04:33 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-09-11 21:16 . 2008-04-14 04:33 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage r‚seau
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-11 19:03 . 2006-01-01 18:19 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
2008-09-11 19:03 . 2007-12-01 17:10 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-11 19:03 . 2006-01-01 18:15 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-11 19:03 . 2008-09-11 19:04 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-11 07:54 . 2008-09-11 07:54 <REP> d-------- C:\Program Files\PowerISO
2008-09-10 20:43 . 2008-09-10 20:46 5,470 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-10 20:42 . 2008-09-10 20:27 1,388,544 --a------ C:\WINDOWS\system32\MSVBVM60.dll
2008-09-10 20:27 . 2008-09-10 20:27 1,388,544 --a------ C:\MSVBVM60.dll
2008-09-10 07:48 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2008-09-10 07:47 . 2007-05-16 16:45 3,497,832 --a------ C:\d3dx9_34.dll
2008-09-10 07:45 . 2008-09-10 07:46 1,598,631 --a------ C:\d3dx9_34.zip
2008-09-09 18:35 . 2001-08-17 21:57 16,128 --a------ C:\WINDOWS\system32\drivers\MODEMCSA.sys
2008-09-09 18:35 . 2001-08-17 21:57 16,128 --a--c--- C:\WINDOWS\system32\dllcache\modemcsa.sys
2008-09-09 18:21 . 2008-09-10 20:43 <REP> d-------- C:\WINDOWS\BricoPacks
2008-09-09 18:21 . 2008-09-09 18:27 <REP> d-------- C:\Program Files\Vista Inspirat 2
2008-09-09 17:46 . 2008-09-09 17:46 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-09 17:46 . 2008-09-09 17:46 <REP> d-------- C:\WINDOWS\system32\bits
2008-09-09 04:32 . 2008-04-14 04:33 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-09-09 04:31 . 2008-04-14 04:33 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-09-09 04:31 . 2008-04-14 04:33 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-09-09 04:31 . 2008-04-14 04:33 49,152 --------- C:\WINDOWS\system32\dhcpqec.dll
2008-09-09 04:31 . 2008-04-14 04:33 39,936 --------- C:\WINDOWS\system32\dimsroam.dll
2008-09-09 04:31 . 2008-04-14 04:33 19,456 --------- C:\WINDOWS\system32\dimsntfy.dll
2008-09-09 04:31 . 2008-04-14 04:33 12,800 --------- C:\WINDOWS\system32\credssp.dll
2008-09-09 04:31 . 2008-04-14 04:33 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll
2008-09-08 23:16 . 2008-09-08 23:19 <REP> d-------- C:\Program Files\TVUPlayer
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-09-08 20:22 . 2008-09-08 20:22 <REP> d-------- C:\WINDOWS\system32\Futuremark
2008-09-08 20:22 . 2008-09-08 20:22 <REP> d-------- C:\Program Files\Fichiers communs\Futuremark Shared
2008-09-08 20:22 . 2008-05-29 12:33 27,672 -ra------ C:\WINDOWS\system32\drivers\Entech.sys
2008-09-03 18:33 . 2008-09-14 22:33 <REP> d-------- C:\Warhammer Online - Age of Reckoning
2008-09-01 19:09 . 2008-04-14 04:05 14,720 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-08-31 18:08 . 2008-08-31 18:08 <REP> d-------- C:\Program Files\Ventrilo
2008-08-31 16:58 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-31 16:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-13 15:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-10 18:46 70,977 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-08-31 16:06 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-31 15:29 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-07 12:33 --------- d-----w C:\Program Files\VTFEdit
2008-08-02 17:38 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-08-02 17:38 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-08-02 17:37 --------- d-----w C:\Program Files\Real
2008-07-29 10:46 --------- d-----w C:\Program Files\BUFFALO
2008-07-29 09:27 --------- d-----w C:\Program Files\Diablo II
2008-07-28 15:41 --------- d-----w C:\Program Files\Hamachi
2008-07-28 15:40 17,480 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-07-28 15:25 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-07-27 12:01 --------- d-----w C:\Program Files\Java
2008-07-27 11:15 --------- d-----w C:\Program Files\Winamp
2008-07-26 15:56 2,829 ----a-w C:\WINDOWS\DIIUnin.pif
2008-07-26 15:56 102,400 ----a-w C:\WINDOWS\DIIUnin.exe
2007-06-25 22:46 1,140,304 -c--a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
2007-06-28 13:04 88 --sh--r C:\WINDOWS\system32\93917F22C8.sys
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-06-28 13:37 3,350 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
2007-12-17 13:43 27,648 --sh--w C:\WINDOWS\system32\Smab0.dll
.

------- Sigcheck -------

2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\$hf_mig$\KB937143\SP2QFE\wininet.dll
2007-06-27 16:14 824320 7201d19b81883b57d5ffe8ebb5a83e8b C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 03:42 825344 f4fd487241d3ac291046a22cebd2cf71 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2008-04-23 09:19 827392 78d3d2b0be6ad3e6d82ccb115cf74310 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
2008-06-23 17:40 827904 52589bae67dd9859724287372668690b C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2007-06-26 16:12 663040 889269134af28b2142f47a337ca3a1cd C:\WINDOWS\$NtUninstallKB937143$\wininet.dll
2004-08-19 16:09 660480 4e958b97efc3d801f49283d1820f48b7 C:\WINDOWS\$NtUninstallKB937143_0$\wininet.dll
2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\ie7\wininet.dll
2006-11-07 21:03 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\ie7updates\KB937143-IE7\wininet.dll
2007-06-27 15:24 823808 2274862267d7445e7010d9af826e89c3 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
2007-08-20 11:59 824832 f6dfceed3a7aa4c9eeb966d3f1adc70a C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
2007-10-11 01:49 926208 ba898406a1b54630f2b26a00668941ac C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
2007-12-07 04:08 824832 4fc90bece54fac81b0090b94e27bfb6b C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
2008-04-23 06:16 817152 d1524e4adae7db718e4d60889293d6d3 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 18:28 817152 6c98101eea87cc71c4938185d080ed53 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-06-23 18:28 817152 6c98101eea87cc71c4938185d080ed53 C:\WINDOWS\system32\wininet.dll
2008-06-23 18:28 826368 ac0bd61dc2c64906fbfe50e005fefa2c C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-14 04:34 979968 d1ea0a366973eca3e03f1acbefda8f43 C:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-19 16:09 1036288 2a7bd330924252a2fd80344fc949bb72 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2008-04-14 04:34 979968 d1ea0a366973eca3e03f1acbefda8f43 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-14 04:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\explorer.exe

2007-07-30 19:19 68440 be055b9cc6958e7b4b2f6fa2a60e2d78 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe
2007-07-30 19:19 68440 be055b9cc6958e7b4b2f6fa2a60e2d78 C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-04 67128]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-09-13 190024]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]
"uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-23 219952]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 630784]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-06-25 13529088]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"razertra"="C:\Program Files\Razer\razertra.exe" [2004-10-10 208896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 267064]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-08-02 185896]
"Launch LGDCore"="C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" [2007-04-26 1132056]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 233472]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-06-25 86016]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 36864]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 1953792]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"nwiz"="nwiz.exe" [2008-06-25 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=euhocy.dll ruthfs.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Vcs;Vcs support;C:\WINDOWS\System32\Drivers\Vcs.sys [2002-12-10 6852]
S3 PALLADIA;Palladia 300/400 Usb Adsl Modem;C:\WINDOWS\system32\DRIVERS\usbiad.sys [2004-07-14 31547]
S3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys [2004-09-14 7168]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contenu du dossier 'Tƒches planifi‚es'
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file)
BHO-{1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file)
BHO-{17B67DCD-A954-4360-9257-6DA28E41826C} - (no file)
BHO-{250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file)
BHO-{37259384-B137-45C4-8170-6261DFCBC02B} - (no file)
BHO-{5DA0824A-401D-4AA6-929D-139668B454AD} - (no file)
BHO-{644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
BHO-{7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file)
BHO-{81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file)
BHO-{98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file)
BHO-{a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file)
BHO-{ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file)
BHO-{BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file)
BHO-{BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file)
BHO-{C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file)
BHO-{EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file)
BHO-{F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file)
BHO-{F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file)
BHO-{FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file)
Toolbar-{94E952A4-FAE1-40E5-BBE1-8199D8CF7FD0} - (no file)
HKCU-Run-Google Update - C:\Documents and Settings\Propriétaire\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
HKLM-Run-CmPCIaudio - CMICNFG3.CPL
ShellExecuteHooks-{644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
SSODL-dtseqrxk-{6167101B-06F1-4C4A-A920-0AA01E18D5B1} - (no file)
Notify-ssqOIXNE - (no file)

.
------- Examen suppl‚mentaire -------
.
FireFox -: Profile - C:\Documents and Settings\Propriétaire\Application Data\Mozilla\Firefox\Profiles\9kjha1ho.default\
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 07:40:40
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cach‚s ...

Recherche d'‚l‚ments en d‚marrage automatique cach‚s ...

Recherche de fichiers cach‚s ...

Scan termin‚ avec succŠs
Fichiers cach‚s: 0

**************************************************************************
.
------------------------ Autres processus actifs ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\system32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSvc.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\notepad.exe
.
**************************************************************************
.
Heure de fin: 2008-09-15 7:52:41 - La machine a red‚marr‚
ComboFix-quarantined-files.txt 2008-09-15 05:52:37

Avant-CF: 88,292,573,184 octets libres
AprŠs-CF: 88,258,109,440 octets libres

328 --- E O F --- 2008-09-11 05:35:34

-------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:53:17, on 15/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Razer\razertra.exe
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Documents and Settings\Propriétaire\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\WINDOWS\system32\taskmgr.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wpabaln.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://x-origin-x.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: euhocy.dll ruthfs.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
0
Réponse 22 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Salut,

la nuit fut bonne .... ^^

la suite :

1-Crées un doc texte sur ton bureau :
pointes ta souris sur ton bureau , cliques droit : vas dans "nouveau" et choisis "document texte" .

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de créer :

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

File::
C:\WINDOWS\system32\Smab0.dll

Folder::
C:\VundoFix Backups

Driver::
TDSSSERV

Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valides ...

2-Nettoyage :

!! Déconnectes toi, fermes toutes tes applications et désactives TOUTES TES DEFENSES ( tu les réactiveras après ) !!

--->Sur ton bureau, fais un glissé avec ta souris le fichier CFScript sur l'icône de ComboFix.exe .

(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tapes 1 puis valide.

Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)

!! Ne touches à rien tant que le scan n'est pas terminé !!

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.

Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )
0
Réponse 23 / 49
Origin
 
Me revoila ;) et voici les rapport :

ComboFix 08-09-14.02 - Propriétaire 2008-09-15 12:48:16.2 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1550 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Propriétaire\Bureau\C-Fix.exe
Command switches used :: C:\Documents and Settings\Propriétaire\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\WINDOWS\system32\Smab0.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-08-15 au 2008-09-15 ))))))))))))))))))))))))))))))))))))
.

