virus"tou have a security problem"

Question

Bonjour à tous. Depuis ce matin un virus s' est installé sur mon ordinateur et j' ai beau tenté de le supprimer à partir d' avast mais cela ne marche pas. je vous explique : j 'ai en fait un icone rouge qui apparait en bas à droite de mon pc et qui me met en message " you have a security problem". De temps en temps une page internet s'ouvre toute seule mais heureusement avast me bloque la connexion sur cette page et cela met mon pc dans tous ses états ( l'alarme d' avast s' enclenche, je tente de supprime le virus trouver, le fameux icone ne disparait pas). Si quelqu' un pouvait m' aider ce serait sympa. bonne journée

toptitbal · Answer

Bonjour

Télécharge le fichier d’installation d’Hijackthis en cliquant sur ce lien 

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

* Enregistre HJTInstall.exe sur ton bureau. 

* Double-clique sur HJTInstall.exe pour lancer le programme

Tuto : https://www.malekal.com/tutoriel-hijackthis/
	http://pagesperso-orange.fr/rginformatique/section%20virus/Hijenr.gif
	http://pagesperso-orange.fr/rginformatique/section%20virus/demohijack.htm

* Accepte la license en cliquant sur le bouton "I Accept"
* Choisis l'option "Do a system scan and save a log file"
* Clique sur "Save log" pour enregistrer le rapport qui s'ouvrira avec le bloc-note
* Clique sur "Edition -> Sélectionner tout", puis sur "Edition -> Copier" pour copier tout le contenu du rapport

* Colle le rapport que tu viens de copier sur ce forum

g!rly · Answer

Salut toptitbal,

Je suis de retour :)

@+

neokaneda · Answer

j'ai eu qq chose de similaire et en faite un .exe c'est installer dans mes temporaire il faut le supprimer et ça devrait allez

pour moi il s'appelait b.exe je l'ai trouvé en passsant par CRTL+ALT+supprime il apparaissait dans les processus j'ai fait clique droit dessus pour le localiser

j'esper que ma réponse t'auras aider

toucco · Answer

bonjour
telecharger, installe et mets a jour ton antivirus et ces 2 logiciels :
spybot : https://www.01net.com/telecharger/windows/Securite/anti-spyware/fiches/26157.html
ccleaner : https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html
ensuite tu redemarre en mode sans echec (toucheF8 ou F12 ou autre en fonction de ta carte mére à l'allumage du pc)
et tu lance un nettoyage complet avec spybot puis cclenear puis ton antivirus.

beto94 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:57:51, on 06/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\UMStor\Res.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Mio Technology\MioSync\mioSync.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Wireless LAN Utility\SiSCFG.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\DOCUME~1\Humberto\LOCALS~1\Temp\video234.cfg
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\DOCUME~1\Humberto\LOCALS~1\Temp\a.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\WINDOWS\UMStor\Res.EXE
O4 - HKLM\..\Run: [ANTIVIRUS] C:\Program Files\SAV\sav.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ANTIVIRUS] C:\Program Files\SAV\sav.exe
O4 - HKCU\..\Run: [MSFox] C:\DOCUME~1\Humberto\LOCALS~1\Temp\video234.cfg.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MioSync.lnk = C:\Program Files\Mio Technology\MioSync\mioSync.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O24 - Desktop Component 0: (no name) - http://81.93.240.201/~wzonfrnf/warez-online/forum/clientscript/vbulletin_global.js

toptitbal · Answer

Imprime ces instructions car il faudra fermer toutes les fenêtres et applications lors de l'installation et de l'analyse. 

Télécharge Malwarebytes' Anti-Malware (MBAM) et enregistre-le sur ton Bureau à partir de ce lien : 

http://www.commentcamarche.net/telecharger/telechargement 34055379 malwarebyte s anti malware

A la fin du téléchargement, ferme toutes les fenêtres et programmes, y compris celui-ci. 

Double-clique sur l'icône Download_mbam-setup.exe sur ton bureau pour démarrer le programme d'installation. 

Pendant l'installation, suis les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet). N'apporte aucune modification aux réglages par défaut et, en fin d'installation, vérifie que les options Update Malwarebytes' Anti-Malware et Launch Malwarebytes' Anti-Malware sont cochées. 

Redémarre ton ordinateur en mode sans échec

Relance MBAM grâce au raccourci présent sur ton bureau.
 
Dans l'onglet analyse, vérifie que "Exécuter un examen complet" est coché et clique sur le bouton Rechercher pour démarrer l'analyse. 

MBAM analyse ton ordinateur. L'analyse peut prendre un certain temps. Il suffit de vérifier de temps en temps son avancement. 

