Virus micro antivirus 2008

Résolu
maryline2108 -  
Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   -
Bonjour,

J'ai besoin d'aide.... J'ai été infecté par le Virus Micro AV.... je suis perdue je ne c pas comment faire. J'ai McAffee comment anti virus mais il ne la pas supprimé...
JE vous remercie par avance pour votre aide.

Une débutante en anti virus.

Maryline
Configuration: Windows XP
Firefox 3.0.1

40 réponses

  • 1
  • 2
Résumé de la discussion

Une utilisatrice signale une infection par le virus MicroAV sur Windows XP (Firefox 3.0.1) malgré McAfee, et cherche des solutions efficaces pour nettoyer le système. Des utilisateurs proposent FindyKill en mode sécurité et des rapports à poster, puis Malwarebytes Anti-Malware avec redémarrage en mode sans échec, et enfin des analyses via Avira et HijackThis. D'autres conseils préconisent la suppression de composants McAfee via sc delete McAfeeFramework, l'élimination d'outils non fiables comme ComboFix et Tools Cleaner, puis l'usage de rapports pour orienter la décontamination. En cas de doute, la discussion souligne l'importance de sauvegarder les rapports et de redémarrer en mode sans échec pour éviter de compromettre les outils de détection.

Bobot (l'IA à votre service)
  1. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Salut,

    - Télécharge HijackThis V 2.02 (HijackThis Installer) :
    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

    - Clique sur Install ensuite sur I Accept

    - Clique sur Do a scan system and save log file

    - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
    0
  2. maryline2108
     
    Merci pour votre réponse rapide.
    J'ai voulu installer votre logiciel et il me met que ce n'est pas un Win32 valide.
    Au secours.......
    0
  3. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Bagle peut-être.

    --> Télécharge FindyKill sur ton bureau :
    http://sd-1.archive-host.com/membres/up/116615172019703188/FindyKill.exe

    --> Lance l'installation avec les paramètres par defaut

    --> Double-clique sur le raccourci FindyKill sur ton bureau

    --> Au menu principal, choisis l'option 1 (Recherche)

    --> Poste le rapport FindyKill.txt

    Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
    0
  4. maryline2108 Messages postés 102 Statut Membre
     
    Voici le resultat

    ----------------- FindyKill V3.095 ------------------

    * User : FAMILY DOLLARD Platform : Windows XP
    * Emplacement : C:\Program Files\FindyKill\FindyKill.exe
    * Outils Mis a jours le 20/09/08 par Chiquitine29
    * Recherche effectuée à 12:34:47 le 20/09/2008

    ----------------- *** Recherche *** ------------------

    »»»» Presence des fichiers dans C:

    »»»» Presence des fichiers dans C:\WINDOWS

    »»»» Presence des fichiers dans C:\WINDOWS\Prefetch

    Present ! - C:\WINDOWS\Prefetch\SETUP.EXE-13EB2E3D.pf
    Present ! - C:\WINDOWS\Prefetch\KEYGEN.EXE-321E87CE.pf

    »»»» Presence des fichiers dans C:\WINDOWS\system32

    »»»» Presence des fichiers dans C:\WINDOWS\system32\drivers

    »»»» Presence des fichiers dans C:\Documents and Settings\FAMILY DOLLARD\Application Data

    »»»» Presence des fichiers dans C:\DOCUME~1\FAMILY~1\LOCALS~1\Temp

    »»»» Registre :

    ! REG.EXE VERSION 3.0

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    ATIPTA REG_SZ "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    RTHDCPL REG_SZ RTHDCPL.EXE
    Alcmtr REG_SZ ALCMTR.EXE
    SynTPLpr REG_SZ C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    SynTPEnh REG_SZ C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    LtMoh REG_SZ C:\Program Files\ltmoh\Ltmoh.exe
    AGRSMMSG REG_SZ AGRSMMSG.exe
    THotkey REG_SZ C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
    Tvs REG_SZ C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
    TPSMain REG_SZ TPSMain.exe
    SmoothView REG_SZ C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    PadTouch REG_SZ C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    DLA REG_SZ C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    CFSServ.exe REG_SZ CFSServ.exe -NoClient
    OpwareSE2 REG_SZ "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
    ShStatEXE REG_SZ "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    McAfeeUpdaterUI REG_SZ "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    \YUR145.exe REG_SZ C:\Windows\system32\YUR145.exe
    \YUR146.exe REG_SZ C:\Windows\system32\YUR146.exe
    \YUR147.exe REG_SZ C:\Windows\system32\YUR147.exe
    \YUR148.exe REG_SZ C:\Windows\system32\YUR148.exe
    ANTIVIRUS REG_SZ C:\Program Files\MicroAV\MicroAV.exe
    \YUR3.exe REG_SZ C:\Windows\system32\YUR3.exe
    \YUR4.exe REG_SZ C:\Windows\system32\YUR4.exe
    \YUR6.exe REG_SZ C:\Windows\system32\YUR6.exe
    \YUR7.exe REG_SZ C:\Windows\system32\YUR7.exe
    BM2bcfe9d1 REG_SZ Rundll32.exe "C:\WINDOWS\system32\owvkgyyb.dll",s
    28fcda4d REG_SZ rundll32.exe "C:\WINDOWS\system32\qjqshldq.dll",b

    HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

    ! REG.EXE VERSION 3.0

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    CTFMON.EXE REG_SZ C:\WINDOWS\system32\ctfmon.exe
    msnmsgr REG_SZ "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    \YUR3.exe REG_SZ C:\Windows\system32\YUR3.exe
    \YUR4.exe REG_SZ C:\Windows\system32\YUR4.exe
    \YUR6.exe REG_SZ C:\Windows\system32\YUR6.exe
    \YUR7.exe REG_SZ C:\Windows\system32\YUR7.exe
    ANTIVIRUS REG_SZ C:\Program Files\MicroAV\MicroAV.exe

    »»»» Presence d infections dans Support amovible :

    ----------- ! Recherche realisée avec success ! -----------
    0

  5. Vous n’avez pas trouvé la réponse que vous recherchez ?

    Posez votre question
  6. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    --> Branche tes disques amovibles à ton PC (clefs USB, disque dur externe, etc...) sans les ouvrir

    --> Double-clique sur le raccourci FindyKill sur ton bureau

    --> Au menu principal, choisis l'option 2 (Suppression)

    /!\ Il y aura 2 redémarrages, laisse travailler l'outil jusqu'à l'apparition du message "nettoyage effectué" /!\

    --> Ensuite, poste le rapport FindyKill.txt

    Note : le rapport FindyKill.txt est sauvegardé à la racine du disque.
    0
  7. maryline2108 Messages postés 102 Statut Membre
     
    je ne possede que une cle USB c un ordi portable... ca va qd meme
    désolée pour c question qui peuvent paraitre bête...
    0
  8. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    Tu peux lancer FindyKill.
    0
  9. maryline2108 Messages postés 102 Statut Membre
     
    CA Y EST JE PEUX A NOUVEAU ACCEDER AU SITE MAIS TJRS LES MM PROBLEMES...
    fichier quality porn + MicroAV + Best zoo Pern..
    je galere que faire....
    je recommence findykill ?

    Merci d'avance
    0
  10. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    - Télécharge et installe MalwareByte's Anti-Malware :
    http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

    - Mets-le à jour

    - Redémarre en mode sans échec (Recommandé) :
    https://www.malekal.com/demarrer-windows-mode-sans-echec/

    - Choisis ta session habituelle

    - Fais un scan complet avec MalwareByte's Anti-Malware

    - Supprime tout ce que le logiciel trouve, enregistre le rapport

    - Redémarre en mode normal et poste le rapport ici
    0
  11. maryline2108 Messages postés 102 Statut Membre
     
    Bjr

    Voila le resultat en sachant que plus rien n'apparait son mon ordi
    Dois-je faire encore quelque chose? Quel anti virus pour pu que ca m'arrive ?

    Malwarebytes' Anti-Malware 1.28
    Version de la base de données: 1182
    Windows 5.1.2600 Service Pack 3

    21/09/2008 07:29:54
    mbam-log-2008-09-21 (07-29-54).txt

    Type de recherche: Examen complet (C:\|)
    Eléments examinés: 82337
    Temps écoulé: 3 hour(s), 46 minute(s), 25 second(s)

    Processus mémoire infecté(s): 0
    Module(s) mémoire infecté(s): 2
    Clé(s) du Registre infectée(s): 17
    Valeur(s) du Registre infectée(s): 42
    Elément(s) de données du Registre infecté(s): 2
    Dossier(s) infecté(s): 1
    Fichier(s) infecté(s): 27

    Processus mémoire infecté(s):
    (Aucun élément nuisible détecté)

    Module(s) mémoire infecté(s):
    C:\WINDOWS\system32\urqRIxur.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\nnnkHbXN.dll (Trojan.Vundo) -> Delete on reboot.

    Clé(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\nnnkhbxn (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7e97de64-94b9-4ecf-9c15-4dde0cad4f15} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{7e97de64-94b9-4ecf-9c15-4dde0cad4f15} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

    Valeur(s) du Registre infectée(s):
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\28fcda4d (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{09c72999-5c10-41a3-a524-24661d942003} (Trojan.Vundo) -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur145.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur146.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur147.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur148.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur6.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur24.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yura.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurd.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur4.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur5.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur6.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur7.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yure.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurf.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur3.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur23.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur24.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yur26.exe (Trojan.Agent) -> Quarantined and deleted successfully.

    Elément(s) de données du Registre infecté(s):
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrixur -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\urqrixur -> Delete on reboot.

    Dossier(s) infecté(s):
    C:\Program Files\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

    Fichier(s) infecté(s):
    C:\WINDOWS\system32\nnnkHbXN.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\urqRIxur.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\ruxIRqru.ini (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\ruxIRqru.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\aaflnjre.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\erjnlfaa.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP43\A0015129.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP45\A0016191.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{7C613A87-BF99-4606-961B-887F813D12F7}\RP45\A0017184.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\nnnnMExV.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\qjqshldq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Program Files\MicroAV\MicroAV.exe (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
    C:\Program Files\MicroAV\MicroAV.ooo (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
    C:\Program Files\MicroAV\MicroAV0.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
    C:\Program Files\MicroAV\MicroAV1.dat (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\YUR145.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\YUR146.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\YUR147.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\YUR148.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\YUR25.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\YUR26.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tdssservers.dat (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\BM2bcfe9d1.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\BM2bcfe9d1.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\x (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\FAMILY DOLLARD\Bureau\BEST ZOO PORN.url (Rogue.Link) -> Quarantined and deleted successfully.
    C:\Documents and Settings\FAMILY DOLLARD\Bureau\QUALITY PORN.url (Rogue.Link) -> Quarantined and deleted successfully.
    0
  12. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    ---> Relance MBAM, va dans Quarantaine et supprime tout