2008-09-15 12:40 . 2008-09-15 12:40 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-15 12:40 . 2008-09-15 12:40 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-15 07:52 . 2008-09-15 07:52 <REP> d-------- C:\Documents and Settings\PropriÚtaire
2008-09-14 20:23 . 2008-09-14 20:24 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-14 20:23 . 2008-09-14 20:23 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Malwarebytes
2008-09-14 20:23 . 2008-09-14 20:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-14 20:23 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-14 20:23 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-14 20:21 . 2008-09-14 20:21 5,208 --a------ C:\WINDOWS\system32\pid.PNF
2008-09-14 16:56 . 2008-09-14 17:05 <REP> d-------- C:\SDFix
2008-09-14 16:51 . 2008-09-14 16:51 <REP> d-------- C:\Program Files\CCleaner
2008-09-14 15:32 . 2008-09-14 16:29 5,012 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-14 15:31 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-09-14 15:31 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-09-14 15:31 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-14 15:31 . 2008-09-02 16:51 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-09-14 15:31 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-09-14 15:31 . 2008-09-13 18:10 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-09-14 15:31 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-09-14 15:31 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-09-14 15:31 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-09-14 15:31 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-09-14 15:11 . 2008-09-14 15:11 <REP> d-------- C:\Program Files\Trend Micro
2008-09-13 17:45 . 2008-09-13 17:45 <REP> d-------- C:\WINDOWS\system32\AlertModule
2008-09-13 17:45 . 2004-08-23 13:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
2008-09-13 17:45 . 2005-10-06 13:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
2008-09-13 17:45 . 2004-08-23 13:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-09-13 17:43 . 2008-09-15 12:41 <REP> d-------- C:\Program Files\Wanadoo
2008-09-13 17:40 . 2008-09-13 17:40 <REP> d-------- C:\Program Files\Securitoo
2008-09-13 17:40 . 2008-09-13 17:40 <REP> d-------- C:\Program Files\Inventel
2008-09-13 17:00 . 2008-09-13 17:00 <REP> d-------- C:\Program Files\ASUS
2008-09-13 16:46 . 2008-09-13 16:46 <REP> d-------- C:\WINDOWS\JM
2008-09-13 16:46 . 2008-09-13 16:46 <REP> d-------- C:\JM
2008-09-13 16:46 . 2006-10-30 14:44 1,953,792 -r------- C:\WINDOWS\system32\JMRaidSetup.exe
2008-09-13 16:46 . 2006-09-13 14:32 139,264 -r------- C:\WINDOWS\system32\JMRaidAPI.dll
2008-09-13 16:46 . 2006-10-30 05:31 43,648 -ra------ C:\WINDOWS\system32\drivers\jraid.sys
2008-09-13 16:46 . 2006-02-07 13:52 6,912 -ra------ C:\WINDOWS\system32\drivers\JGOGO.sys
2008-09-13 16:42 . 2008-09-13 16:42 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-09-13 16:42 . 2008-09-13 16:42 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-09-13 16:41 . 2008-09-13 16:41 <REP> d-------- C:\WINDOWS\system32\Lang
2008-09-13 16:39 . 2006-08-01 09:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2008-09-13 16:38 . 2008-09-13 16:38 <REP> d-------- C:\Program Files\Realtek
2008-09-13 16:37 . 2006-09-12 08:34 499,712 -r------- C:\WINDOWS\RtlExUpd.dll
2008-09-13 16:30 . 2008-09-13 16:30 <REP> d-------- C:\WINDOWS\ASUSInstAll
2008-09-13 16:27 . 2006-06-21 11:24 810,056 -ra------ C:\WINDOWS\system32\Alert.bmp
2008-09-13 16:27 . 2006-09-27 03:44 495,616 -ra------ C:\WINDOWS\system32\AsusSetup.exe
2008-09-13 16:27 . 2006-12-12 09:25 907 -ra------ C:\WINDOWS\system32\AsusSetup.ini
2008-09-13 16:27 . 2006-06-21 18:32 263 -ra------ C:\WINDOWS\system32\raidmgmt.ini
2008-09-13 16:25 . 2008-09-13 16:47 13,423 --a------ C:\WINDOWS\Ascd_log.ini
2008-09-13 16:25 . 2008-09-13 16:59 13,174 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-09-13 16:25 . 2006-10-11 05:33 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-09-13 16:25 . 2004-08-13 04:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-09-13 16:04 . 2008-06-25 06:57 189,001 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-09-13 14:03 . 2008-09-13 14:03 <REP> d-------- C:\Program Files\Lavalys
2008-09-13 04:46 . 2008-09-13 11:58 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-09-13 04:26 . 2008-04-13 20:46 61,696 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2008-09-13 04:26 . 2008-04-13 20:46 61,696 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2008-09-13 04:26 . 2008-04-13 20:46 53,376 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2008-09-13 04:26 . 2008-04-13 20:46 53,376 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2008-09-13 04:26 . 2001-08-17 21:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-09-13 04:26 . 2001-08-17 21:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2008-09-12 18:38 . 2008-09-12 18:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-12 08:13 . 2008-09-12 08:13 <REP> d-------- C:\Program Files\Yahoo!
2008-09-12 00:31 . 2008-09-12 00:34 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-12 00:31 . 2008-09-14 16:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-12 00:06 . 2008-09-12 00:06 7,601,152 --a------ C:\Program Files\Firefox Setup 3.0.1.exe
2008-09-11 21:16 . 2008-04-14 04:33 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-09-11 21:16 . 2008-04-14 04:33 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-11 19:03 . 2006-01-01 18:19 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-09-11 19:03 . 2007-12-01 17:10 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-11 19:03 . 2006-01-01 18:15 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-11 19:03 . 2008-09-11 19:04 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-11 07:54 . 2008-09-11 07:54 <REP> d-------- C:\Program Files\PowerISO
2008-09-10 20:43 . 2008-09-10 20:46 5,470 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-10 20:42 . 2008-09-10 20:27 1,388,544 --a------ C:\WINDOWS\system32\MSVBVM60.dll
2008-09-10 20:27 . 2008-09-10 20:27 1,388,544 --a------ C:\MSVBVM60.dll
2008-09-10 07:48 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2008-09-10 07:47 . 2007-05-16 16:45 3,497,832 --a------ C:\d3dx9_34.dll
2008-09-10 07:45 . 2008-09-10 07:46 1,598,631 --a------ C:\d3dx9_34.zip
2008-09-09 18:35 . 2001-08-17 21:57 16,128 --a------ C:\WINDOWS\system32\drivers\MODEMCSA.sys
2008-09-09 18:35 . 2001-08-17 21:57 16,128 --a--c--- C:\WINDOWS\system32\dllcache\modemcsa.sys
2008-09-09 18:21 . 2008-09-10 20:43 <REP> d-------- C:\WINDOWS\BricoPacks
2008-09-09 18:21 . 2008-09-09 18:27 <REP> d-------- C:\Program Files\Vista Inspirat 2
2008-09-09 17:46 . 2008-09-09 17:46 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-09 17:46 . 2008-09-09 17:46 <REP> d-------- C:\WINDOWS\system32\bits
2008-09-09 04:32 . 2008-04-14 04:33 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-09-09 04:31 . 2008-04-14 04:33 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-09-09 04:31 . 2008-04-14 04:33 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-09-09 04:31 . 2008-04-14 04:33 49,152 --------- C:\WINDOWS\system32\dhcpqec.dll
2008-09-09 04:31 . 2008-04-14 04:33 39,936 --------- C:\WINDOWS\system32\dimsroam.dll
2008-09-09 04:31 . 2008-04-14 04:33 19,456 --------- C:\WINDOWS\system32\dimsntfy.dll
2008-09-09 04:31 . 2008-04-14 04:33 12,800 --------- C:\WINDOWS\system32\credssp.dll
2008-09-09 04:31 . 2008-04-14 04:33 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll
2008-09-08 23:16 . 2008-09-08 23:19 <REP> d-------- C:\Program Files\TVUPlayer
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\Propriétaire\LocalLow
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\Propriétaire\LocalLow
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\TVU Networks
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-09-08 20:22 . 2008-09-08 20:22 <REP> d-------- C:\WINDOWS\system32\Futuremark
2008-09-08 20:22 . 2008-09-08 20:22 <REP> d-------- C:\Program Files\Fichiers communs\Futuremark Shared
2008-09-08 20:22 . 2008-05-29 12:33 27,672 -ra------ C:\WINDOWS\system32\drivers\Entech.sys
2008-09-03 18:33 . 2008-09-14 22:33 <REP> d-------- C:\Warhammer Online - Age of Reckoning
2008-09-01 19:09 . 2008-04-14 04:05 14,720 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-08-31 18:08 . 2008-08-31 18:08 <REP> d-------- C:\Program Files\Ventrilo
2008-08-31 18:08 . 2008-08-31 18:17 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Ventrilo
2008-08-31 16:58 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-31 16:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-15 10:43 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\uTorrent
2008-09-13 15:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-13 09:43 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Hamachi
2008-09-10 18:46 70,977 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-09-10 18:46 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-01 08:42 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\MSN6
2008-08-31 16:06 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-31 15:29 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-07 12:33 --------- d-----w C:\Program Files\VTFEdit
2008-08-02 17:38 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-08-02 17:38 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-08-02 17:37 --------- d-----w C:\Program Files\Real
2008-07-29 10:46 --------- d-----w C:\Program Files\BUFFALO
2008-07-29 09:27 --------- d-----w C:\Program Files\Diablo II
2008-07-28 15:41 --------- d-----w C:\Program Files\Hamachi
2008-07-28 15:40 17,480 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-07-28 15:25 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-07-27 12:01 --------- d-----w C:\Program Files\Java
2008-07-27 11:26 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\vlc
2008-07-27 11:15 --------- d-----w C:\Program Files\Winamp
2008-07-26 16:03 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2008-07-26 16:03 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2008-07-26 16:03 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2008-07-26 15:56 2,829 ----a-w C:\WINDOWS\DIIUnin.pif
2008-07-26 15:56 102,400 ----a-w C:\WINDOWS\DIIUnin.exe
2008-07-08 09:47 8,769,536 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:28 817,152 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-16 14:34 446,464 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-03-01 19:40 8 ----a-w C:\Documents and Settings\Propriétaire\Application Data\usb.dat
2007-06-25 22:46 1,140,304 -c--a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
2007-06-28 13:04 88 --sh--r C:\WINDOWS\system32\93917F22C8.sys
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-06-28 13:37 3,350 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

------- Sigcheck -------

2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\$hf_mig$\KB937143\SP2QFE\wininet.dll
2007-06-27 16:14 824320 7201d19b81883b57d5ffe8ebb5a83e8b C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 03:42 825344 f4fd487241d3ac291046a22cebd2cf71 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2008-04-23 09:19 827392 78d3d2b0be6ad3e6d82ccb115cf74310 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
2008-06-23 17:40 827904 52589bae67dd9859724287372668690b C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2007-06-26 16:12 663040 889269134af28b2142f47a337ca3a1cd C:\WINDOWS\$NtUninstallKB937143$\wininet.dll
2004-08-19 16:09 660480 4e958b97efc3d801f49283d1820f48b7 C:\WINDOWS\$NtUninstallKB937143_0$\wininet.dll
2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\ie7\wininet.dll
2006-11-07 21:03 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\ie7updates\KB937143-IE7\wininet.dll
2007-06-27 15:24 823808 2274862267d7445e7010d9af826e89c3 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
2007-08-20 11:59 824832 f6dfceed3a7aa4c9eeb966d3f1adc70a C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
2007-10-11 01:49 926208 ba898406a1b54630f2b26a00668941ac C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
2007-12-07 04:08 824832 4fc90bece54fac81b0090b94e27bfb6b C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
2008-04-23 06:16 817152 d1524e4adae7db718e4d60889293d6d3 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 18:28 817152 6c98101eea87cc71c4938185d080ed53 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-06-23 18:28 817152 6c98101eea87cc71c4938185d080ed53 C:\WINDOWS\system32\wininet.dll
2008-06-23 18:28 826368 ac0bd61dc2c64906fbfe50e005fefa2c C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-14 04:34 979968 d1ea0a366973eca3e03f1acbefda8f43 C:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-19 16:09 1036288 2a7bd330924252a2fd80344fc949bb72 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2008-04-14 04:34 979968 d1ea0a366973eca3e03f1acbefda8f43 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-14 04:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\explorer.exe

2007-07-30 19:19 68440 be055b9cc6958e7b4b2f6fa2a60e2d78 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe
2007-07-30 19:19 68440 be055b9cc6958e7b4b2f6fa2a60e2d78 C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-15_ 7.52.13.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-15 10:39:56 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-04 67128]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-09-13 190024]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]
"uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-23 219952]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 630784]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-06-25 13529088]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"razertra"="C:\Program Files\Razer\razertra.exe" [2004-10-10 208896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 267064]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-08-02 185896]
"Launch LGDCore"="C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" [2007-04-26 1132056]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 233472]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-06-25 86016]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 36864]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 1953792]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"nwiz"="nwiz.exe" [2008-06-25 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-07 110592]
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-07 110592]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-01-01 98304]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-04 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqOIXNE]
[BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Vcs;Vcs support;C:\WINDOWS\System32\Drivers\Vcs.sys [2002-12-10 6852]
S3 PALLADIA;Palladia 300/400 Usb Adsl Modem;C:\WINDOWS\system32\DRIVERS\usbiad.sys [2004-07-14 31547]
S3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys [2004-09-14 7168]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contenu du dossier 'Tâches planifiées'
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file)
BHO-{1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file)
BHO-{17B67DCD-A954-4360-9257-6DA28E41826C} - (no file)
BHO-{250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file)
BHO-{37259384-B137-45C4-8170-6261DFCBC02B} - (no file)
BHO-{5DA0824A-401D-4AA6-929D-139668B454AD} - (no file)
BHO-{644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
BHO-{7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file)
BHO-{81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file)
BHO-{98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file)
BHO-{a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file)
BHO-{ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file)
BHO-{BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file)
BHO-{BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file)
BHO-{C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file)
BHO-{EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file)
BHO-{F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file)
BHO-{F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file)
BHO-{FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 12:51:56
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

**************************************************************************
.
Heure de fin: 2008-09-15 12:55:27
ComboFix-quarantined-files.txt 2008-09-15 10:54:24
ComboFix2.txt 2008-09-15 05:52:42

Avant-CF: 88,227,586,048 octets libres
AprŠs-CF: 88,227,835,904 octets libres

315 --- E O F --- 2008-09-11 05:35:34

---------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:26, on 15/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file)
O2 - BHO: (no name) - {1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file)
O2 - BHO: (no name) - {17B67DCD-A954-4360-9257-6DA28E41826C} - (no file)
O2 - BHO: (no name) - {250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {37259384-B137-45C4-8170-6261DFCBC02B} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5DA0824A-401D-4AA6-929D-139668B454AD} - (no file)
O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file)
O2 - BHO: (no name) - {81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file)
O2 - BHO: (no name) - {a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file)
O2 - BHO: (no name) - {ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file)
O2 - BHO: (no name) - {BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file)
O2 - BHO: (no name) - {C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file)
O2 - BHO: (no name) - {EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file)
O2 - BHO: (no name) - {F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file)
O2 - BHO: (no name) - {F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file)
O2 - BHO: (no name) - {FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: (no name) - {94E952A4-FAE1-40E5-BBE1-8199D8CF7FD0} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://x-origin-x.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ssqOIXNE - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
0
Réponse 24 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Bien ... encore un truc louche .... :-/

Supprimes le doc CFScript que tu as sur ton bureau et on reprend :

1-Crées un doc texte sur ton bureau :
pointes ta souris sur ton bureau , cliques droit : vas dans "nouveau" et choisis "document texte" .