A la fin de l'analyse, un message s'affiche indiquant la fin de l'analyse. Clique sur OK pour poursuivre. 

Si des malwares ont été détectés, leur liste s'affiche. 
En cliquant sur Suppression (?) , MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine. 

MBAM va ouvrir le Bloc-notes et y copier le rapport d'analyse. Ferme le Bloc-notes. (Le rapport peut être retrouvé sous l'onglet Rapports/logs) 

Ferme MBAM en cliquant sur Quitter. 

Poste le rapport dans ta réponse

beto94 · Answer

désolé de ne repondre que maintenant mais le scan a duré plus longtemps que je ne le pensais. voilà le rapport du scan rendu par MBAM




Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1232
Windows 5.1.2600 Service Pack 2

06/10/2008 13:14:41
mbam-log-2008-10-06 (13-14-36).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 141767
Temps écoulé: 53 minute(s), 4 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 3
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 10

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.SystemAntivirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.SystemAntivirus) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSFox (Trojan.FakeAlert) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings\Humberto\Local Settings\Temporary Internet Files\Content.IE5\47QKTHPA\ropotok[1].cc (Trojan.Agent) -> No action taken.
C:\Program Files\eChanblard\EvID4226Patch.exe (Adware.Agent) -> No action taken.
C:\Program Files\SAV\SAV.exe (Rogue.SystemAntivirus) -> No action taken.
C:\WINDOWS\system32\SAV.cpl (Rogue.SystemAntivirus2008) -> No action taken.
C:\Program Files\SAV\SAV.cpl (Rogue.SystemAntivirus) -> No action taken.
C:\Program Files\SAV\sav0.dat (Rogue.SystemAntivirus) -> No action taken.
C:\Program Files\SAV\sav1.dat (Rogue.SystemAntivirus) -> No action taken.
C:\Program Files\SAV\sav.ooo (Rogue.SystemAntivirus) -> No action taken.
C:\Documents and Settings\Humberto\Local Settings\Temp\video234.cfg.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Humberto\Local Settings\Temp\video234.cfg (Trojan.FakeAlert) -> No action taken.

g!rly · Answer

Salut

Supprime bien tout ce que malwarebytes a trouvé.

car la ca dit > No action taken il n´a donc rien supprimé...

Une fois la suppressions des fichiers acceptés click sur l´onglet quarantaine et supprime les fichiers qui sont dedant.

Puis post un nouveau rapport hijak this stp

@+

beto94 · Answer

oui désolé. en fait pour t' expliquer il y a un rapport qui m' est apparu et ensuite j' ai supprimé tout ce que Malware a trouvé. enfin bref...
voilà le nouveau rapport de Hijackthis :


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:40:57, on 06/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\UMStor\Res.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Mio Technology\MioSync\mioSync.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Wireless LAN Utility\SiSCFG.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\WINDOWS\UMStor\Res.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MioSync.lnk = C:\Program Files\Mio Technology\MioSync\mioSync.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O24 - Desktop Component 0: (no name) - http://81.93.240.201/~wzonfrnf/warez-online/forum/clientscript/vbulletin_global.js

g!rly · Answer

salut beto94, 

je pensais que toptibal aurait continué ?

passe ceci stp

Télécharge Lop S&D (de Angeldark et Eric71) sur le Bureau :
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

[*]Double-clique sur Lop S&D.exe pour lancer l'installation,
[*]Puis double-clique sur le raccourci Lop S&D présent sur le Bureau.
[*]Séléctionne la langue souhaitée , puis choisis l'Option 1 (Recherche)
Le scan prend moins d'une minute.
[*]A l'issue du scan, le bloc-notes va s'ouvrir avec le résultat de la recherche.
[*]Enregistre le rapport LopR.txt sur le Bureau pour le retrouver facilement, sinon il sauvegardé à la racine de la partition système : C:\LopR.txt

@+

beto94 · Answer

c'est pas grave girly :). depuis hier je n'ai déjà plus de souci avec le virus. c'est dejà très gentil de sa part de m'avoir aidé. je te poste tout de même le rapport résultant du scan LOPSD :