    ---> Fais ceci :

    - Télécharge HijackThis V 2.02 (HijackThis Installer) :
    http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe

    - Fais un double-clic sur HJTInstall.exe afin de lancer l'installation

    - Clique sur Install ensuite sur I Accept

    - Clique sur Do a scan system and save log file

    - Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse.
    0
  13. maryline2108 Messages postés 102 Statut Membre
     
    Voici la reponse

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:30:38, on 21/09/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\acs.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
    C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
    C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
    C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
    C:\Program Files\McAfee\Common Framework\UdaterUI.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\McAfee\Common Framework\McTray.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\LimeWire\LimeWire.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.6play.fr/m6#/choisir-par-genre
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
    O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://maryline2108.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    0
  14. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    ---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
    http://download.bleepingcomputer.com/sUBs/ComboFix.exe

    /!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

    ---> Double-clique sur Combofix.exe
    Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
    Accepte en cliquant sur "Oui"

    ---> Mets-le en langue française F
    Tape sur la touche 1 (Yes) pour démarrer le scan.

    /!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

    En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

    Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

    /!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

    Note : Le rapport se trouve également là : C:\ComboFix.txt
    0
  15. maryline2108 Messages postés 102 Statut Membre
     
    voici la réponse

    ComboFix 08-09-20.05 - FAMILY DOLLARD 2008-09-21 12:38:31.1 - NTFSx86
    Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.192 [GMT 2:00]
    Lancé depuis: C:\Documents and Settings\FAMILY DOLLARD\Bureau\ComboFix.exe
    * Un nouveau point de restauration a été créé

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Administrateur\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
    C:\InfoSat.txt
    C:\WINDOWS\temp\perflib_perfdata_1cc.dat

    .
    ((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_TDSSSERV

    ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-21 au 2008-09-21 ))))))))))))))))))))))))))))))))))))
    .