Ensuite copie/colle le texte ci-dessous ( et rien d'autre!) dans le fichier texte que tu viens de créer :

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqOIXNE]

Puis vas dans "fichier" et choisis "enregistrer sous ..." et tu le nommes exactement ainsi :
CFScript puis valides ...

2-Nettoyage :

!! Déconnectes toi, fermes toutes tes applications et désactives TOUTES TES DEFENSES ( tu les réactiveras après ) !!

--->Sur ton bureau, fais un glissé avec ta souris le fichier CFScript sur l'icône de ComboFix.exe .

(Regarde ici : http://i261.photobucket.com/albums/ii49/Malekal_morte/CFScript.gif )

Cette manipulation va relancer combofix .
--> Une fenêtre bleue va apparaître: au message qui apparaît "Type 1 to continue, or 2 to abort" : tapes 1 puis valide.

Puis patientes le temps du scan.( Le Bureau va disparaître à plusieurs reprises : c'est normal!)

!! Ne touches à rien tant que le scan n'est pas terminé !!

Note : en fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisses-le faire.

Une fois le scan achevé, un rapport va s'afficher : Postes le accompagné d' un nouveau rapport HijackThis pour analyse ...

( Attention : cette manipe a été fait pour ce PC . Toute réutilisation peut endommager sévèrement le système d'exploitation )

0

Vous n’avez pas trouvé la réponse que vous recherchez ?

Posez votre question
Réponse 25 / 49
Origin
 
Re :

ComboFix 08-09-14.02 - Propriétaire 2008-09-15 14:00:08.3 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.1537 [GMT 2:00]
Lancé depuis: C:\Documents and Settings\Propriétaire\Bureau\C-Fix.exe
Command switches used :: C:\Documents and Settings\Propriétaire\Bureau\CFScript.txt
* Un nouveau point de restauration a été créé

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés du 2008-08-15 au 2008-09-15 ))))))))))))))))))))))))))))))))))))
.

2008-09-15 12:40 . 2008-09-15 12:40 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-15 12:40 . 2008-09-15 12:40 1,409 --a------ C:\WINDOWS\QTFont.for
2008-09-15 07:52 . 2008-09-15 07:52 <REP> d-------- C:\Documents and Settings\PropriÚtaire
2008-09-14 20:23 . 2008-09-14 20:24 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-14 20:23 . 2008-09-14 20:23 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Malwarebytes
2008-09-14 20:23 . 2008-09-14 20:23 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-14 20:23 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-14 20:23 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-14 20:21 . 2008-09-14 20:21 5,208 --a------ C:\WINDOWS\system32\pid.PNF
2008-09-14 16:56 . 2008-09-14 17:05 <REP> d-------- C:\SDFix
2008-09-14 16:51 . 2008-09-14 16:51 <REP> d-------- C:\Program Files\CCleaner
2008-09-14 15:32 . 2008-09-14 16:29 5,012 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-14 15:31 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-09-14 15:31 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-09-14 15:31 . 2008-09-08 23:38 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-09-14 15:31 . 2008-09-02 16:51 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-09-14 15:31 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-09-14 15:31 . 2008-09-13 18:10 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-09-14 15:31 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-09-14 15:31 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-09-14 15:31 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-09-14 15:31 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-09-14 15:11 . 2008-09-14 15:11 <REP> d-------- C:\Program Files\Trend Micro
2008-09-13 17:45 . 2008-09-13 17:45 <REP> d-------- C:\WINDOWS\system32\AlertModule
2008-09-13 17:45 . 2004-08-23 13:49 40,960 --a------ C:\WINDOWS\system32\FTRTSVC.exe
2008-09-13 17:45 . 2005-10-06 13:55 36,864 --a------ C:\WINDOWS\system32\IfHelper.dll
2008-09-13 17:45 . 2004-08-23 13:50 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-09-13 17:43 . 2008-09-15 12:41 <REP> d-------- C:\Program Files\Wanadoo
2008-09-13 17:40 . 2008-09-13 17:40 <REP> d-------- C:\Program Files\Securitoo
2008-09-13 17:40 . 2008-09-13 17:40 <REP> d-------- C:\Program Files\Inventel
2008-09-13 17:00 . 2008-09-13 17:00 <REP> d-------- C:\Program Files\ASUS
2008-09-13 16:46 . 2008-09-13 16:46 <REP> d-------- C:\WINDOWS\JM
2008-09-13 16:46 . 2008-09-13 16:46 <REP> d-------- C:\JM
2008-09-13 16:46 . 2006-10-30 14:44 1,953,792 -r------- C:\WINDOWS\system32\JMRaidSetup.exe
2008-09-13 16:46 . 2006-09-13 14:32 139,264 -r------- C:\WINDOWS\system32\JMRaidAPI.dll
2008-09-13 16:46 . 2006-10-30 05:31 43,648 -ra------ C:\WINDOWS\system32\drivers\jraid.sys
2008-09-13 16:46 . 2006-02-07 13:52 6,912 -ra------ C:\WINDOWS\system32\drivers\JGOGO.sys
2008-09-13 16:42 . 2008-09-13 16:42 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-09-13 16:42 . 2008-09-13 16:42 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-09-13 16:41 . 2008-09-13 16:41 <REP> d-------- C:\WINDOWS\system32\Lang
2008-09-13 16:39 . 2006-08-01 09:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2008-09-13 16:38 . 2008-09-13 16:38 <REP> d-------- C:\Program Files\Realtek
2008-09-13 16:37 . 2006-09-12 08:34 499,712 -r------- C:\WINDOWS\RtlExUpd.dll
2008-09-13 16:30 . 2008-09-13 16:30 <REP> d-------- C:\WINDOWS\ASUSInstAll
2008-09-13 16:27 . 2006-06-21 11:24 810,056 -ra------ C:\WINDOWS\system32\Alert.bmp
2008-09-13 16:27 . 2006-09-27 03:44 495,616 -ra------ C:\WINDOWS\system32\AsusSetup.exe
2008-09-13 16:27 . 2006-12-12 09:25 907 -ra------ C:\WINDOWS\system32\AsusSetup.ini
2008-09-13 16:27 . 2006-06-21 18:32 263 -ra------ C:\WINDOWS\system32\raidmgmt.ini
2008-09-13 16:25 . 2008-09-13 16:47 13,423 --a------ C:\WINDOWS\Ascd_log.ini
2008-09-13 16:25 . 2008-09-13 16:59 13,174 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-09-13 16:25 . 2006-10-11 05:33 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2008-09-13 16:25 . 2004-08-13 04:56 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-09-13 16:04 . 2008-06-25 06:57 189,001 --a------ C:\WINDOWS\system32\nvapps.nvb
2008-09-13 14:03 . 2008-09-13 14:03 <REP> d-------- C:\Program Files\Lavalys
2008-09-13 04:46 . 2008-09-13 11:58 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-09-13 04:26 . 2008-04-13 20:46 61,696 --a------ C:\WINDOWS\system32\drivers\ohci1394.sys
2008-09-13 04:26 . 2008-04-13 20:46 61,696 --a--c--- C:\WINDOWS\system32\dllcache\ohci1394.sys
2008-09-13 04:26 . 2008-04-13 20:46 53,376 --a------ C:\WINDOWS\system32\drivers\1394bus.sys
2008-09-13 04:26 . 2008-04-13 20:46 53,376 --a--c--- C:\WINDOWS\system32\dllcache\1394bus.sys
2008-09-13 04:26 . 2001-08-17 21:46 6,400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys
2008-09-13 04:26 . 2001-08-17 21:46 6,400 --a--c--- C:\WINDOWS\system32\dllcache\enum1394.sys
2008-09-12 18:38 . 2008-09-12 18:38 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-09-12 08:13 . 2008-09-12 08:13 <REP> d-------- C:\Program Files\Yahoo!
2008-09-12 00:31 . 2008-09-12 00:34 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-12 00:31 . 2008-09-14 16:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-12 00:06 . 2008-09-12 00:06 7,601,152 --a------ C:\Program Files\Firefox Setup 3.0.1.exe
2008-09-11 21:16 . 2008-04-14 04:33 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2008-09-11 21:16 . 2008-04-14 04:33 21,504 --a--c--- C:\WINDOWS\system32\dllcache\hidserv.dll
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage réseau
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
2008-09-11 19:03 . 2006-01-01 18:19 <REP> d--h----- C:\Documents and Settings\Administrateur\Modèles
2008-09-11 19:03 . 2007-12-01 17:10 <REP> d-------- C:\Documents and Settings\Administrateur\Mes documents
2008-09-11 19:03 . 2006-01-01 18:15 <REP> dr------- C:\Documents and Settings\Administrateur\Menu Démarrer
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d-------- C:\Documents and Settings\Administrateur\Favoris
2008-09-11 19:03 . 2006-01-01 18:15 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
2008-09-11 19:03 . 2008-09-11 19:04 <REP> d-------- C:\Documents and Settings\Administrateur
2008-09-11 07:54 . 2008-09-11 07:54 <REP> d-------- C:\Program Files\PowerISO
2008-09-10 20:43 . 2008-09-10 20:46 5,470 --a------ C:\WINDOWS\BricoPackFoldersDelete.cmd
2008-09-10 20:42 . 2008-09-10 20:27 1,388,544 --a------ C:\WINDOWS\system32\MSVBVM60.dll
2008-09-10 20:27 . 2008-09-10 20:27 1,388,544 --a------ C:\MSVBVM60.dll
2008-09-10 07:48 . 2007-05-16 16:45 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2008-09-10 07:47 . 2007-05-16 16:45 3,497,832 --a------ C:\d3dx9_34.dll
2008-09-10 07:45 . 2008-09-10 07:46 1,598,631 --a------ C:\d3dx9_34.zip
2008-09-09 18:35 . 2001-08-17 21:57 16,128 --a------ C:\WINDOWS\system32\drivers\MODEMCSA.sys
2008-09-09 18:35 . 2001-08-17 21:57 16,128 --a--c--- C:\WINDOWS\system32\dllcache\modemcsa.sys
2008-09-09 18:21 . 2008-09-10 20:43 <REP> d-------- C:\WINDOWS\BricoPacks
2008-09-09 18:21 . 2008-09-09 18:27 <REP> d-------- C:\Program Files\Vista Inspirat 2
2008-09-09 17:46 . 2008-09-09 17:46 <REP> d-------- C:\WINDOWS\system32\fr
2008-09-09 17:46 . 2008-09-09 17:46 <REP> d-------- C:\WINDOWS\system32\bits
2008-09-09 04:32 . 2008-04-14 04:33 651,264 --------- C:\WINDOWS\system32\dot3ui.dll
2008-09-09 04:31 . 2008-04-14 04:33 233,472 --------- C:\WINDOWS\system32\azroles.dll
2008-09-09 04:31 . 2008-04-14 04:33 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-09-09 04:31 . 2008-04-14 04:33 49,152 --------- C:\WINDOWS\system32\dhcpqec.dll
2008-09-09 04:31 . 2008-04-14 04:33 39,936 --------- C:\WINDOWS\system32\dimsroam.dll
2008-09-09 04:31 . 2008-04-14 04:33 19,456 --------- C:\WINDOWS\system32\dimsntfy.dll
2008-09-09 04:31 . 2008-04-14 04:33 12,800 --------- C:\WINDOWS\system32\credssp.dll
2008-09-09 04:31 . 2008-04-14 04:33 7,168 --------- C:\WINDOWS\system32\bitsprx4.dll
2008-09-08 23:16 . 2008-09-08 23:19 <REP> d-------- C:\Program Files\TVUPlayer
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\Propriétaire\LocalLow
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\Propriétaire\LocalLow
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\TVU Networks
2008-09-08 23:16 . 2008-09-08 23:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\TVU Networks
2008-09-08 20:22 . 2008-09-08 20:22 <REP> d-------- C:\WINDOWS\system32\Futuremark
2008-09-08 20:22 . 2008-09-08 20:22 <REP> d-------- C:\Program Files\Fichiers communs\Futuremark Shared
2008-09-08 20:22 . 2008-05-29 12:33 27,672 -ra------ C:\WINDOWS\system32\drivers\Entech.sys
2008-09-03 18:33 . 2008-09-15 13:54 <REP> d-------- C:\Warhammer Online - Age of Reckoning
2008-09-01 19:09 . 2008-04-14 04:05 14,720 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-08-31 18:08 . 2008-08-31 18:08 <REP> d-------- C:\Program Files\Ventrilo
2008-08-31 18:08 . 2008-08-31 18:17 <REP> d-------- C:\Documents and Settings\Propriétaire\Application Data\Ventrilo
2008-08-31 16:58 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-31 16:57 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-15 10:43 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\uTorrent
2008-09-13 15:00 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-09-13 09:43 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\Hamachi
2008-09-10 18:46 70,977 ----a-w C:\WINDOWS\BricoPackUninst.cmd
2008-09-10 18:46 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2008-09-01 08:42 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\MSN6
2008-08-31 16:06 --------- d-----w C:\Program Files\Fichiers communs\Wise Installation Wizard
2008-08-31 15:29 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-07 12:33 --------- d-----w C:\Program Files\VTFEdit
2008-08-02 17:38 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2008-08-02 17:38 --------- d-----w C:\Program Files\Fichiers communs\Real
2008-08-02 17:37 --------- d-----w C:\Program Files\Real
2008-07-29 10:46 --------- d-----w C:\Program Files\BUFFALO
2008-07-29 09:27 --------- d-----w C:\Program Files\Diablo II
2008-07-28 15:41 --------- d-----w C:\Program Files\Hamachi
2008-07-28 15:40 17,480 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2008-07-28 15:25 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-07-27 12:01 --------- d-----w C:\Program Files\Java
2008-07-27 11:26 --------- d-----w C:\Documents and Settings\Propriétaire\Application Data\vlc
2008-07-27 11:15 --------- d-----w C:\Program Files\Winamp
2008-07-26 16:03 21,840 ----a-w C:\WINDOWS\system32\SIntfNT.dll
2008-07-26 16:03 17,212 ----a-w C:\WINDOWS\system32\SIntf32.dll
2008-07-26 16:03 12,067 ----a-w C:\WINDOWS\system32\SIntf16.dll
2008-07-26 15:56 2,829 ----a-w C:\WINDOWS\DIIUnin.pif
2008-07-26 15:56 102,400 ----a-w C:\WINDOWS\DIIUnin.exe
2008-07-08 09:47 8,769,536 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 16:28 817,152 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:47 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-16 14:34 446,464 ----a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-03-01 19:40 8 ----a-w C:\Documents and Settings\Propriétaire\Application Data\usb.dat
2007-06-25 22:46 1,140,304 -c--a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
2007-06-28 13:04 88 --sh--r C:\WINDOWS\system32\93917F22C8.sys
2006-05-03 10:06 163,328 --sh--r C:\WINDOWS\system32\flvDX.dll
2007-06-28 13:37 3,350 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-02-21 11:47 31,232 --sh--r C:\WINDOWS\system32\msfDX.dll
.