  --------------------\  Lop S&D 4.2.4-5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : Humberto ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1201 [VPS 081006-0] 4.8.1201 (Activated)
   C:\ (Local Disk) - NTFS - Total : 186 Go Free : 80 Go
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
   Option : [1] ( 07/10/2008|16:44 )
 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [04/12/2007|15:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [14/07/2007|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [20/03/2008|15:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [25/09/2008|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [30/08/2007|20:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
   [27/11/2006|20:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5
   [15/01/2008|11:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [08/05/2006|14:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
   [07/10/2008|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TVU Networks
   [28/05/2006|17:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [29/08/2007|11:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [17/03/2008|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [29/08/2007|11:33] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [14/02/2008|13:34] C:\DOCUME~1\Humberto\APPLIC~1\Adobe
   [07/02/2006|00:53] C:\DOCUME~1\Humberto\APPLIC~1\ATI
   [04/10/2006|14:40] C:\DOCUME~1\Humberto\APPLIC~1\BearShare
   [30/11/2007|19:46] C:\DOCUME~1\Humberto\APPLIC~1\BSplayer
   [30/11/2007|19:40] C:\DOCUME~1\Humberto\APPLIC~1\BSplayer Pro
   [21/02/2006|00:34] C:\DOCUME~1\Humberto\APPLIC~1\DeepBurner
   [07/03/2006|17:15] C:\DOCUME~1\Humberto\APPLIC~1\dvdcss
   [17/09/2006|20:59] C:\DOCUME~1\Humberto\APPLIC~1\Google
   [24/05/2006|01:28] C:\DOCUME~1\Humberto\APPLIC~1\Help
   [06/02/2006|01:46] C:\DOCUME~1\Humberto\APPLIC~1\Identities
   [15/01/2008|02:17] C:\DOCUME~1\Humberto\APPLIC~1\IDMComp
   [26/05/2006|16:06] C:\DOCUME~1\Humberto\APPLIC~1\InterTrust
   [12/11/2007|09:55] C:\DOCUME~1\Humberto\APPLIC~1\Lavasoft
   [07/02/2006|14:09] C:\DOCUME~1\Humberto\APPLIC~1\Macromedia
   [20/03/2008|15:15] C:\DOCUME~1\Humberto\APPLIC~1\Malwarebytes
   [17/03/2006|01:30] C:\DOCUME~1\Humberto\APPLIC~1\Media Player Classic
   [08/05/2008|16:25] C:\DOCUME~1\Humberto\APPLIC~1\Microsoft
   [29/08/2007|12:12] C:\DOCUME~1\Humberto\APPLIC~1\MSNInstaller
   [24/02/2008|14:52] C:\DOCUME~1\Humberto\APPLIC~1\OpenOffice.org2
   [17/10/2006|20:09] C:\DOCUME~1\Humberto\APPLIC~1\ppStream
   [28/08/2008|15:12] C:\DOCUME~1\Humberto\APPLIC~1\Real
   [27/11/2006|20:52] C:\DOCUME~1\Humberto\APPLIC~1\River Past G5
   [25/02/2006|22:42] C:\DOCUME~1\Humberto\APPLIC~1\Sun
   [06/02/2006|01:59] C:\DOCUME~1\Humberto\APPLIC~1\Symantec
   [06/03/2008|19:54] C:\DOCUME~1\Humberto\APPLIC~1\TVU networks
   [04/12/2007|15:24] C:\DOCUME~1\Humberto\APPLIC~1\vlc

   [29/03/2007|16:09] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [24/02/2008|18:19] C:\DOCUME~1\Marco\APPLIC~1\Adobe
   [07/02/2006|11:51] C:\DOCUME~1\Marco\APPLIC~1\ATI
   [26/10/2006|12:13] C:\DOCUME~1\Marco\APPLIC~1\Google
   [14/02/2006|15:32] C:\DOCUME~1\Marco\APPLIC~1\Help
   [06/02/2006|02:26] C:\DOCUME~1\Marco\APPLIC~1\Identities
   [07/02/2006|12:50] C:\DOCUME~1\Marco\APPLIC~1\Macromedia
   [27/06/2006|14:11] C:\DOCUME~1\Marco\APPLIC~1\Media Player Classic
   [17/07/2007|20:38] C:\DOCUME~1\Marco\APPLIC~1\Microsoft
   [06/02/2006|02:39] C:\DOCUME~1\Marco\APPLIC~1\MSNInstaller
   [24/11/2007|17:40] C:\DOCUME~1\Marco\APPLIC~1\OpenOffice.org2
   [04/07/2006|10:21] C:\DOCUME~1\Marco\APPLIC~1\Real
   [09/02/2006|18:06] C:\DOCUME~1\Marco\APPLIC~1\Sun