    2008-09-21 11:30 . 2008-09-21 11:30 <REP> d-------- C:\Program Files\Trend Micro
    2008-09-20 22:59 . 2008-09-20 22:59 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
    2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Malwarebytes
    2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-20 22:17 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-20 22:17 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-20 18:23 . 2008-09-20 18:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-09-20 18:23 . 2008-09-20 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-09-20 18:17 . 2008-09-20 18:17 <REP> d-------- C:\Program Files\Lavasoft
    2008-09-20 18:17 . 2008-09-20 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-09-20 18:16 . 2008-09-20 18:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
    2008-09-20 16:48 . 2008-09-20 17:33 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-20 16:46 . 2008-09-20 16:48 <REP> d-------- C:\Program Files\Trojan Remover
    2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Simply Super Software
    2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
    2008-09-20 16:46 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
    2008-09-20 16:46 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
    2008-09-20 16:46 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
    2008-09-20 16:46 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
    2008-09-20 16:46 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
    2008-09-20 16:42 . 2008-09-20 16:42 65 --a------ C:\WINDOWS\system32\28fcc8c3
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
    2008-09-20 16:34 . 2008-08-28 14:34 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage r‚seau
    2008-09-20 16:34 . 2005-12-09 08:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
    2008-09-20 16:34 . 2005-12-12 12:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\toshiba
    2008-09-20 16:34 . 2005-12-09 12:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
    2008-09-20 16:34 . 2008-09-20 16:34 <REP> d-------- C:\Documents and Settings\Administrateur
    2008-09-20 12:33 . 2008-09-20 14:04 <REP> d-------- C:\Program Files\FindyKill
    2008-09-20 12:07 . 2008-09-20 12:07 97,280 --a------ C:\WINDOWS\system32\owvkgyyb.dll
    2008-09-20 12:06 . 2008-09-20 12:06 257,536 --a------ C:\WINDOWS\system32\jkkiIbYs.dll.vir
    2008-09-19 20:34 . 2008-09-19 20:34 <REP> d-------- C:\Program Files\Windows Media Connect 2
    2008-09-19 20:27 . 2008-09-19 20:27 <REP> d-------- C:\WINDOWS\system32\LogFiles
    2008-09-19 20:27 . 2008-09-19 20:30 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-09-19 19:56 . 2008-09-21 10:47 <REP> d-------- C:\QUARANTINE
    2008-09-19 13:39 . 2008-09-19 13:39 <REP> d--h----- C:\WINDOWS\PIF
    2008-09-19 12:52 . 2008-09-19 12:55 <REP> d-------- C:\Program Files\PhotoFiltre
    2008-09-18 14:44 . 2008-09-18 14:45 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
    2008-09-18 13:50 . 2008-09-18 14:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\AdobeUM
    2008-09-18 13:30 . 2008-09-18 13:30 <REP> d-------- C:\Program Files\Alice
    2008-09-18 13:29 . 2008-09-18 13:29 268 --ah----- C:\sqmdata02.sqm
    2008-09-18 13:29 . 2008-09-18 13:29 244 --ah----- C:\sqmnoopt02.sqm
    2008-09-18 13:23 . 2008-09-18 13:23 268 --ah----- C:\sqmdata01.sqm
    2008-09-18 13:23 . 2008-09-18 13:23 244 --ah----- C:\sqmnoopt01.sqm
    2008-09-16 10:18 . 2008-09-16 10:18 268 --ah----- C:\sqmdata00.sqm
    2008-09-16 10:18 . 2008-09-16 10:18 244 --ah----- C:\sqmnoopt00.sqm
    2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\Fichiers communs\Cisco Systems
    2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-09-12 17:24 . 2006-12-19 15:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
    2008-09-12 17:24 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
    2008-09-12 17:23 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\McAfee
    2008-09-12 17:23 . 2008-09-12 17:23 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
    2008-09-12 17:23 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
    2008-09-12 17:23 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
    2008-09-12 17:23 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
    2008-09-12 17:23 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
    2008-09-12 17:23 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
    2008-09-06 13:59 . 2008-09-12 16:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Canon
    2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr
    2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\bits
    2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\l2schemas
    2008-09-06 11:56 . 2008-09-06 12:01 <REP> d-------- C:\WINDOWS\ServicePackFiles
    2008-09-06 11:48 . 2008-09-06 11:48 <REP> d-------- C:\WINDOWS\EHome
    2008-09-03 15:13 . 2008-09-03 15:13 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Media Player Classic
    2008-09-03 15:11 . 2008-09-03 15:11 <REP> d-------- C:\Program Files\K-Lite Codec Pack
    2008-09-03 14:41 . 2008-09-03 14:41 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\divx_3.22b
    2008-09-01 14:34 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-09-01 14:34 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-09-01 14:34 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-09-01 14:34 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-09-01 14:34 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-09-01 14:34 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-09-01 14:34 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-09-01 14:34 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-09-01 14:34 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-09-01 14:33 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-09-01 14:26 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
    2008-08-31 03:21 . 2008-08-31 03:21 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-08-30 13:44 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-08-30 13:44 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
    2008-08-30 13:44 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-08-29 19:03 . 2008-08-29 19:03 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-29 19:02 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7J.DLL
    2008-08-29 19:02 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-08-29 19:02 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2008-08-29 19:02 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
    2008-08-29 19:02 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7J.DLL
    2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\ScanSoft
    2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanWizard
    2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
    2008-08-29 15:21 . 2008-08-29 15:21 532 --a------ C:\WINDOWS\MAXLINK.INI
    2008-08-29 15:20 . 2008-08-29 15:20 <REP> d-------- C:\Program Files\ScanSoft
    2008-08-29 15:20 . 2008-08-29 15:21 <REP> d-------- C:\Program Files\Fichiers communs\ScanSoft Shared
    2008-08-29 15:12 . 2008-09-10 22:40 <REP> d-------- C:\WINDOWS\CAVTemp
    2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
    2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\CanonMP
    2008-08-29 15:11 . 2005-08-04 03:46 221,184 --a------ C:\WINDOWS\system32\CNCC170.DLL
    2008-08-29 15:11 . 2005-05-30 12:46 139,264 --a------ C:\WINDOWS\system32\CNCL170.DLL
    2008-08-29 15:11 . 2005-08-04 03:46 69,632 --a------ C:\WINDOWS\system32\CNCI170.DLL
    2008-08-29 15:11 . 2005-08-04 03:47 49,152 --a------ C:\WINDOWS\system32\cncisco.dll
    2008-08-29 15:09 . 2008-08-29 15:12 <REP> d-------- C:\Program Files\Canon
    2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
    2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
    2008-08-29 14:29 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Favorites
    2008-08-29 14:28 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Toolbar
    2008-08-29 14:27 . 2008-08-30 00:04 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Contacts
    2008-08-29 14:27 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
    2008-08-29 14:26 . 2008-08-29 14:26 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
    2008-08-29 14:25 . 2008-08-29 14:25 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-08-29 14:21 . 2008-08-31 03:04 <REP> d-------- C:\Program Files\Windows Live
    2008-08-29 14:21 . 2008-08-29 14:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
    2008-08-29 14:20 . 2008-08-29 14:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-08-28 18:05 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-08-28 18:03 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-08-28 18:03 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-08-28 17:14 . 2004-08-04 00:38 327,168 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
    2008-08-28 16:57 . 2008-09-21 12:34 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\LimeWire
    2008-08-28 16:56 . 2008-08-28 16:57 <REP> d-------- C:\Program Files\LimeWire
    2008-08-28 16:50 . 2008-08-28 16:50 0 --a------ C:\WINDOWS\nsreg.dat