------- Sigcheck -------

2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\$hf_mig$\KB937143\SP2QFE\wininet.dll
2007-06-27 16:14 824320 7201d19b81883b57d5ffe8ebb5a83e8b C:\WINDOWS\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
2007-08-20 11:49 825344 2dd1b0f579c80562edcb8848ff7ea9f6 C:\WINDOWS\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
2007-10-11 01:22 825344 871ae10d6ae8877e9636ae5017953d52 C:\WINDOWS\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
2007-12-07 03:42 825344 f4fd487241d3ac291046a22cebd2cf71 C:\WINDOWS\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
2008-03-01 14:34 827392 5a0093f59b505c008ed0cee615563c72 C:\WINDOWS\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
2008-04-23 09:19 827392 78d3d2b0be6ad3e6d82ccb115cf74310 C:\WINDOWS\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
2008-06-23 17:40 827904 52589bae67dd9859724287372668690b C:\WINDOWS\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
2007-06-26 16:12 663040 889269134af28b2142f47a337ca3a1cd C:\WINDOWS\$NtUninstallKB937143$\wininet.dll
2004-08-19 16:09 660480 4e958b97efc3d801f49283d1820f48b7 C:\WINDOWS\$NtUninstallKB937143_0$\wininet.dll
2007-06-26 16:36 669696 19058fbdc72f7bae085369c6d0a7d074 C:\WINDOWS\ie7\wininet.dll
2006-11-07 21:03 818688 92995334f993e6e49c25c6d02ec04401 C:\WINDOWS\ie7updates\KB937143-IE7\wininet.dll
2007-06-27 15:24 823808 2274862267d7445e7010d9af826e89c3 C:\WINDOWS\ie7updates\KB939653-IE7\wininet.dll
2007-08-20 11:59 824832 f6dfceed3a7aa4c9eeb966d3f1adc70a C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
2007-10-11 01:49 926208 ba898406a1b54630f2b26a00668941ac C:\WINDOWS\ie7updates\KB944533-IE7\wininet.dll
2007-12-07 04:08 824832 4fc90bece54fac81b0090b94e27bfb6b C:\WINDOWS\ie7updates\KB947864-IE7\wininet.dll
2008-03-01 14:58 826368 8e027981ddffa690d456fe18b37415a0 C:\WINDOWS\ie7updates\KB950759-IE7\wininet.dll
2008-04-23 06:16 817152 d1524e4adae7db718e4d60889293d6d3 C:\WINDOWS\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 18:28 817152 6c98101eea87cc71c4938185d080ed53 C:\WINDOWS\ServicePackFiles\i386\wininet.dll
2008-06-23 18:28 817152 6c98101eea87cc71c4938185d080ed53 C:\WINDOWS\system32\wininet.dll
2008-06-23 18:28 826368 ac0bd61dc2c64906fbfe50e005fefa2c C:\WINDOWS\system32\dllcache\wininet.dll

2008-04-14 04:34 979968 d1ea0a366973eca3e03f1acbefda8f43 C:\WINDOWS\explorer.exe
2007-06-13 15:10 1037312 b795475444d6d57a572c14b9e1a29839 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 15:22 979456 80a5400514eb32d393654768c4017e46 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-19 16:09 1036288 2a7bd330924252a2fd80344fc949bb72 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2008-04-14 04:34 979968 d1ea0a366973eca3e03f1acbefda8f43 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-14 04:34 1037824 f2317622d29f9ff0f88aeecd5f60f0dd C:\WINDOWS\SoftwareDistribution\Download\23ec66f2314a80d718b5483ab6e865af\explorer.exe

2007-07-30 19:19 68440 be055b9cc6958e7b4b2f6fa2a60e2d78 C:\WINDOWS\ServicePackFiles\i386\wuauclt.exe
2007-07-30 19:19 68440 be055b9cc6958e7b4b2f6fa2a60e2d78 C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 f3e9065eb617a7e3a832a7976bfa021b C:\WINDOWS\system32\dllcache\wuauclt.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-15_ 7.52.13.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-15 10:39:56 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-04 67128]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-01-18 196608]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-09-13 190024]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 360448]
"uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-02-23 219952]
"RocketDock"="C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe" [2007-03-19 630784]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" [2004-08-23 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-06-25 13529088]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"LVCOMSX"="C:\WINDOWS\System32\LVCOMSX.EXE" [2004-10-08 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-01-18 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-01-18 217088]
"razertra"="C:\Program Files\Razer\razertra.exe" [2004-10-10 208896]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 267064]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2008-08-02 185896]
"Launch LGDCore"="C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" [2007-04-26 1132056]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2008-03-15 233472]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-06-25 86016]
"JMB36X IDE Setup"="C:\WINDOWS\JM\JMInsIDE.exe" [2006-10-30 36864]
"JMB36X Configure"="C:\WINDOWS\system32\JMRaidSetup.exe" [2006-10-30 1953792]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 32768]
"nwiz"="nwiz.exe" [2008-06-25 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-11-14 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-07 110592]
RocketDock.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 630784]
TransBar.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe [2005-06-01 65536]
UberIcon.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 180224]
Y'z Shadow.lnk - C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe [2006-05-21 155648]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-07 110592]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-01-01 98304]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-04 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Extension de thème;C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Vcs;Vcs support;C:\WINDOWS\System32\Drivers\Vcs.sys [2002-12-10 6852]
S3 PALLADIA;Palladia 300/400 Usb Adsl Modem;C:\WINDOWS\system32\DRIVERS\usbiad.sys [2004-07-14 31547]
S3 Razerlow;Razerlow USB Filter Driver;C:\WINDOWS\system32\Drivers\Razerlow.sys [2004-09-14 7168]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{D58F39FF-953E-4F45-898F-59F243B9A523}]
RUNDLL32 advpack.dll,LaunchINFSection Sidebar.inf,Register
.
Contenu du dossier 'Tâches planifiées'
.
- - - - ORPHELINS SUPPRIMES - - - -

BHO-{0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file)
BHO-{1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file)
BHO-{17B67DCD-A954-4360-9257-6DA28E41826C} - (no file)
BHO-{250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file)
BHO-{37259384-B137-45C4-8170-6261DFCBC02B} - (no file)
BHO-{5DA0824A-401D-4AA6-929D-139668B454AD} - (no file)
BHO-{644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
BHO-{7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file)
BHO-{81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file)
BHO-{98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file)
BHO-{a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file)
BHO-{ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file)
BHO-{BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file)
BHO-{BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file)
BHO-{C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file)
BHO-{EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file)
BHO-{F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file)
BHO-{F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file)
BHO-{FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file)
Toolbar-{94E952A4-FAE1-40E5-BBE1-8199D8CF7FD0} - (no file)

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 14:03:54
Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

**************************************************************************
.
Heure de fin: 2008-09-15 14:07:27
ComboFix-quarantined-files.txt 2008-09-15 12:06:25
ComboFix2.txt 2008-09-15 10:55:28
ComboFix3.txt 2008-09-15 05:52:42

Avant-CF: 88,211,918,848 octets libres
AprŠs-CF: 88,195,330,048 octets libres

310 --- E O F --- 2008-09-11 05:35:34

-----------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:08:10, on 15/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\monjack.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file)
O2 - BHO: (no name) - {1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file)
O2 - BHO: (no name) - {17B67DCD-A954-4360-9257-6DA28E41826C} - (no file)
O2 - BHO: (no name) - {250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {37259384-B137-45C4-8170-6261DFCBC02B} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5DA0824A-401D-4AA6-929D-139668B454AD} - (no file)
O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file)
O2 - BHO: (no name) - {81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file)
O2 - BHO: (no name) - {a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file)
O2 - BHO: (no name) - {ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file)
O2 - BHO: (no name) - {BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file)
O2 - BHO: (no name) - {C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file)
O2 - BHO: (no name) - {EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file)
O2 - BHO: (no name) - {F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file)
O2 - BHO: (no name) - {F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file)
O2 - BHO: (no name) - {FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://x-origin-x.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ssqOIXNE - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
0
Réponse 26 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Bon ...

1- Fermes toutes tes applications et déconnectes toi .

Relances Hijackthis mais click sur " Do a scan only "
Tu vois donc apparaitre le résultat du scan : une multitudes de lignes ,chacunes précédées d'un carré vide .
Tu vas cliquer sur les carrés des lignes suivantes : 

O2 - BHO: (no name) - {0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file) 
O2 - BHO: (no name) - {1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file) 
O2 - BHO: (no name) - {17B67DCD-A954-4360-9257-6DA28E41826C} - (no file) 
O2 - BHO: (no name) - {250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file) 
O2 - BHO: (no name) - {37259384-B137-45C4-8170-6261DFCBC02B} - (no file) 
O2 - BHO: (no name) - {5DA0824A-401D-4AA6-929D-139668B454AD} - (no file) 
O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file) 
O2 - BHO: (no name) - {7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file) 
O2 - BHO: (no name) - {81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file) 
O2 - BHO: (no name) - {98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file) 
O2 - BHO: (no name) - {a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file) 
O2 - BHO: (no name) - {ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file) 
O2 - BHO: (no name) - {BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file) 
O2 - BHO: (no name) - {BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file) 
O2 - BHO: (no name) - {C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file) 
O2 - BHO: (no name) - {EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file) 
O2 - BHO: (no name) - {F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file) 
O2 - BHO: (no name) - {F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file) 
O2 - BHO: (no name) - {FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file) 

O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe 
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" 
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot 
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE 
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe" 
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') 

O20 - Winlogon Notify: ssqOIXNE - C:\WINDOWS\


Tu cliques en bas sur le bouton FIX CHECKED et valides .