   [06/02/2006|01:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [07/10/2008 11:16][--ah-----] C:\WINDOWS	asks\SA.DAT
   [05/08/2004 14:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [26/05/2006|16:05] C:\Program Files\802.11 Wireless LAN
   [26/05/2006|16:06] C:\Program Files\Adobe
   [08/05/2006|14:22] C:\Program Files\Alwil Software
   [28/05/2006|17:38] C:\Program Files\Ashampoo
   [21/02/2006|01:32] C:\Program Files\Astonsoft
   [07/02/2006|00:47] C:\Program Files\ATI Technologies
   [07/03/2008|14:37] C:\Program Files\Audacity
   [05/09/2006|00:59] C:\Program Files\AviSynth 2.5
   [14/03/2006|15:12] C:\Program Files\CDBurnerXP Pro 3
   [06/02/2006|01:36] C:\Program Files\ComPlus Applications
   [07/10/2008|11:24] C:\Program Files\eChanblard
   [20/04/2006|18:36] C:\Program Files\Encarta
   [14/03/2008|10:07] C:\Program Files\Fichiers communs
   [29/05/2006|02:41] C:\Program Files\FreeGo
   [15/03/2007|20:41] C:\Program Files\Fritivi
   [24/05/2006|01:28] C:\Program Files\GoldWave
   [04/12/2007|15:11] C:\Program Files\Google
   [09/01/2008|18:31] C:\Program Files\GRETECH
   [20/02/2006|19:23] C:\Program Files\HP
   [15/01/2008|02:17] C:\Program Files\IDM Computer Solutions
   [22/07/2007|00:37] C:\Program Files\INFORAD
   [22/07/2007|00:37] C:\Program Files\INFORAD_DRIVERS
   [02/10/2008|16:27] C:\Program Files\InstallShield Installation Information
   [29/08/2008|02:08] C:\Program Files\Internet Explorer
   [17/01/2008|01:09] C:\Program Files\Java
   [12/11/2007|09:55] C:\Program Files\Lavasoft
   [14/07/2007|20:45] C:\Program Files\Logitech
   [12/11/2007|12:08] C:\Program Files\Macrogaming
   [07/10/2008|11:59] C:\Program Files\Malwarebytes' Anti-Malware
   [17/03/2008|20:30] C:\Program Files\Messenger
   [31/08/2007|02:37] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [11/02/2006|12:57] C:\Program Files\Microsoft Encarta
   [06/02/2006|01:41] C:\Program Files\microsoft frontpage
   [25/02/2008|20:06] C:\Program Files\Microsoft Office
   [25/02/2008|20:05] C:\Program Files\Microsoft Visual Studio
   [11/06/2008|00:59] C:\Program Files\Microsoft Works
   [20/04/2006|18:16] C:\Program Files\Microsoft Works Suite 2005
   [25/02/2008|20:04] C:\Program Files\Microsoft.NET
   [21/07/2007|22:08] C:\Program Files\Mio DigiWalker
   [21/07/2007|23:52] C:\Program Files\Mio Technology
   [06/02/2006|01:37] C:\Program Files\Movie Maker
   [29/08/2007|12:12] C:\Program Files\MSN
   [06/02/2006|01:36] C:\Program Files\MSN Gaming Zone
   [29/08/2007|11:34] C:\Program Files\MSN Messenger
   [18/08/2007|01:34] C:\Program Files\MSXML 4.0
   [18/08/2007|21:25] C:\Program Files\MyXOFT
   [21/03/2008|00:22] C:\Program Files\Navilog1
   [06/02/2006|01:37] C:\Program Files\NetMeeting
   [06/02/2006|01:36] C:\Program Files\Online Services
   [29/11/2007|23:22] C:\Program Files\OpenOffice.org 2.0
   [25/02/2008|20:15] C:\Program Files\OpenOffice.org 2.3
   [14/06/2007|00:53] C:\Program Files\Outlook Express
   [05/09/2006|00:09] C:\Program Files\Oxilog
   [22/03/2008|21:28] C:\Program Files\Panda Security
   [20/04/2006|18:35] C:\Program Files\Picture It! Premium 10
   [17/10/2006|20:43] C:\Program Files\PPStream
   [04/12/2007|15:00] C:\Program Files\Radio Fr Solo
   [28/05/2006|17:08] C:\Program Files\Real
   [24/05/2006|01:22] C:\Program Files\RM to MP3 Converter
   [01/10/2008|19:52] C:\Program Files\Samsung
   [17/03/2006|01:30] C:\Program Files\Satsuki Decoder Pack
   [06/10/2008|13:14] C:\Program Files\SAV
   [06/02/2006|01:38] C:\Program Files\Services en ligne
   [06/02/2006|02:10] C:\Program Files\SiS162u
   [06/09/2008|19:54] C:\Program Files\SopCast
   [21/07/2007|20:57] C:\Program Files\Sports Interactive
   [15/01/2008|11:37] C:\Program Files\Spybot - Search & Destroy
   [03/04/2006|16:21] C:\Program Files\SUPREME TOOLBAR
   [20/03/2008|18:20] C:\Program Files\Trend Micro
   [05/03/2008|21:41] C:\Program Files\TVAnts
   [07/10/2008|12:14] C:\Program Files\TVUPlayer
   [06/02/2006|01:46] C:\Program Files\Uninstall Information
   [02/10/2008|16:27] C:\Program Files\USB Disk Win98 Driver
   [04/12/2007|15:23] C:\Program Files\VideoLAN
   [30/11/2007|19:46] C:\Program Files\Webteh
   [07/07/2008|13:05] C:\Program Files\Winamp
   [29/08/2007|11:34] C:\Program Files\Windows Live
   [17/03/2008|13:21] C:\Program Files\Windows Media Connect 2
   [29/03/2007|16:07] C:\Program Files\Windows Media Player
   [06/02/2006|01:36] C:\Program Files\Windows NT
   [06/02/2006|01:38] C:\Program Files\WindowsUpdate
   [28/05/2006|17:41] C:\Program Files\WinPcap
   [30/09/2006|14:49] C:\Program Files\WinRAR
   [06/02/2006|02:10] C:\Program Files\Wireless LAN Utility
   [06/02/2006|01:41] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [27/05/2006|21:35] C:\Program Files\Fichiers communs\Adobe
   [04/03/2007|21:27] C:\Program Files\Fichiers communs\Designer
   [20/02/2006|19:22] C:\Program Files\Fichiers communs\Hewlett-Packard
   [20/02/2006|19:18] C:\Program Files\Fichiers communs\HP
   [14/02/2006|15:18] C:\Program Files\Fichiers communs\InstallShield
   [06/02/2006|01:40] C:\Program Files\Fichiers communs\Java
   [14/07/2007|20:44] C:\Program Files\Fichiers communs\Logitech
   [09/07/2008|00:34] C:\Program Files\Fichiers communs\Microsoft Shared
   [06/02/2006|01:37] C:\Program Files\Fichiers communs\MSSoap
   [06/02/2006|12:30] C:\Program Files\Fichiers communs\ODBC
   [28/05/2006|17:08] C:\Program Files\Fichiers communs\Real
   [06/02/2006|01:37] C:\Program Files\Fichiers communs\Services
   [06/02/2006|12:30] C:\Program Files\Fichiers communs\SpeechEngines
   [25/02/2008|20:05] C:\Program Files\Fichiers communs\System
   [17/03/2008|20:38] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [28/05/2006|17:08] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 59 Processes )