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-28 18:18 --------- d-----w C:\Program Files\TOSHIBA
    2008-08-28 18:17 --------- d-----w C:\Program Files\Synaptics
    2008-08-28 18:16 --------- d---a-w C:\Program Files\Offre Wanadoo
    2008-08-28 18:16 --------- d-----w C:\Program Files\Sonic
    2008-08-28 18:16 --------- d-----w C:\Program Files\Services en ligne
    2008-08-28 18:16 --------- d-----w C:\Program Files\Realtek
    2008-08-28 18:14 --------- d-----w C:\Program Files\Microsoft.NET
    2008-08-28 18:13 --------- d-----w C:\Program Files\microsoft frontpage
    2008-08-28 18:13 --------- d-----w C:\Program Files\ltmoh
    2008-08-28 18:12 --------- d-----w C:\Program Files\Java
    2008-08-28 18:12 --------- d-----w C:\Program Files\InterVideo
    2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\Java
    2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
    2008-08-28 18:06 --------- d-----w C:\Program Files\ATI Technologies
    2008-08-28 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI
    2008-08-28 13:57 --------- d-----w C:\Program Files\Symantec
    2008-08-28 13:39 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
    2008-08-28 13:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-08-28 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-28 12:32 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2008-08-28 12:32 --------- d-----w C:\Program Files\Atheros
    2008-07-25 08:34 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
    2008-07-25 08:34 683,520 ----a-w C:\WINDOWS\system32\divx.dll
    2008-07-23 16:50 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
    2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
    2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
    2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
    2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
    2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2008-07-18 20:08 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
    2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
    2008-07-07 20:28 253,952 ----a-w C:\WINDOWS\system32\es.dll
    2008-06-24 16:44 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
    2008-06-24 16:12 295,936 ------w C:\WINDOWS\system32\wmpeffects.dll
    2008-06-23 16:28 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
    "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-19 188416]
    "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-12-08 352256]
    "Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728]
    "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 118784]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-08-30 1077328]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 122940]
    "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
    "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
    "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
    "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-09-15 920144]
    "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 C:\WINDOWS\agrsmmsg.exe]
    "TPSMain"="TPSMain.exe" [2005-08-03 C:\WINDOWS\system32\TPSMain.exe]
    "CFSServ.exe"="CFSServ.exe" [BU]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12"= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys]
    @=""

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

    .
    Contenu du dossier 'Tâches planifiées'
    .
    .
    ------- Examen supplémentaire -------
    .
    FireFox -: Profile - C:\Documents and Settings\FAMILY DOLLARD\Application Data\Mozilla\Firefox\Profiles\6lmz0wdh.default\
    FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava11.dll
    FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava12.dll
    FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava13.dll
    FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava14.dll
    FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJava32.dll
    FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPJPI150_04.dll
    FF -: plugin - C:\Program Files\Java\jre1.5.0_04\bin\NPOJI610.dll
    FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
    FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-21 12:43:50
    Windows 5.1.2600 Service Pack 3 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    .
    ------------------------ Autres processus actifs ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\acs.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
    C:\Program Files\McAfee\Common Framework\Mctray.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\WINDOWS\system32\wscntfy.exe
    .
    **************************************************************************
    .
    Heure de fin: 2008-09-21 12:48:34 - La machine a redémarré
    ComboFix-quarantined-files.txt 2008-09-21 10:48:25

    Avant-CF: 55ÿ989ÿ051ÿ392 octets libres
    Après-CF: 55,961,808,896 octets libres

    275 --- E O F --- 2008-09-20 15:53:01
    0
  16. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    /!\ Seul maryline2108 peut suivre cette procédure /!\

    1/

    ---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

    ---> Copie le texte ci-dessous par sélection puis Ctrl+C :

    KillAll::

    File::
    C:\WINDOWS\system32\tdssinit.dll
    C:\WINDOWS\system32\drivers\TDSSjcxe.sys
    C:\WINDOWS\system32\drivers\tdsserv.sys
    C:\WINDOWS\system32\tdssadw.dll
    C:\WINDOWS\system32\TDSSerrors.log
    C:\WINDOWS\system32\tdssl.dll
    C:\WINDOWS\system32\tdssmain.dll
    C:\WINDOWS\system32\tdssservers.dat
    C:\WINDOWS\system32\epoPGPsdk.dll.sig
    C:\WINDOWS\system32\epoPGPsdk.dll
    C:\WINDOWS\system32\jkkiIbYs.dll.vir
    C:\WINDOWS\system32\owvkgyyb.dll

    Registry::
    [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSserv.sys]

    ---> Colle la sélection dans le bloc-notes

    ---> Enregistre ce fichier sur le bureau (Impératif)

    ---> Nom du fichier : CFScript
    ---> Type du fichier : tous les fichiers
    ---> Clique sur Enregistrer
    ---> Quitte le bloc-notes

    2/

    ---> Redémarre en mode sans échec

    ---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
    http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

    [*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

    [*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
    Ne touche à rien tant que le scan n'est pas terminé.

    [*] Une fois le scan achevé, un rapport va s'afficher : poste-le

    [*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt
    0
  17. maryline2108 Messages postés 102 Statut Membre
     
    voila le resultat

    ComboFix 08-09-20.05 - FAMILY DOLLARD 2008-09-21 13:22:10.2 - NTFSx86 MINIMAL
    Lancé depuis: C:\Documents and Settings\FAMILY DOLLARD\Bureau\ComboFix.exe
    Commutateurs utilisés :: C:\Documents and Settings\FAMILY DOLLARD\Bureau\CFScript.txt

    [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

    FILE ::
    C:\WINDOWS\system32\drivers\tdsserv.sys
    C:\WINDOWS\system32\drivers\TDSSjcxe.sys
    C:\WINDOWS\system32\epoPGPsdk.dll
    C:\WINDOWS\system32\epoPGPsdk.dll.sig
    C:\WINDOWS\system32\jkkiIbYs.dll.vir
    C:\WINDOWS\system32\owvkgyyb.dll
    C:\WINDOWS\system32\tdssadw.dll
    C:\WINDOWS\system32\TDSSerrors.log
    C:\WINDOWS\system32\tdssinit.dll
    C:\WINDOWS\system32\tdssl.dll
    C:\WINDOWS\system32\tdssmain.dll
    C:\WINDOWS\system32\tdssservers.dat
    .