2- refais un coup de CCleaner ( registre compris )

3-Vas dans panneau de config/ajout et suppression de prg .
Regardes dans la liste si tu trouves un prg comme : " CID Help ", "Circle Developement" ou
"Adverts" --->si ils s'y trouvent , supprimes les .

4-Télécharges Lop S&D :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Déconnetes toi et fermes toutes tes applications en cours .

Double cliques sur sur l'.exe que tu viens de télécharger pour lancer l'installe .

Une fois l'installation faite, cliques sur le raccourci pour lancer l'outil .

Là,laisses toi guider:
--->choisis l'option 1 (recherche) et valides.

(Tu ne fais pas l'option de nettoyage ( 2 ou 3) ).

Une fois le scan terminer ,le Bloc-Notes contenant le rapport va s'ouvrir.
Postes ce rapport dans ta prochaine réponse pour analyse .

Tuto : https://sites.google.com/site/eric71mespages/lop.sd.exe

0
Réponse 27 / 49
Origin
 
re :

--------------------\\ Lop S&D 4.2.4-3 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Propriétaire ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080914-0] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total : 149 Go Free : 82 Go
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (CD or DVD)
H:\ (USB)

"C:\Lop SD" ( MAJ : 14-09-2008|22:40 )
Option : [1] ( 15/09/2008|18:30 )

--------------------\\ Listing des dossiers dans APPLIC~1

[11/09/2008|19:09] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[25/08/2007|20:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[04/08/2007|15:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
[04/09/2007|13:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[14/09/2006|13:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[12/05/2008|21:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[25/02/2008|13:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CompSoftNurbBait
[26/06/2007|00:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Corel
[25/08/2007|20:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
[28/06/2007|15:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[25/02/2008|04:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
[04/11/2007|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
[14/09/2008|20:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[13/09/2006|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[08/12/2006|15:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/01/2006|20:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[19/11/2007|21:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[03/01/2007|22:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[12/05/2008|21:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony
[12/05/2008|21:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
[14/09/2008|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[26/02/2008|00:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[30/09/2007|20:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
[08/09/2008|23:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TVU Networks
[03/12/2006|12:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[01/09/2006|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[30/09/2007|21:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
[13/11/2007|19:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[12/09/2008|18:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[07/04/2006|13:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[01/01/2006|18:21] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[01/01/2006|18:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[01/01/2006|18:21] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[08/06/2008|22:44] C:\DOCUME~1\PROPRI~3\APPLIC~1\Adobe

[14/09/2006|13:15] C:\DOCUME~1\PROPRI~2\APPLIC~1\Macromedia

[08/06/2008|22:44] C:\DOCUME~1\PROPRI~1\APPLIC~1\Adobe
[03/01/2007|22:31] C:\DOCUME~1\PROPRI~1\APPLIC~1\Apple Computer
[28/06/2007|15:37] C:\DOCUME~1\PROPRI~1\APPLIC~1\Corel
[24/02/2008|14:57] C:\DOCUME~1\PROPRI~1\APPLIC~1\COWON
[15/04/2008|21:38] C:\DOCUME~1\PROPRI~1\APPLIC~1\DAEMON Tools
[16/04/2007|13:03] C:\DOCUME~1\PROPRI~1\APPLIC~1\dvdcss
[10/06/2008|17:48] C:\DOCUME~1\PROPRI~1\APPLIC~1\EPSON
[10/04/2006|15:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\FotoWire
[30/03/2007|17:40] C:\DOCUME~1\PROPRI~1\APPLIC~1\Google
[13/09/2008|11:43] C:\DOCUME~1\PROPRI~1\APPLIC~1\Hamachi
[06/07/2006|17:57] C:\DOCUME~1\PROPRI~1\APPLIC~1\Help
[21/12/2006|12:33] C:\DOCUME~1\PROPRI~1\APPLIC~1\ICQ Toolbar
[27/03/2007|20:39] C:\DOCUME~1\PROPRI~1\APPLIC~1\ICQLite
[30/07/2006|21:37] C:\DOCUME~1\PROPRI~1\APPLIC~1\Identities
[12/05/2008|21:20] C:\DOCUME~1\PROPRI~1\APPLIC~1\InstallShield
[01/01/2006|19:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterTrust
[01/01/2006|20:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterVideo
[17/09/2006|19:45] C:\DOCUME~1\PROPRI~1\APPLIC~1\Jasc
[08/10/2007|17:59] C:\DOCUME~1\PROPRI~1\APPLIC~1\ma-config.com
[02/01/2006|16:45] C:\DOCUME~1\PROPRI~1\APPLIC~1\Macromedia
[14/09/2008|20:23] C:\DOCUME~1\PROPRI~1\APPLIC~1\Malwarebytes
[08/10/2007|21:42] C:\DOCUME~1\PROPRI~1\APPLIC~1\Media Player Classic
[31/08/2008|18:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\Microsoft
[20/06/2008|20:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\Mozilla
[01/09/2008|10:42] C:\DOCUME~1\PROPRI~1\APPLIC~1\MSN6
[12/06/2008|02:13] C:\DOCUME~1\PROPRI~1\APPLIC~1\Notepad++
[06/08/2007|13:40] C:\DOCUME~1\PROPRI~1\APPLIC~1\Opera
[25/02/2008|02:54] C:\DOCUME~1\PROPRI~1\APPLIC~1\Publish Providers
[02/08/2008|19:40] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
[19/03/2007|23:31] C:\DOCUME~1\PROPRI~1\APPLIC~1\Screenshot Sender
[01/08/2007|00:54] C:\DOCUME~1\PROPRI~1\APPLIC~1\Shareaza
[12/05/2008|21:48] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sony
[25/02/2008|02:30] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sony Setup
[02/01/2006|17:59] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sun
[12/12/2007|22:09] C:\DOCUME~1\PROPRI~1\APPLIC~1\teamspeak2
[01/01/2006|19:21] C:\DOCUME~1\PROPRI~1\APPLIC~1\Template
[30/09/2007|20:07] C:\DOCUME~1\PROPRI~1\APPLIC~1\TuneUp Software
[08/09/2008|23:16] C:\DOCUME~1\PROPRI~1\APPLIC~1\TVU Networks
[15/09/2008|12:43] C:\DOCUME~1\PROPRI~1\APPLIC~1\uTorrent
[31/08/2008|18:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\Ventrilo
[27/07/2008|13:26] C:\DOCUME~1\PROPRI~1\APPLIC~1\vlc
[01/08/2007|23:48] C:\DOCUME~1\PROPRI~1\APPLIC~1\WinRAR
[30/10/2006|00:33] C:\DOCUME~1\PROPRI~1\APPLIC~1\Xfire
[08/02/2007|18:25] C:\DOCUME~1\PROPRI~1\APPLIC~1\ZangoToolbar
[30/07/2006|22:39] C:\DOCUME~1\PROPRI~1\APPLIC~1\Zylom

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[14/09/2008 18:55][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job
[15/09/2008 18:17][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
[05/09/2008 18:19][--a------] C:\WINDOWS\tasks\Maintenance en 1 clic.job
[01/09/2008 11:30][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[15/09/2008 18:09][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[26/02/2008|01:43] C:\Program Files\7-Zip
[25/08/2007|20:12] C:\Program Files\Adobe
[25/02/2008|13:02] C:\Program Files\Adverts
[01/01/2006|19:00] C:\Program Files\Ahead
[25/06/2008|19:23] C:\Program Files\Alky for Applications
[29/03/2006|21:59] C:\Program Files\Alwil Software
[09/06/2008|12:14] C:\Program Files\Apple Software Update
[01/01/2006|19:16] C:\Program Files\ArcSoft
[13/09/2008|17:00] C:\Program Files\ASUS
[15/04/2008|20:00] C:\Program Files\Audacity
[01/01/2001|00:02] C:\Program Files\Avanquest update
[15/04/2008|19:40] C:\Program Files\AviSynth 2.5
[02/04/2007|21:24] C:\Program Files\baselogobody
[06/09/2006|00:27] C:\Program Files\Blender Foundation
[25/08/2007|20:09] C:\Program Files\Bonjour
[29/07/2008|12:46] C:\Program Files\BUFFALO
[16/04/2008|13:26] C:\Program Files\CamStudio
[14/09/2008|16:51] C:\Program Files\CCleaner
[01/01/2006|18:19] C:\Program Files\ComPlus Applications
[31/07/2007|23:02] C:\Program Files\Corel
[15/04/2008|21:42] C:\Program Files\DAEMON Tools Lite
[29/07/2008|11:27] C:\Program Files\Diablo II
[25/09/2007|21:18] C:\Program Files\DivX
[11/03/2007|20:51] C:\Program Files\EPSON
[15/04/2008|19:38] C:\Program Files\eRightSoft
[10/12/2007|17:17] C:\Program Files\ESET
[15/09/2008|14:02] C:\Program Files\Fichiers communs
[19/07/2006|00:28] C:\Program Files\GUILD WARS
[28/07/2008|17:41] C:\Program Files\Hamachi
[08/10/2007|17:59] C:\Program Files\HardwareDetection
[03/06/2007|18:53] C:\Program Files\ICQLite
[13/06/2007|22:56] C:\Program Files\ICQToolbar
[13/09/2008|17:00] C:\Program Files\InstallShield Installation Information
[08/10/2007|17:48] C:\Program Files\Intel Desktop Board
[07/11/2006|19:44] C:\Program Files\InterActual
[01/09/2008|03:05] C:\Program Files\Internet Explorer
[01/01/2006|19:03] C:\Program Files\InterVideo
[13/09/2008|17:40] C:\Program Files\Inventel
[09/10/2007|19:04] C:\Program Files\iPod
[09/10/2007|19:04] C:\Program Files\iTunes
[07/11/2006|19:42] C:\Program Files\Jasc Software Inc
[27/07/2008|14:01] C:\Program Files\Java
[15/04/2008|21:37] C:\Program Files\JetAudio
[23/01/2007|20:25] C:\Program Files\Kit ADSL
[13/09/2008|14:03] C:\Program Files\Lavalys
[04/11/2007|20:49] C:\Program Files\Logitech
[08/10/2007|17:59] C:\Program Files\ma-config.com
[14/09/2008|20:24] C:\Program Files\Malwarebytes' Anti-Malware
[09/09/2008|17:52] C:\Program Files\Messenger
[31/08/2008|17:29] C:\Program Files\Messenger Plus! Live
[13/09/2006|20:22] C:\Program Files\MessengerPlus! 3
[01/10/2007|16:03] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/01/2006|18:22] C:\Program Files\microsoft frontpage
[21/03/2006|19:06] C:\Program Files\Microsoft Games
[24/04/2007|18:49] C:\Program Files\Microsoft Office
[26/02/2008|02:42] C:\Program Files\Microsoft SQL Server
[01/01/2006|18:56] C:\Program Files\Microsoft Works
[10/09/2008|20:47] C:\Program Files\Movie Maker
[15/09/2008|18:24] C:\Program Files\Mozilla Firefox
[25/02/2008|02:46] C:\Program Files\MSBuild
[01/01/2006|18:19] C:\Program Files\MSN
[01/01/2006|18:19] C:\Program Files\MSN Gaming Zone
[26/08/2007|14:01] C:\Program Files\MSXML 4.0
[26/02/2008|04:03] C:\Program Files\MSXML 6.0
[09/09/2008|17:43] C:\Program Files\NetMeeting
[20/09/2007|18:14] C:\Program Files\Netropa
[12/06/2008|02:12] C:\Program Files\Notepad++
[25/08/2007|17:12] C:\Program Files\Omni
[10/09/2008|20:47] C:\Program Files\Outlook Express
[11/09/2008|07:54] C:\Program Files\PowerISO
[04/09/2007|13:59] C:\Program Files\QuickTime
[30/09/2007|20:36] C:\Program Files\Razer
[02/08/2008|19:37] C:\Program Files\Real
[13/09/2008|16:38] C:\Program Files\Realtek
[25/02/2008|02:40] C:\Program Files\Reference Assemblies
[24/01/2007|21:54] C:\Program Files\Rockstar Games
[13/09/2008|17:40] C:\Program Files\Securitoo
[11/03/2007|20:51] C:\Program Files\SEIKO EPSON Corp
[01/01/2006|18:21] C:\Program Files\Services en ligne
[26/02/2008|02:37] C:\Program Files\Sony
[12/05/2008|21:41] C:\Program Files\Sony Ericsson
[26/02/2008|02:35] C:\Program Files\Sony Setup
[12/09/2008|00:34] C:\Program Files\Spybot - Search & Destroy
[16/04/2008|13:30] C:\Program Files\StuffPlug3
[31/08/2006|22:06] C:\Program Files\Teamspeak2_RC2
[15/04/2008|21:38] C:\Program Files\The KMPlayer FR
[14/09/2008|15:11] C:\Program Files\Trend Micro
[23/04/2008|02:16] C:\Program Files\TuneUp Utilities 2007
[08/09/2008|23:19] C:\Program Files\TVUPlayer
[26/02/2008|02:43] C:\Program Files\Uninstall Information
[29/03/2006|19:52] C:\Program Files\USB Driver-Express
[01/08/2007|00:28] C:\Program Files\uTorrent
[15/11/2006|16:17] C:\Program Files\Valve
[21/04/2007|11:57] C:\Program Files\VCW VicMan's Photo Editor
[31/08/2008|18:08] C:\Program Files\Ventrilo
[02/01/2006|13:57] C:\Program Files\VideoLAN
[09/09/2008|18:27] C:\Program Files\Vista Inspirat 2
[25/06/2008|19:52] C:\Program Files\VistaExperience.org
[26/02/2008|02:38] C:\Program Files\Vstplugins
[07/08/2008|14:33] C:\Program Files\VTFEdit
[15/09/2008|18:11] C:\Program Files\Wanadoo
[23/04/2008|15:35] C:\Program Files\Warcraft III
[13/09/2006|16:08] C:\Program Files\Webteh
[27/07/2008|13:15] C:\Program Files\Winamp
[13/11/2007|19:46] C:\Program Files\Windows Live
[28/07/2008|17:25] C:\Program Files\Windows Live Safety Center
[05/11/2007|04:00] C:\Program Files\Windows Live Toolbar
[26/08/2007|17:23] C:\Program Files\Windows Media Connect 2
[09/09/2008|17:43] C:\Program Files\Windows Media Player
[09/09/2008|17:43] C:\Program Files\Windows NT
[13/06/2007|20:40] C:\Program Files\WindowsUpdate
[01/08/2007|20:25] C:\Program Files\WinRAR
[01/01/2006|18:22] C:\Program Files\xerox
[12/09/2008|08:13] C:\Program Files\Yahoo!
[13/06/2007|21:20] C:\Program Files\Zylom Games