   IEXPLORE.EXE ~ [PID:2828]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\DOCUME~1\Humberto\Cookies\humberto@advertstream[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@gulfnews.advertserve[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@adultfriendfinder[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@advertising[2].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@ero-advertising[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@adin.bigpoint[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@bigpoint[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@fr.seafight.bigpoint[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@fr1.darkorbit.bigpoint[2].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@fr1.seafight.bigpoint[2].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@adopt.euroclick[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@partygaming.122.2o7[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@partypoker[2].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@fr.seafight.bigpoint[1].txt
   C:\DOCUME~1\Humberto\Cookies\humberto@fr1.seafight.bigpoint[2].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-10-07 16:45:15
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 505
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Humberto\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\crack.au-b2a731c-3cd002c0.au
   C:\DOCUME~1\Humberto\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\crack.au-b2a731c-3cd002c0.idx
   C:\DOCUME~1\Humberto\Cookies\humberto@crackxxiem.skyrock[1].txt


   [F:1619][D:18]-> C:\DOCUME~1\Humberto\LOCALS~1\Temp
   [F:2478][D:0]-> C:\DOCUME~1\Humberto\Cookies
   [F:12789][D:39]-> C:\DOCUME~1\Humberto\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 07/10/2008|16:48 - Option : [1]

   --------------------\  Fin du rapport a 16:48:25

toptitbal · Answer

Pardon beto94, c'est vrai que je t'avais un peu oublié.
J'ai quelques topiks qui ont mystérieusement disparus de "Mes interventions" depuis hier...

g!rly va bien te soigner, c'est l'avantage du travail en équipe, il y a toujours quelqu'un qui peut prendre le relais.

P.S. Oh les vilains cracks que tu as, veux-tu m'enlever ça tout de suite ;-)))

g!rly · Answer

Re, 

c´est pas tout a fait propre...