    (((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\epoPGPsdk.dll
    C:\WINDOWS\system32\epoPGPsdk.dll.sig
    C:\WINDOWS\system32\jkkiIbYs.dll.vir
    C:\WINDOWS\system32\owvkgyyb.dll

    .
    ((((((((((((((((((((((((((((( Fichiers créés du 2008-08-21 au 2008-09-21 ))))))))))))))))))))))))))))))))))))
    .

    2008-09-21 11:30 . 2008-09-21 11:30 <REP> d-------- C:\Program Files\Trend Micro
    2008-09-20 22:59 . 2008-09-20 22:59 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
    2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Malwarebytes
    2008-09-20 22:17 . 2008-09-20 22:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-09-20 22:17 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-09-20 22:17 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-09-20 18:23 . 2008-09-20 18:27 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-09-20 18:23 . 2008-09-20 20:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-09-20 18:17 . 2008-09-20 18:17 <REP> d-------- C:\Program Files\Lavasoft
    2008-09-20 18:17 . 2008-09-20 18:19 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-09-20 18:16 . 2008-09-20 18:16 <REP> d-------- C:\Program Files\Fichiers communs\Wise Installation Wizard
    2008-09-20 16:48 . 2008-09-20 17:33 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
    2008-09-20 16:46 . 2008-09-20 16:48 <REP> d-------- C:\Program Files\Trojan Remover
    2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Simply Super Software
    2008-09-20 16:46 . 2008-09-20 16:46 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Simply Super Software
    2008-09-20 16:46 . 2006-05-25 15:52 162,304 --a------ C:\WINDOWS\system32\ztvunrar36.dll
    2008-09-20 16:46 . 2003-02-02 20:06 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
    2008-09-20 16:46 . 2005-08-26 01:50 77,312 --a------ C:\WINDOWS\system32\ztvunace26.dll
    2008-09-20 16:46 . 2002-03-06 01:00 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
    2008-09-20 16:46 . 2006-06-19 13:01 69,632 --a------ C:\WINDOWS\system32\ztvcabinet.dll
    2008-09-20 16:42 . 2008-09-20 16:42 65 --a------ C:\WINDOWS\system32\28fcc8c3
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\WINDOWS
    2008-09-20 16:34 . 2008-08-28 14:34 <REP> d-------- C:\Documents and Settings\Administrateur\Voisinage r‚seau
    2008-09-20 16:34 . 2005-12-09 08:55 <REP> d--h----- C:\Documents and Settings\Administrateur\Voisinage d'impression
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d--h----- C:\Documents and Settings\Administrateur\ModŠles
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Mes documents
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Menu D‚marrer
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> dr------- C:\Documents and Settings\Administrateur\Favoris
    2008-09-20 16:34 . 2005-12-12 12:16 <REP> d-------- C:\Documents and Settings\Administrateur\Bureau
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\toshiba
    2008-09-20 16:34 . 2005-12-09 12:22 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Symantec
    2008-09-20 16:34 . 2008-08-28 19:46 <REP> d-------- C:\Documents and Settings\Administrateur\Application Data\Sonic
    2008-09-20 16:34 . 2008-09-20 16:34 <REP> d-------- C:\Documents and Settings\Administrateur
    2008-09-20 12:33 . 2008-09-20 14:04 <REP> d-------- C:\Program Files\FindyKill
    2008-09-19 20:34 . 2008-09-19 20:34 <REP> d-------- C:\Program Files\Windows Media Connect 2
    2008-09-19 20:27 . 2008-09-19 20:27 <REP> d-------- C:\WINDOWS\system32\LogFiles
    2008-09-19 20:27 . 2008-09-19 20:30 <REP> d-------- C:\WINDOWS\system32\drivers\UMDF
    2008-09-19 19:56 . 2008-09-21 10:47 <REP> d-------- C:\QUARANTINE
    2008-09-19 13:39 . 2008-09-19 13:39 <REP> d--h----- C:\WINDOWS\PIF
    2008-09-19 12:52 . 2008-09-19 12:55 <REP> d-------- C:\Program Files\PhotoFiltre
    2008-09-18 14:44 . 2008-09-18 14:45 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
    2008-09-18 13:50 . 2008-09-18 14:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\AdobeUM
    2008-09-18 13:30 . 2008-09-18 13:30 <REP> d-------- C:\Program Files\Alice
    2008-09-18 13:29 . 2008-09-18 13:29 268 --ah----- C:\sqmdata02.sqm
    2008-09-18 13:29 . 2008-09-18 13:29 244 --ah----- C:\sqmnoopt02.sqm
    2008-09-18 13:23 . 2008-09-18 13:23 268 --ah----- C:\sqmdata01.sqm
    2008-09-18 13:23 . 2008-09-18 13:23 244 --ah----- C:\sqmnoopt01.sqm
    2008-09-16 10:18 . 2008-09-16 10:18 268 --ah----- C:\sqmdata00.sqm
    2008-09-16 10:18 . 2008-09-16 10:18 244 --ah----- C:\sqmnoopt00.sqm
    2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\Fichiers communs\Cisco Systems
    2008-09-12 17:24 . 2008-09-12 17:24 <REP> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-09-12 17:23 . 2008-09-12 17:24 <REP> d-------- C:\Program Files\McAfee
    2008-09-12 17:23 . 2008-09-12 17:23 <REP> d-------- C:\Program Files\Fichiers communs\McAfee
    2008-09-12 17:23 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
    2008-09-12 17:23 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
    2008-09-12 17:23 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
    2008-09-12 17:23 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
    2008-09-12 17:23 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
    2008-09-06 13:59 . 2008-09-12 16:38 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Canon
    2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr
    2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\bits
    2008-09-06 12:00 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\l2schemas