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[25/08/2007|20:09] C:\Program Files\Fichiers communs\Adobe
[04/08/2007|15:07] C:\Program Files\Fichiers communs\Adobe Systems Shared
[04/09/2007|13:56] C:\Program Files\Fichiers communs\Apple
[15/04/2008|21:37] C:\Program Files\Fichiers communs\COWON
[04/03/2007|20:04] C:\Program Files\Fichiers communs\EPSON
[10/04/2006|15:27] C:\Program Files\Fichiers communs\FotoWire
[08/09/2008|20:22] C:\Program Files\Fichiers communs\Futuremark Shared
[29/03/2006|19:52] C:\Program Files\Fichiers communs\InstallShield
[02/01/2006|17:57] C:\Program Files\Fichiers communs\Java
[04/11/2007|20:49] C:\Program Files\Fichiers communs\Logitech
[25/08/2007|19:52] C:\Program Files\Fichiers communs\Macrovision Shared
[06/06/2008|13:02] C:\Program Files\Fichiers communs\Microsoft Shared
[01/01/2006|18:20] C:\Program Files\Fichiers communs\MSSoap
[01/01/2006|18:16] C:\Program Files\Fichiers communs\ODBC
[11/03/2007|20:52] C:\Program Files\Fichiers communs\Python
[02/08/2008|19:38] C:\Program Files\Fichiers communs\Real
[01/01/2006|18:20] C:\Program Files\Fichiers communs\Services
[01/01/2006|18:16] C:\Program Files\Fichiers communs\SpeechEngines
[09/09/2008|17:43] C:\Program Files\Fichiers communs\System
[07/04/2006|18:04] C:\Program Files\Fichiers communs\Vbox
[13/11/2007|19:42] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[31/08/2008|18:06] C:\Program Files\Fichiers communs\Wise Installation Wizard
[02/08/2008|19:38] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 56 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\Program Files\Adverts

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 18:31:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 243

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.1.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky_Internet_Security_2009 + Crack.zip.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Sony Vegas 8 Pro + Crack.torrent
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sony.Vegas.v7.0c.Incl.Keygen-SSG.rar
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sonykeygen
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG\keygen.exe
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Toshop CS3\cracktro_totoshop.exe
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Toshop CS3\keygen.exe

[F:1][D:1]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
[F:9][D:0]-> C:\DOCUME~1\PROPRI~1\Cookies
[F:177][D:4]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 15/09/2008|18:32 - Option : [1]

--------------------\\ Fin du rapport a 18:32:31
0
Réponse 28 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
bien ...

->Déconnetes toi et fermes toutes tes applications en cours .

Relances Lop S&D ,
--->choisis l'option 3 (nettoyage) et valides.

Laisses travailler l'outil ....

Une fois le scan terminer ,le Bloc-Notes contenant le rapport va s'ouvrir.
Postes ce rapport dans ta prochaine réponse pour analyse et attends la suite ....
0
Réponse 29 / 49
Origin
 
--------------------\\ Lop S&D 4.2.4-3 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Propriétaire ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080914-0] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total : 149 Go Free : 82 Go
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (CD or DVD)
H:\ (USB)

"C:\Lop SD" ( MAJ : 14-09-2008|22:40 )
Option : [3] ( 15/09/2008|20:54 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\Program Files\Adverts

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[11/09/2008|19:09] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

[25/08/2007|20:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[04/08/2007|15:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
[04/09/2007|13:56] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
[14/09/2006|13:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
[12/05/2008|21:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BVRP Software
[25/02/2008|13:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CompSoftNurbBait
[26/06/2007|00:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Corel
[25/08/2007|20:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
[28/06/2007|15:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[25/02/2008|04:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
[04/11/2007|20:49] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
[14/09/2008|20:23] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[13/09/2006|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Messenger Plus!
[08/12/2006|15:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/01/2006|20:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
[19/11/2007|21:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
[03/01/2007|22:08] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[12/05/2008|21:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony
[12/05/2008|21:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
[14/09/2008|16:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
[26/02/2008|00:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
[30/09/2007|20:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TuneUp Software
[08/09/2008|23:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TVU Networks
[03/12/2006|12:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[01/09/2006|23:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar
[30/09/2007|21:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
[13/11/2007|19:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
[12/09/2008|18:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
[07/04/2006|13:01] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

[01/01/2006|18:21] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

[01/01/2006|18:21] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[01/01/2006|18:21] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

[08/06/2008|22:44] C:\DOCUME~1\PROPRI~3\APPLIC~1\Adobe

[14/09/2006|13:15] C:\DOCUME~1\PROPRI~2\APPLIC~1\Macromedia

[08/06/2008|22:44] C:\DOCUME~1\PROPRI~1\APPLIC~1\Adobe
[03/01/2007|22:31] C:\DOCUME~1\PROPRI~1\APPLIC~1\Apple Computer
[28/06/2007|15:37] C:\DOCUME~1\PROPRI~1\APPLIC~1\Corel
[24/02/2008|14:57] C:\DOCUME~1\PROPRI~1\APPLIC~1\COWON
[15/04/2008|21:38] C:\DOCUME~1\PROPRI~1\APPLIC~1\DAEMON Tools
[16/04/2007|13:03] C:\DOCUME~1\PROPRI~1\APPLIC~1\dvdcss
[10/06/2008|17:48] C:\DOCUME~1\PROPRI~1\APPLIC~1\EPSON
[10/04/2006|15:27] C:\DOCUME~1\PROPRI~1\APPLIC~1\FotoWire
[30/03/2007|17:40] C:\DOCUME~1\PROPRI~1\APPLIC~1\Google
[13/09/2008|11:43] C:\DOCUME~1\PROPRI~1\APPLIC~1\Hamachi
[06/07/2006|17:57] C:\DOCUME~1\PROPRI~1\APPLIC~1\Help
[21/12/2006|12:33] C:\DOCUME~1\PROPRI~1\APPLIC~1\ICQ Toolbar
[27/03/2007|20:39] C:\DOCUME~1\PROPRI~1\APPLIC~1\ICQLite
[30/07/2006|21:37] C:\DOCUME~1\PROPRI~1\APPLIC~1\Identities
[12/05/2008|21:20] C:\DOCUME~1\PROPRI~1\APPLIC~1\InstallShield
[01/01/2006|19:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterTrust
[01/01/2006|20:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\InterVideo
[17/09/2006|19:45] C:\DOCUME~1\PROPRI~1\APPLIC~1\Jasc
[08/10/2007|17:59] C:\DOCUME~1\PROPRI~1\APPLIC~1\ma-config.com
[02/01/2006|16:45] C:\DOCUME~1\PROPRI~1\APPLIC~1\Macromedia
[14/09/2008|20:23] C:\DOCUME~1\PROPRI~1\APPLIC~1\Malwarebytes
[08/10/2007|21:42] C:\DOCUME~1\PROPRI~1\APPLIC~1\Media Player Classic
[31/08/2008|18:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\Microsoft
[20/06/2008|20:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\Mozilla
[01/09/2008|10:42] C:\DOCUME~1\PROPRI~1\APPLIC~1\MSN6
[12/06/2008|02:13] C:\DOCUME~1\PROPRI~1\APPLIC~1\Notepad++
[06/08/2007|13:40] C:\DOCUME~1\PROPRI~1\APPLIC~1\Opera
[25/02/2008|02:54] C:\DOCUME~1\PROPRI~1\APPLIC~1\Publish Providers
[02/08/2008|19:40] C:\DOCUME~1\PROPRI~1\APPLIC~1\Real
[19/03/2007|23:31] C:\DOCUME~1\PROPRI~1\APPLIC~1\Screenshot Sender
[01/08/2007|00:54] C:\DOCUME~1\PROPRI~1\APPLIC~1\Shareaza
[12/05/2008|21:48] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sony
[25/02/2008|02:30] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sony Setup
[02/01/2006|17:59] C:\DOCUME~1\PROPRI~1\APPLIC~1\Sun
[12/12/2007|22:09] C:\DOCUME~1\PROPRI~1\APPLIC~1\teamspeak2
[01/01/2006|19:21] C:\DOCUME~1\PROPRI~1\APPLIC~1\Template
[30/09/2007|20:07] C:\DOCUME~1\PROPRI~1\APPLIC~1\TuneUp Software
[08/09/2008|23:16] C:\DOCUME~1\PROPRI~1\APPLIC~1\TVU Networks
[15/09/2008|12:43] C:\DOCUME~1\PROPRI~1\APPLIC~1\uTorrent
[31/08/2008|18:17] C:\DOCUME~1\PROPRI~1\APPLIC~1\Ventrilo
[27/07/2008|13:26] C:\DOCUME~1\PROPRI~1\APPLIC~1\vlc
[01/08/2007|23:48] C:\DOCUME~1\PROPRI~1\APPLIC~1\WinRAR
[30/10/2006|00:33] C:\DOCUME~1\PROPRI~1\APPLIC~1\Xfire
[08/02/2007|18:25] C:\DOCUME~1\PROPRI~1\APPLIC~1\ZangoToolbar
[30/07/2006|22:39] C:\DOCUME~1\PROPRI~1\APPLIC~1\Zylom