* Télécharge OTMoveIt2 (de Old_Timer) sur ton bureau : http://download.bleepingcomputer.com/oldtimer/OTMoveIt2.exe
* Double-clique sur OTMoveIt.exe pour lancer le programme,
* Copie la liste de fichiers ou de dossiers ci-dessous et colle-la dans la fenêtre du programme "Paste Custom List of Files/Folders to Move" :

C:\WINDOWS	asks\SA.DAT
C:\Program Files\SAV
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
C:\DOCUME~1\Humberto\APPLIC~1\Symantec
C:\DOCUME~1\Humberto\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\crack.au-b2a731c-3cd002c0.au
C:\DOCUME~1\Humberto\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\crack.au-b2a731c-3cd002c0.idx
C:\DOCUME~1\Humberto\Cookies\humberto@crackxxiem.skyrock[1].txt

* Clique sur MoveIt! pour lancer la suppression,
* Le résultat appraraîtra dans le cadre Results.
* Clique sur Exit pour fermer le programme.
* Poste le rapport qui est situé ici : C:\\_OTMoveIt\MovedFiles
* Il te sera peut-être demandé de redémarrer ton PC. Dans ce cas, clique sur Yes.

puis passe l´option 2 de lopsd

donc post le rapport de ot_move it, celui de lopsd (option2) puis un nouveau rapport hijack this stp

@+

beto94 · Answer

alors on procède par étape : tout d'abord le rapport otmoveit :

C:\WINDOWS	asks\SA.DAT moved successfully.
C:\Program Files\SAV moved successfully.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec\LiveSubscribe moved successfully.
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec moved successfully.
C:\DOCUME~1\Humberto\APPLIC~1\Symantec\Shared\Sessions moved successfully.
C:\DOCUME~1\Humberto\APPLIC~1\Symantec\Shared moved successfully.
C:\DOCUME~1\Humberto\APPLIC~1\Symantec moved successfully.
C:\DOCUME~1\Humberto\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\crack.au-b2a731c-3cd002c0.au moved successfully.
C:\DOCUME~1\Humberto\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\crack.au-b2a731c-3cd002c0.idx moved successfully.
< C:\DOCUME~1\Humberto\Cookies\humberto@crackxxiem.skyrock[1].txt >
C:\DOCUME~1\Humberto\Cookies\humberto@crackxxiem.skyrock[1].txt moved successfully.
 
OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 10072008_170624




ensuite le rapport lop sd :


   --------------------\  Lop S&D 4.2.4-5   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : AMD Athlon(tm) 64 X2 Dual Core Processor 3800+ )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : Humberto ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1201 [VPS 081006-0] 4.8.1201 (Activated)
   C:\ (Local Disk) - NTFS - Total : 186 Go Free : 80 Go
   D:\ (CD or DVD)

   "C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
   Option : [2] ( 07/10/2008|17:14 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@advertstream[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@gulfnews.advertserve[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@adultfriendfinder[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@advertising[2].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@ero-advertising[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@adin.bigpoint[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@bigpoint[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@fr.seafight.bigpoint[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@fr1.darkorbit.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@fr1.seafight.bigpoint[2].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@adopt.euroclick[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@partygaming.122.2o7[1].txt
   Supprime! - C:\DOCUME~1\Humberto\Cookies\humberto@partypoker[2].txt
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [04/12/2007|15:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [14/07/2007|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Logitech
   [20/03/2008|15:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [25/09/2008|12:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [30/08/2007|20:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
   [27/11/2006|20:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\River Past G5
   [15/01/2008|11:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [07/10/2008|12:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TVU Networks
   [28/05/2006|17:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [29/08/2007|11:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WindowsLiveInstaller
   [17/03/2008|20:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller

   [29/08/2007|11:33] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [14/02/2008|13:34] C:\DOCUME~1\Humberto\APPLIC~1\Adobe
   [07/02/2006|00:53] C:\DOCUME~1\Humberto\APPLIC~1\ATI
   [04/10/2006|14:40] C:\DOCUME~1\Humberto\APPLIC~1\BearShare
   [30/11/2007|19:46] C:\DOCUME~1\Humberto\APPLIC~1\BSplayer
   [30/11/2007|19:40] C:\DOCUME~1\Humberto\APPLIC~1\BSplayer Pro
   [21/02/2006|00:34] C:\DOCUME~1\Humberto\APPLIC~1\DeepBurner
   [07/03/2006|17:15] C:\DOCUME~1\Humberto\APPLIC~1\dvdcss
   [17/09/2006|20:59] C:\DOCUME~1\Humberto\APPLIC~1\Google
   [24/05/2006|01:28] C:\DOCUME~1\Humberto\APPLIC~1\Help
   [06/02/2006|01:46] C:\DOCUME~1\Humberto\APPLIC~1\Identities
   [15/01/2008|02:17] C:\DOCUME~1\Humberto\APPLIC~1\IDMComp
   [26/05/2006|16:06] C:\DOCUME~1\Humberto\APPLIC~1\InterTrust
   [12/11/2007|09:55] C:\DOCUME~1\Humberto\APPLIC~1\Lavasoft
   [07/02/2006|14:09] C:\DOCUME~1\Humberto\APPLIC~1\Macromedia
   [20/03/2008|15:15] C:\DOCUME~1\Humberto\APPLIC~1\Malwarebytes
   [17/03/2006|01:30] C:\DOCUME~1\Humberto\APPLIC~1\Media Player Classic
   [08/05/2008|16:25] C:\DOCUME~1\Humberto\APPLIC~1\Microsoft
   [29/08/2007|12:12] C:\DOCUME~1\Humberto\APPLIC~1\MSNInstaller
   [24/02/2008|14:52] C:\DOCUME~1\Humberto\APPLIC~1\OpenOffice.org2
   [17/10/2006|20:09] C:\DOCUME~1\Humberto\APPLIC~1\ppStream
   [28/08/2008|15:12] C:\DOCUME~1\Humberto\APPLIC~1\Real
   [27/11/2006|20:52] C:\DOCUME~1\Humberto\APPLIC~1\River Past G5
   [25/02/2006|22:42] C:\DOCUME~1\Humberto\APPLIC~1\Sun
   [06/03/2008|19:54] C:\DOCUME~1\Humberto\APPLIC~1\TVU networks
   [04/12/2007|15:24] C:\DOCUME~1\Humberto\APPLIC~1\vlc

   [29/03/2007|16:09] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [24/02/2008|18:19] C:\DOCUME~1\Marco\APPLIC~1\Adobe
   [07/02/2006|11:51] C:\DOCUME~1\Marco\APPLIC~1\ATI
   [26/10/2006|12:13] C:\DOCUME~1\Marco\APPLIC~1\Google
   [14/02/2006|15:32] C:\DOCUME~1\Marco\APPLIC~1\Help
   [06/02/2006|02:26] C:\DOCUME~1\Marco\APPLIC~1\Identities
   [07/02/2006|12:50] C:\DOCUME~1\Marco\APPLIC~1\Macromedia
   [27/06/2006|14:11] C:\DOCUME~1\Marco\APPLIC~1\Media Player Classic
   [17/07/2007|20:38] C:\DOCUME~1\Marco\APPLIC~1\Microsoft
   [06/02/2006|02:39] C:\DOCUME~1\Marco\APPLIC~1\MSNInstaller
   [24/11/2007|17:40] C:\DOCUME~1\Marco\APPLIC~1\OpenOffice.org2
   [04/07/2006|10:21] C:\DOCUME~1\Marco\APPLIC~1\Real
   [09/02/2006|18:06] C:\DOCUME~1\Marco\APPLIC~1\Sun