    2008-09-06 11:56 . 2008-09-06 12:01 <REP> d-------- C:\WINDOWS\ServicePackFiles
    2008-09-06 11:48 . 2008-09-06 11:48 <REP> d-------- C:\WINDOWS\EHome
    2008-09-03 15:13 . 2008-09-03 15:13 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\Media Player Classic
    2008-09-03 15:11 . 2008-09-03 15:11 <REP> d-------- C:\Program Files\K-Lite Codec Pack
    2008-09-03 14:41 . 2008-09-03 14:41 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\divx_3.22b
    2008-09-01 14:34 . 2008-06-23 18:28 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-09-01 14:34 . 2007-04-17 11:32 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-09-01 14:34 . 2007-03-08 07:10 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-09-01 14:34 . 2008-06-23 18:28 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-09-01 14:34 . 2008-06-23 18:28 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-09-01 14:34 . 2008-06-23 18:28 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-09-01 14:34 . 2008-06-23 18:28 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-09-01 14:34 . 2008-06-23 18:28 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-09-01 14:34 . 2008-06-23 11:20 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-09-01 14:33 . 2008-09-06 12:00 <REP> d-------- C:\WINDOWS\system32\fr-fr
    2008-09-01 14:26 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
    2008-08-31 03:21 . 2008-08-31 03:21 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-08-30 13:44 . 2008-07-18 22:07 270,880 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-08-30 13:44 . 2008-07-18 22:07 210,976 --a------ C:\WINDOWS\system32\muweb.dll
    2008-08-30 13:44 . 2008-07-18 22:07 29,728 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-08-29 19:03 . 2008-08-29 19:03 <REP> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
    2008-08-29 19:02 . 2005-05-06 22:00 140,288 --a------ C:\WINDOWS\system32\CNMLM7J.DLL
    2008-08-29 19:02 . 2008-04-13 20:45 32,128 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-08-29 19:02 . 2008-04-13 20:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2008-08-29 19:02 . 2008-04-13 20:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
    2008-08-29 19:02 . 2005-05-06 22:00 8,704 --a------ C:\WINDOWS\system32\CNMVS7J.DLL
    2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\ScanSoft
    2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanWizard
    2008-08-29 15:21 . 2008-08-29 15:21 <REP> d-------- C:\Documents and Settings\All Users\Application Data\SSScanAppDataDir
    2008-08-29 15:21 . 2008-08-29 15:21 532 --a------ C:\WINDOWS\MAXLINK.INI
    2008-08-29 15:20 . 2008-08-29 15:20 <REP> d-------- C:\Program Files\ScanSoft
    2008-08-29 15:20 . 2008-08-29 15:21 <REP> d-------- C:\Program Files\Fichiers communs\ScanSoft Shared
    2008-08-29 15:12 . 2008-09-10 22:40 <REP> d-------- C:\WINDOWS\CAVTemp
    2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\WINDOWS\system32\CanonMP Uninstaller Information
    2008-08-29 15:11 . 2008-08-29 15:11 <REP> d--h----- C:\CanonMP
    2008-08-29 15:11 . 2005-08-04 03:46 221,184 --a------ C:\WINDOWS\system32\CNCC170.DLL
    2008-08-29 15:11 . 2005-05-30 12:46 139,264 --a------ C:\WINDOWS\system32\CNCL170.DLL
    2008-08-29 15:11 . 2005-08-04 03:46 69,632 --a------ C:\WINDOWS\system32\CNCI170.DLL
    2008-08-29 15:11 . 2005-08-04 03:47 49,152 --a------ C:\WINDOWS\system32\cncisco.dll
    2008-08-29 15:09 . 2008-08-29 15:12 <REP> d-------- C:\Program Files\Canon
    2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a------ C:\WINDOWS\system32\drivers\SONYPVU1.SYS
    2008-08-29 15:03 . 2001-08-17 21:56 7,552 --a--c--- C:\WINDOWS\system32\dllcache\sonypvu1.sys
    2008-08-29 14:29 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Favorites
    2008-08-29 14:28 . 2008-08-29 14:29 <REP> d-------- C:\Program Files\Windows Live Toolbar
    2008-08-29 14:27 . 2008-08-30 00:04 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Contacts
    2008-08-29 14:27 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
    2008-08-29 14:26 . 2008-08-29 14:26 <REP> d-------- C:\Program Files\Microsoft SQL Server Compact Edition
    2008-08-29 14:25 . 2008-08-29 14:25 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-08-29 14:21 . 2008-08-31 03:04 <REP> d-------- C:\Program Files\Windows Live
    2008-08-29 14:21 . 2008-08-29 14:23 <REP> d--hsc--- C:\Program Files\Fichiers communs\WindowsLiveInstaller
    2008-08-29 14:20 . 2008-08-29 14:20 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-08-28 18:05 . 2008-05-08 16:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
    2008-08-28 18:03 . 2008-04-11 21:05 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2008-08-28 18:03 . 2008-05-01 16:36 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
    2008-08-28 17:14 . 2004-08-04 00:38 327,168 --------- C:\WINDOWS\system32\drivers\ati2mtaa.sys
    2008-08-28 16:57 . 2008-09-21 13:12 <REP> d-------- C:\Documents and Settings\FAMILY DOLLARD\Application Data\LimeWire
    2008-08-28 16:56 . 2008-08-28 16:57 <REP> d-------- C:\Program Files\LimeWire
    2008-08-28 16:50 . 2008-08-28 16:50 0 --a------ C:\WINDOWS\nsreg.dat
    2008-08-28 16:48 . 2008-06-14 19:33 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys
    2008-08-28 16:48 . 2008-06-14 19:33 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-08-28 16:44 . 2008-07-18 22:10 45,768 --a------ C:\WINDOWS\system32\wups2.dll
    2008-08-28 16:44 . 2008-07-18 22:10 38,088 --a------ C:\WINDOWS\system32\wucltui.dll.mui