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[14/09/2008 18:55][--a------] C:\WINDOWS\tasks\GoogleUpdateTaskUser.job
[15/09/2008 20:17][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
[05/09/2008 18:19][--a------] C:\WINDOWS\tasks\Maintenance en 1 clic.job
[01/09/2008 11:30][--a------] C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[15/09/2008 18:09][--ah-----] C:\WINDOWS\tasks\SA.DAT
[30/08/2002 14:00][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[26/02/2008|01:43] C:\Program Files\7-Zip
[25/08/2007|20:12] C:\Program Files\Adobe
[01/01/2006|19:00] C:\Program Files\Ahead
[25/06/2008|19:23] C:\Program Files\Alky for Applications
[29/03/2006|21:59] C:\Program Files\Alwil Software
[09/06/2008|12:14] C:\Program Files\Apple Software Update
[01/01/2006|19:16] C:\Program Files\ArcSoft
[13/09/2008|17:00] C:\Program Files\ASUS
[15/04/2008|20:00] C:\Program Files\Audacity
[01/01/2001|00:02] C:\Program Files\Avanquest update
[15/04/2008|19:40] C:\Program Files\AviSynth 2.5
[02/04/2007|21:24] C:\Program Files\baselogobody
[06/09/2006|00:27] C:\Program Files\Blender Foundation
[25/08/2007|20:09] C:\Program Files\Bonjour
[29/07/2008|12:46] C:\Program Files\BUFFALO
[16/04/2008|13:26] C:\Program Files\CamStudio
[14/09/2008|16:51] C:\Program Files\CCleaner
[01/01/2006|18:19] C:\Program Files\ComPlus Applications
[31/07/2007|23:02] C:\Program Files\Corel
[15/04/2008|21:42] C:\Program Files\DAEMON Tools Lite
[29/07/2008|11:27] C:\Program Files\Diablo II
[25/09/2007|21:18] C:\Program Files\DivX
[11/03/2007|20:51] C:\Program Files\EPSON
[15/04/2008|19:38] C:\Program Files\eRightSoft
[10/12/2007|17:17] C:\Program Files\ESET
[15/09/2008|14:02] C:\Program Files\Fichiers communs
[19/07/2006|00:28] C:\Program Files\GUILD WARS
[28/07/2008|17:41] C:\Program Files\Hamachi
[08/10/2007|17:59] C:\Program Files\HardwareDetection
[03/06/2007|18:53] C:\Program Files\ICQLite
[13/06/2007|22:56] C:\Program Files\ICQToolbar
[13/09/2008|17:00] C:\Program Files\InstallShield Installation Information
[08/10/2007|17:48] C:\Program Files\Intel Desktop Board
[07/11/2006|19:44] C:\Program Files\InterActual
[01/09/2008|03:05] C:\Program Files\Internet Explorer
[01/01/2006|19:03] C:\Program Files\InterVideo
[13/09/2008|17:40] C:\Program Files\Inventel
[09/10/2007|19:04] C:\Program Files\iPod
[09/10/2007|19:04] C:\Program Files\iTunes
[07/11/2006|19:42] C:\Program Files\Jasc Software Inc
[27/07/2008|14:01] C:\Program Files\Java
[15/04/2008|21:37] C:\Program Files\JetAudio
[23/01/2007|20:25] C:\Program Files\Kit ADSL
[13/09/2008|14:03] C:\Program Files\Lavalys
[04/11/2007|20:49] C:\Program Files\Logitech
[08/10/2007|17:59] C:\Program Files\ma-config.com
[14/09/2008|20:24] C:\Program Files\Malwarebytes' Anti-Malware
[09/09/2008|17:52] C:\Program Files\Messenger
[31/08/2008|17:29] C:\Program Files\Messenger Plus! Live
[13/09/2006|20:22] C:\Program Files\MessengerPlus! 3
[01/10/2007|16:03] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/01/2006|18:22] C:\Program Files\microsoft frontpage
[21/03/2006|19:06] C:\Program Files\Microsoft Games
[24/04/2007|18:49] C:\Program Files\Microsoft Office
[26/02/2008|02:42] C:\Program Files\Microsoft SQL Server
[01/01/2006|18:56] C:\Program Files\Microsoft Works
[10/09/2008|20:47] C:\Program Files\Movie Maker
[15/09/2008|20:52] C:\Program Files\Mozilla Firefox
[25/02/2008|02:46] C:\Program Files\MSBuild
[01/01/2006|18:19] C:\Program Files\MSN
[01/01/2006|18:19] C:\Program Files\MSN Gaming Zone
[26/08/2007|14:01] C:\Program Files\MSXML 4.0
[26/02/2008|04:03] C:\Program Files\MSXML 6.0
[09/09/2008|17:43] C:\Program Files\NetMeeting
[20/09/2007|18:14] C:\Program Files\Netropa
[12/06/2008|02:12] C:\Program Files\Notepad++
[25/08/2007|17:12] C:\Program Files\Omni
[10/09/2008|20:47] C:\Program Files\Outlook Express
[11/09/2008|07:54] C:\Program Files\PowerISO
[04/09/2007|13:59] C:\Program Files\QuickTime
[30/09/2007|20:36] C:\Program Files\Razer
[02/08/2008|19:37] C:\Program Files\Real
[13/09/2008|16:38] C:\Program Files\Realtek
[25/02/2008|02:40] C:\Program Files\Reference Assemblies
[24/01/2007|21:54] C:\Program Files\Rockstar Games
[13/09/2008|17:40] C:\Program Files\Securitoo
[11/03/2007|20:51] C:\Program Files\SEIKO EPSON Corp
[01/01/2006|18:21] C:\Program Files\Services en ligne
[26/02/2008|02:37] C:\Program Files\Sony
[12/05/2008|21:41] C:\Program Files\Sony Ericsson
[26/02/2008|02:35] C:\Program Files\Sony Setup
[12/09/2008|00:34] C:\Program Files\Spybot - Search & Destroy
[16/04/2008|13:30] C:\Program Files\StuffPlug3
[31/08/2006|22:06] C:\Program Files\Teamspeak2_RC2
[15/04/2008|21:38] C:\Program Files\The KMPlayer FR
[14/09/2008|15:11] C:\Program Files\Trend Micro
[23/04/2008|02:16] C:\Program Files\TuneUp Utilities 2007
[08/09/2008|23:19] C:\Program Files\TVUPlayer
[26/02/2008|02:43] C:\Program Files\Uninstall Information
[29/03/2006|19:52] C:\Program Files\USB Driver-Express
[01/08/2007|00:28] C:\Program Files\uTorrent
[15/11/2006|16:17] C:\Program Files\Valve
[21/04/2007|11:57] C:\Program Files\VCW VicMan's Photo Editor
[31/08/2008|18:08] C:\Program Files\Ventrilo
[02/01/2006|13:57] C:\Program Files\VideoLAN
[09/09/2008|18:27] C:\Program Files\Vista Inspirat 2
[25/06/2008|19:52] C:\Program Files\VistaExperience.org
[26/02/2008|02:38] C:\Program Files\Vstplugins
[07/08/2008|14:33] C:\Program Files\VTFEdit
[15/09/2008|18:11] C:\Program Files\Wanadoo
[23/04/2008|15:35] C:\Program Files\Warcraft III
[13/09/2006|16:08] C:\Program Files\Webteh
[27/07/2008|13:15] C:\Program Files\Winamp
[13/11/2007|19:46] C:\Program Files\Windows Live
[28/07/2008|17:25] C:\Program Files\Windows Live Safety Center
[05/11/2007|04:00] C:\Program Files\Windows Live Toolbar
[26/08/2007|17:23] C:\Program Files\Windows Media Connect 2
[09/09/2008|17:43] C:\Program Files\Windows Media Player
[09/09/2008|17:43] C:\Program Files\Windows NT
[13/06/2007|20:40] C:\Program Files\WindowsUpdate
[01/08/2007|20:25] C:\Program Files\WinRAR
[01/01/2006|18:22] C:\Program Files\xerox
[12/09/2008|08:13] C:\Program Files\Yahoo!
[13/06/2007|21:20] C:\Program Files\Zylom Games

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[25/08/2007|20:09] C:\Program Files\Fichiers communs\Adobe
[04/08/2007|15:07] C:\Program Files\Fichiers communs\Adobe Systems Shared
[04/09/2007|13:56] C:\Program Files\Fichiers communs\Apple
[15/04/2008|21:37] C:\Program Files\Fichiers communs\COWON
[04/03/2007|20:04] C:\Program Files\Fichiers communs\EPSON
[10/04/2006|15:27] C:\Program Files\Fichiers communs\FotoWire
[08/09/2008|20:22] C:\Program Files\Fichiers communs\Futuremark Shared
[29/03/2006|19:52] C:\Program Files\Fichiers communs\InstallShield
[02/01/2006|17:57] C:\Program Files\Fichiers communs\Java
[04/11/2007|20:49] C:\Program Files\Fichiers communs\Logitech
[25/08/2007|19:52] C:\Program Files\Fichiers communs\Macrovision Shared
[06/06/2008|13:02] C:\Program Files\Fichiers communs\Microsoft Shared
[01/01/2006|18:20] C:\Program Files\Fichiers communs\MSSoap
[01/01/2006|18:16] C:\Program Files\Fichiers communs\ODBC
[11/03/2007|20:52] C:\Program Files\Fichiers communs\Python
[02/08/2008|19:38] C:\Program Files\Fichiers communs\Real
[01/01/2006|18:20] C:\Program Files\Fichiers communs\Services
[01/01/2006|18:16] C:\Program Files\Fichiers communs\SpeechEngines
[09/09/2008|17:43] C:\Program Files\Fichiers communs\System
[07/04/2006|18:04] C:\Program Files\Fichiers communs\Vbox
[13/11/2007|19:42] C:\Program Files\Fichiers communs\WindowsLiveInstaller
[31/08/2008|18:06] C:\Program Files\Fichiers communs\Wise Installation Wizard
[02/08/2008|19:38] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 56 Processes )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-15 20:55:31
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 243

--------------------\\ Recherche d'autres infections

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.1.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky_Internet_Security_2009 + Crack.zip.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Sony Vegas 8 Pro + Crack.torrent
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sony.Vegas.v7.0c.Incl.Keygen-SSG.rar
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sonykeygen
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG\keygen.exe
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Toshop CS3\cracktro_totoshop.exe
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers re‡us\Toshop CS3\keygen.exe

[F:16][D:1]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\Temp
[F:9][D:0]-> C:\DOCUME~1\PROPRI~1\Cookies
[F:191][D:4]-> C:\DOCUME~1\PROPRI~1\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 15/09/2008|18:32 - Option : [1]
2 - "C:\Lop SD\LopR_2.txt" - 15/09/2008|20:57 - Option : [3]

--------------------\\ Fin du rapport a 20:57:15
0
Réponse 30 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
bien ... Encore pas mal de crack infecté qu'il faut supprimer !

Télécharges OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
ou http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

Déconnectes toi et fermes toute tes applications en cours .

cliques double sur OTMoveIt.exe pour le lancer.
copies ce qui se trouve en citation ci-dessous,

C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.1.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky_Internet_Security_2009 + Crack.zip.torrent
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Sony Vegas 8 Pro + Crack.torrent
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sony.Vegas.v7.0c.Incl.Keygen-SSG.rar
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sonykeygen
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG\keygen.exe
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Toshop CS3\cracktro_totoshop.exe
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Toshop CS3\keygen.exe

et colles le dans le cadre de gauche de OTMoveIt2 :
Paste standard List of Files/Folders to be moved.

cliques sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.

cliques sur Exit pour fermer.
--->postes le rapport situé dans le dossier " C:\OTMoveIt\MovedFiles." ( c'est un .log )

Note : il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
si c'est le cas acceptes par "Yes".
0
Réponse 31 / 49
Origin
 
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.1.torrent moved successfully.
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky 7.0.0.125 full (working) + keygen (crack).rar.torrent moved successfully.
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Kaspersky_Internet_Security_2009 + Crack.zip.torrent moved successfully.
C:\DOCUME~1\PROPRI~1\Application Data\uTorrent\Sony Vegas 8 Pro + Crack.torrent moved successfully.
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sony.Vegas.v7.0c.Incl.Keygen-SSG.rar moved successfully.
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG moved successfully.
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sonykeygen moved successfully.
File/Folder C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG not found.
File/Folder C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Downloads\Sonykeygen\Sony.Vegas.v7.0c.Incl.Keygen-SSG\­keygen.exe not found.
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Toshop CS3\cracktro_totoshop.exe moved successfully.
C:\DOCUME~1\PROPRI~1\Mes documents\Mes fichiers reçus\Toshop CS3\keygen.exe moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 09152008_211343
0
Réponse 32 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
très bien ... la suite dans l'ordre :

1-Télécharges ToolsCleaner (de A.Rothstein) sur ton Bureau.
http://pc-system.fr/

Déconnectes toi et fermes bien toutes tes applications en cours .

Lances le .
*Cliques sur Recherche et laisses le scan se terminer (cela peut être long).
*Cliques sur Suppression pour finaliser.
*Tu peux, si tu le souhaites, te servir des Options facultatives
*Click sur "quitter" pour générer un rapport :
---> Postes le (TCleaner.txt), il se trouve à la racine de ton disque dur (C:\).

Note : Ce petit soft va te nettoyer tout les trucs dont on c'est servi pour la désinfection .
Supprimes tout les outils , dossiers ou rapports consernant la désinfection que Toolscleaner2 n'a pas supprimé .

( gardes CCleaner et Malwarebytes : très utiles ! )

2- Refais un coup de CCleaner ( registre compris ) .

3- Retélécharges et réinstalles hijackthis ( car supprimé par Toolscleaner2 ) ,

Télécharges et installes le logiciel HijackThis :

ici ftp://ftp.commentcamarche.com/download/HJTInstall.exe
ou ici http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe
ou ici https://www.clubic.com/telecharger-fiche17891-hijackthis.html

-> Cliques sur le setup pour lancer l'installe : laisses toi guider et ne modifies pas les paramètres d'installation .
A la fin de l'installe , le prg ce lance automatiquement : fermes le en cliquant sur la croix rouge .
Au final, tu dois avoir un raccourci sur ton bureau et aussi un cheminement comme :
"C:\ program files\Trend Micro\HijackThis\HijackThis.exe " .

( ne fais pas de scan pour le momment )

4- Purge de la restauration système
*Désactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/coche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC
*Réactives ta restauration :
Cliques droit sur poste de travail/propriétés/Restauration système/décoche la case désactiver la restauration, appliquer, OK
--->Redémarres ton PC

5- Fais ce scan en ligne pour vérifier :

Fais un scan en ligne avec Kaspersky : https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
- Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >.
Le scan ne marche que sous Internet Explorer(et pas sous firefox ou autre...).
- On va te demander de télécharger un contôle active x, accepte .
- Dans le menu Choisissez la cible de l'analyse, sélectionne Poste de travail. Le scan va commencer.
- Sauvegardes le rapport qui sera généré, puis copies/colles le dans ta prochaine réponse pour analyse et attends la suite ...

S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : http://www.inoculer.com/activex.php3
Rappel : le scan est à faire sous Internet Explorer !

--> tuto :
https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566
0
Réponse 33 / 49
Origin
 
re , sa aura pris du temps cette derniere etape et kaspersky na rien trouver et donc ne ma pas fait de rapport :/

voila un screen : http://img140.imageshack.us/img140/8915/rienfn2.png

[ Rapport ToolsCleaner version 2.2.3 (par A.Rothstein & dj QUIOU) ]

-->- Recherche:

C:\VundoFix.txt: trouvé !
C:\Combofix.txt: trouvé !
C:\lopR.txt: trouvé !
C:\SDFIX: trouvé !
C:\Lop SD: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Bureau\VBG.txt: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\SdFix.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\LopSD.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\VirtumundoBeGone.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\OtMoveIt2.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\vundoFix.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Propriétaire\Bureau\SmitFraudfix: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\SdFix.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\LopSD.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\VirtumundoBeGone.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\OtMoveIt2.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\vundoFix.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\HJTInstall.exe: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\SmitFraudFix.exe: supprimé !
C:\VundoFix.txt: supprimé !
C:\Combofix.txt: supprimé !
C:\lopR.txt: supprimé !
C:\Documents and Settings\All Users\Bureau\VBG.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\Lop SD: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\Propriétaire\Bureau\SmitFraudfix: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !
0
Réponse 34 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Impec ... ^^

On finalise ....

A- Mets à jours ce qui suit, c'est important ( des versions pas à jours = failles de sécurité ) :
* Adobe Reader :
télécharges et installes la dernière version ici (désinstalles avant l'ancienne version via son propre prg de désinstallation):
http://www.commentcamarche.net/telecharger/telecharger 27 acrobat reader

B- O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe

C'est un service de FranceTelecom, bien inutile, qui malheureusement est à l'origine de plantage sur certaines machines ... (aucun probleme à l'enlever, tout fonctionnera parfaitement). Il collecte des infos sur ton PC.
Ce service n est pas infectueux mais il peut entrainer des dysfonctionnements sur le systeme! Par ailleurs, il est installé sans le consentement de l utilisateur avec une update de wanadoo!

Et pour exclure se service inutile FTRTSVC, il suffit de faire ainsi:

Clic sur « Démarrer » => « Exécuter » ; ensuite, dans la lucarne de saisie, coller ce qui est en gras ci dessous : (recommencer pour chacune des trois commandes suivantes) :

# 1- sc stop FTRTSVC > valider par OK
# 2- sc config FTRTSVC start= disabled > valider par OK
# 3- sc delete FTRTSVC > valider par OK

--> Quand tu auras fais ces dernieres manips', repostes moi un dernier rapport hijackthis pour analyse et attends la suite ...

0
Réponse 35 / 49
Origin
 
voili voilou :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:48:25, on 16/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file)
O2 - BHO: (no name) - {1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file)
O2 - BHO: (no name) - {17B67DCD-A954-4360-9257-6DA28E41826C} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {37259384-B137-45C4-8170-6261DFCBC02B} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5DA0824A-401D-4AA6-929D-139668B454AD} - (no file)
O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file)
O2 - BHO: (no name) - {81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file)
O2 - BHO: (no name) - {a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file)
O2 - BHO: (no name) - {ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file)
O2 - BHO: (no name) - {BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file)
O2 - BHO: (no name) - {C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file)
O2 - BHO: (no name) - {EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file)
O2 - BHO: (no name) - {F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file)
O2 - BHO: (no name) - {F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file)
O2 - BHO: (no name) - {FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://x-origin-x.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ssqOIXNE - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
0
Réponse 36 / 49
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537
 
Bonjour,

pour suivre
0
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Salut Lyonnais92,

Tu fais bien de suivre ... :-/

Tout les BHO reviennent systémathiquement ainsi que : O20 - Winlogon Notify: ssqOIXNE - C:\WINDOWS\

Une idée ? ... Un driver peut-être ? ....
0
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537 > sKe69 Messages postés 21955 Statut Contributeur sécurité
 
Re,

c'est bien ça qui m'a fait suivre.

Pas de drivers suspect (dixit Combofix).

Une piste : la restauration systématique sur un point de restauration.

Dans l'ordre :

fixer avec Hijackthis

vérifier (do a scan and save a log) et mettre le log dans une réponse

vider la restauration système

prendre un point de restauration

faire redémarrer l'ordi

refaire tourner Hijackthis et mettre le log en réponse.
0
sKe69 Messages postés 21955 Statut Contributeur sécurité 463 > Lyonnais92 Messages postés 25708 Statut Contributeur sécurité
 
Normalement elle a été purgée à l'étape 4 ici :
http://www.commentcamarche.net/forum/affich 8422033 probleme virus virtumonde?page=2#35

???
0
Lyonnais92 Messages postés 25708 Statut Contributeur sécurité 1 537 > sKe69 Messages postés 21955 Statut Contributeur sécurité
 
Re,

certes, mais quel était l'état du registre à ce moment là ?

D'où le passage de Hijackthis juste avant la purge de la restauration.

Mais je ne garantis pas la maneuvre.
0
Réponse 37 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Origin,

Malgré que le scan de Kaspersky soit vierge , j'ai un gros doute au vu du dernier hijackthis ...

Fais ce qui suit stp :

Télécharges ToolBar S&D ( de Eric_71/Team IDN ) :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

( Tuto : https://sites.google.com/site/toolbarsd/aideenimages )

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

* double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ...
* Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil .
* Choisis l'option 1 ( "recherche") et tapes "entrée" .
* Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité
de son contenu dans ta prochaine réponse ...
( le rapport est en outre sauvegardé ici -> C:\TB.txt )
0
Origin
 
Vala le rapport :


-----------\\ ToolBar S&D 1.2.0 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 3
X86-based PC ( Multiprocessor Free : Processeur Intel Pentium III Xeon )
BIOS : Phoenix - AwardBIOS v6.00PG
USER : Propriétaire ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.8.1229 [VPS 080915-0] 4.8.1229 (Activated)
C:\ (Local Disk) - NTFS - Total : 149 Go Free : 82 Go
D:\ (CD or DVD)
E:\ (CD or DVD)
F:\ (CD or DVD)
H:\ (USB)

"C:\ToolBar SD" ( MAJ : 14-09-2008|23:30 )
Option : [1] ( 16/09/2008|13:51 )

-----------\\ Recherche de Fichiers / Dossiers ...


-----------\\ Extensions

(Propri‚taire) - {239c61a8-e55f-11db-8314-0800200c9a66} => blackx-inr
(Propri‚taire) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar
(Propri‚taire) - {5aee7040-9782-11db-b606-0800200c9a66} => chrome
(Propri‚taire) - {635abd67-4fe9-1b23-4f01-e679fa7484c1} => ytoolbar


-----------\\ [..\Internet Explorer\Main]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Local Page"="C:\\windows\\system32\\blank.htm"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Url"="http://www.microsoft.com/athome/community/rss.xml"
"Url"="http://rss.msn.com/en-us/?feedoutput=rss&ocid=iehrs&unsub=true"
"Url"="http://www.microsoft.com/atwork/community/rss.xml"

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
"Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
"Local Page"="C:\\windows\\system32\\blank.htm"
"Start Page"="http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home"


--------------------\\ Recherche d'autres infections


Aucune autre infection trouvée !


1 - "C:\ToolBar SD\TB_1.txt" - 16/09/2008|13:52 - Option : [1]

-----------\\ Fin du rapport a 13:52:42,00
0
Réponse 38 / 49
Origin
 
Dac' jvais faire ça , je tiens a préciser que un message dans un popup dans la barre de tache m'indique qu'il me reste 24 jours pour activer windows ( surement dû au fait que j'ai mis le disk dur dans une nouvelle config. ) je ne sais pas si sa peu répondre a certaine choses voila je reposte avec le rapport ;)
0
Réponse 39 / 49
sKe69 Messages postés 21955 Statut Contributeur sécurité 463
 
Bon ... un coup d'épée dans l'eau ...

1-Télécharges OTMoveIt (de Old_Timer) sur ton Bureau.
http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
ou http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe

Déconnectes toi et fermes toute tes applications en cours .

cliques double sur OTMoveIt.exe pour le lancer.
copies ce qui se trouve en citation ci-dessous,

C:\DOCUME~1\PROPRI~1\APPLIC~1\ZangoToolbar

et colles le dans le cadre de gauche de OTMoveIt2 :
Paste standard List of Files/Folders to be moved.

cliques sur MoveIt! pour lancer la suppression.
le résultat apparaîtra dans le cadre Results.

cliques sur Exit pour fermer.
--->postes le rapport situé dans le dossier " C:\OTMoveIt\MovedFiles." ( c'est un .log )

Note : il te sera peut-être demandé de redémarrer le pc pour achever la suppression.
si c'est le cas acceptes par "Yes".

2- refais un scan hijackthis pour contrôle et postes le rapport ....
0
Réponse 40 / 49
Origin
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:06:41, on 16/09/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Razer\razertra.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\PSIService.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wpabaln.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0E021A26-8A9D-4B2B-8CFC-AAAB2CBE6469} - (no file)
O2 - BHO: (no name) - {1052faf2-81d1-4126-aa6e-c6324601d8c4} - (no file)
O2 - BHO: (no name) - {17B67DCD-A954-4360-9257-6DA28E41826C} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {250DB0B3-DD81-4FDE-9BB1-F324BDF2B133} - (no file)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {37259384-B137-45C4-8170-6261DFCBC02B} - (no file)
O2 - BHO: (no name) - {5DA0824A-401D-4AA6-929D-139668B454AD} - (no file)
O2 - BHO: (no name) - {644D9331-F010-4A1A-99B1-6D2F04622803} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7CA6B7AB-CA50-4BEE-8604-4717A7A526E8} - (no file)
O2 - BHO: (no name) - {81A9D21F-3C1D-4E11-9C15-82F24F911EEF} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {98421408-C454-4CCA-86E8-3329DF8B79E7} - (no file)
O2 - BHO: (no name) - {a3178055-78fa-4cec-bee2-6c41a9a82c6c} - (no file)
O2 - BHO: (no name) - {ABCCDE5B-3792-42FB-BB37-AF15DF246542} - (no file)
O2 - BHO: (no name) - {BC1BE916-EF56-4867-AC7C-4194A0EF541D} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {BE4A7961-27E9-4133-BE20-5671A05DB933} - (no file)
O2 - BHO: (no name) - {C450BD8F-F417-4812-9D22-E8C08F1F0F28} - (no file)
O2 - BHO: (no name) - {EAB83AC3-1405-4366-B464-AAA5D57FA32E} - (no file)
O2 - BHO: (no name) - {F28CADF7-DCD8-40C6-9045-553002A1B7B7} - (no file)
O2 - BHO: (no name) - {F8A94BD6-ACD0-4B08-9843-C0DA5D8AC1BF} - (no file)
O2 - BHO: (no name) - {FD6597DC-EF4F-4C3B-A116-D1C8CDCCEFBE} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Fichiers communs\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [RocketDock] "C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: TransBar.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\TransBar\TransBar.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Startup: Y'z Shadow.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\YzShadow\YzShadow.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Orange - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://x-origin-x.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab47946.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ssqOIXNE - C:\WINDOWS\
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\System32\PSIService.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
0

Discussions similaires

Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses
Désinstaller Softonic
Diguimette -
lilidurhone -

5 réponses
virus Artemis!
mabiche37 -
Malekal_morte- -

14 réponses
Message Apple virus !!
Souclik67 -
MPMP10 -

3 réponses