    .
    (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-28 18:18 --------- d-----w C:\Program Files\TOSHIBA
    2008-08-28 18:17 --------- d-----w C:\Program Files\Synaptics
    2008-08-28 18:16 --------- d---a-w C:\Program Files\Offre Wanadoo
    2008-08-28 18:16 --------- d-----w C:\Program Files\Sonic
    2008-08-28 18:16 --------- d-----w C:\Program Files\Services en ligne
    2008-08-28 18:16 --------- d-----w C:\Program Files\Realtek
    2008-08-28 18:14 --------- d-----w C:\Program Files\Microsoft.NET
    2008-08-28 18:13 --------- d-----w C:\Program Files\microsoft frontpage
    2008-08-28 18:13 --------- d-----w C:\Program Files\ltmoh
    2008-08-28 18:12 --------- d-----w C:\Program Files\Java
    2008-08-28 18:12 --------- d-----w C:\Program Files\InterVideo
    2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\Java
    2008-08-28 18:06 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
    2008-08-28 18:06 --------- d-----w C:\Program Files\ATI Technologies
    2008-08-28 17:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\SBSI
    2008-08-28 13:57 --------- d-----w C:\Program Files\Symantec
    2008-08-28 13:39 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
    2008-08-28 13:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-08-28 13:22 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-08-28 12:32 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
    2008-08-28 12:32 --------- d-----w C:\Program Files\Atheros
    2008-07-18 18:39 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
    .

    ((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
    "msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 344064]
    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-15 98394]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-15 688218]
    "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-05-19 188416]
    "THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2005-12-08 352256]
    "Tvs"="C:\Program Files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728]
    "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 118784]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-08-30 1077328]
    "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-08-01 122940]
    "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 49152]
    "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2007-02-22 112216]
    "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 136768]
    "TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-09-15 920144]
    "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 172544]
    "RTHDCPL"="RTHDCPL.EXE" [2005-11-10 C:\WINDOWS\RTHDCPL.exe]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 C:\WINDOWS\agrsmmsg.exe]
    "TPSMain"="TPSMain.exe" [2005-08-03 C:\WINDOWS\system32\TPSMain.exe]
    "CFSServ.exe"="CFSServ.exe" [BU]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12"= yv12vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
    "C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

    .
    Contenu du dossier 'Tâches planifiées'
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-09-21 13:32:29
    Windows 5.1.2600 Service Pack 3 NTFS

    Recherche de processus cachés ...

    Recherche d'éléments en démarrage automatique cachés ...

    Recherche de fichiers cachés ...

    Scan terminé avec succès
    Fichiers cachés: 0

    **************************************************************************
    .
    Heure de fin: 2008-09-21 13:39:07 - La machine a redémarré
    ComboFix-quarantined-files.txt 2008-09-21 11:38:55
    ComboFix2.txt 2008-09-21 10:48:36

    Avant-CF: 55ÿ964ÿ999ÿ680 octets libres
    Après-CF: 55,952,515,072 octets libres

    237 --- E O F --- 2008-09-20 15:53:01
    0
  19. maryline2108 Messages postés 102 Statut Membre
     
    VOILA LE RESULTAT

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 16:40:49, on 21/09/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\acs.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
    C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
    C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe
    C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\TPSBattM.exe
    C:\Program Files\LimeWire\LimeWire.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Mozilla Firefox\firefox.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.6play.fr/m6#/choisir-par-genre
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
    O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
    O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
    O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient
    O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
    O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
    O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/...
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://maryline2108.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Service de configuration Atheros (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
    O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
    O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    0
  20. maryline2108 Messages postés 102 Statut Membre
     
    qd j'allume mon PC une fenetre s'ouvre
    UdaterUl.exe - Composant introuvable car epoPGPSDK.dll est introuvable.
    .....Kesako ?
    0
  21. Destrio5 Messages postés 99820 Date d'inscription   Statut Modérateur Dernière intervention   10 324
     
    C'est McAfee, tu devrais le virer et installer Antivir à la place.
    0
  • 1
  • 2

Discussions similaires

Chrome://newtab
Nova -
snoopy35_ -

14 réponses
Impossible d'être entendu avec casque-micro Nintendo switch
kardeyo -
crooner76 -

3 réponses
Freebox POP coupure en 2.5gb...
onizuka1000 -
FHL44 -

49 réponses
Softonic,est-ce un virus ?
techmel1 -
techmel1 -

6 réponses