   [06/02/2006|01:44] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [05/08/2004 14:00][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [26/05/2006|16:05] C:\Program Files\802.11 Wireless LAN
   [26/05/2006|16:06] C:\Program Files\Adobe
   [08/05/2006|14:22] C:\Program Files\Alwil Software
   [28/05/2006|17:38] C:\Program Files\Ashampoo
   [21/02/2006|01:32] C:\Program Files\Astonsoft
   [07/02/2006|00:47] C:\Program Files\ATI Technologies
   [07/03/2008|14:37] C:\Program Files\Audacity
   [05/09/2006|00:59] C:\Program Files\AviSynth 2.5
   [14/03/2006|15:12] C:\Program Files\CDBurnerXP Pro 3
   [06/02/2006|01:36] C:\Program Files\ComPlus Applications
   [07/10/2008|11:24] C:\Program Files\eChanblard
   [20/04/2006|18:36] C:\Program Files\Encarta
   [14/03/2008|10:07] C:\Program Files\Fichiers communs
   [29/05/2006|02:41] C:\Program Files\FreeGo
   [15/03/2007|20:41] C:\Program Files\Fritivi
   [24/05/2006|01:28] C:\Program Files\GoldWave
   [04/12/2007|15:11] C:\Program Files\Google
   [09/01/2008|18:31] C:\Program Files\GRETECH
   [20/02/2006|19:23] C:\Program Files\HP
   [15/01/2008|02:17] C:\Program Files\IDM Computer Solutions
   [22/07/2007|00:37] C:\Program Files\INFORAD
   [22/07/2007|00:37] C:\Program Files\INFORAD_DRIVERS
   [02/10/2008|16:27] C:\Program Files\InstallShield Installation Information
   [29/08/2008|02:08] C:\Program Files\Internet Explorer
   [17/01/2008|01:09] C:\Program Files\Java
   [12/11/2007|09:55] C:\Program Files\Lavasoft
   [14/07/2007|20:45] C:\Program Files\Logitech
   [12/11/2007|12:08] C:\Program Files\Macrogaming
   [07/10/2008|11:59] C:\Program Files\Malwarebytes' Anti-Malware
   [17/03/2008|20:30] C:\Program Files\Messenger
   [31/08/2007|02:37] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [11/02/2006|12:57] C:\Program Files\Microsoft Encarta
   [06/02/2006|01:41] C:\Program Files\microsoft frontpage
   [25/02/2008|20:06] C:\Program Files\Microsoft Office
   [25/02/2008|20:05] C:\Program Files\Microsoft Visual Studio
   [11/06/2008|00:59] C:\Program Files\Microsoft Works
   [20/04/2006|18:16] C:\Program Files\Microsoft Works Suite 2005
   [25/02/2008|20:04] C:\Program Files\Microsoft.NET
   [21/07/2007|22:08] C:\Program Files\Mio DigiWalker
   [21/07/2007|23:52] C:\Program Files\Mio Technology
   [06/02/2006|01:37] C:\Program Files\Movie Maker
   [29/08/2007|12:12] C:\Program Files\MSN
   [06/02/2006|01:36] C:\Program Files\MSN Gaming Zone
   [29/08/2007|11:34] C:\Program Files\MSN Messenger
   [18/08/2007|01:34] C:\Program Files\MSXML 4.0
   [18/08/2007|21:25] C:\Program Files\MyXOFT
   [21/03/2008|00:22] C:\Program Files\Navilog1
   [06/02/2006|01:37] C:\Program Files\NetMeeting
   [06/02/2006|01:36] C:\Program Files\Online Services
   [29/11/2007|23:22] C:\Program Files\OpenOffice.org 2.0
   [25/02/2008|20:15] C:\Program Files\OpenOffice.org 2.3
   [14/06/2007|00:53] C:\Program Files\Outlook Express
   [05/09/2006|00:09] C:\Program Files\Oxilog
   [22/03/2008|21:28] C:\Program Files\Panda Security
   [20/04/2006|18:35] C:\Program Files\Picture It! Premium 10
   [17/10/2006|20:43] C:\Program Files\PPStream
   [04/12/2007|15:00] C:\Program Files\Radio Fr Solo
   [28/05/2006|17:08] C:\Program Files\Real
   [24/05/2006|01:22] C:\Program Files\RM to MP3 Converter
   [01/10/2008|19:52] C:\Program Files\Samsung
   [17/03/2006|01:30] C:\Program Files\Satsuki Decoder Pack
   [06/02/2006|01:38] C:\Program Files\Services en ligne
   [06/02/2006|02:10] C:\Program Files\SiS162u
   [06/09/2008|19:54] C:\Program Files\SopCast
   [21/07/2007|20:57] C:\Program Files\Sports Interactive
   [15/01/2008|11:37] C:\Program Files\Spybot - Search & Destroy
   [03/04/2006|16:21] C:\Program Files\SUPREME TOOLBAR
   [20/03/2008|18:20] C:\Program Files\Trend Micro
   [05/03/2008|21:41] C:\Program Files\TVAnts
   [07/10/2008|12:14] C:\Program Files\TVUPlayer
   [06/02/2006|01:46] C:\Program Files\Uninstall Information
   [02/10/2008|16:27] C:\Program Files\USB Disk Win98 Driver
   [04/12/2007|15:23] C:\Program Files\VideoLAN
   [30/11/2007|19:46] C:\Program Files\Webteh
   [07/07/2008|13:05] C:\Program Files\Winamp
   [29/08/2007|11:34] C:\Program Files\Windows Live
   [17/03/2008|13:21] C:\Program Files\Windows Media Connect 2
   [29/03/2007|16:07] C:\Program Files\Windows Media Player
   [06/02/2006|01:36] C:\Program Files\Windows NT
   [06/02/2006|01:38] C:\Program Files\WindowsUpdate
   [28/05/2006|17:41] C:\Program Files\WinPcap
   [30/09/2006|14:49] C:\Program Files\WinRAR
   [06/02/2006|02:10] C:\Program Files\Wireless LAN Utility
   [06/02/2006|01:41] C:\Program Files\xerox

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [27/05/2006|21:35] C:\Program Files\Fichiers communs\Adobe
   [04/03/2007|21:27] C:\Program Files\Fichiers communs\Designer
   [20/02/2006|19:22] C:\Program Files\Fichiers communs\Hewlett-Packard
   [20/02/2006|19:18] C:\Program Files\Fichiers communs\HP
   [14/02/2006|15:18] C:\Program Files\Fichiers communs\InstallShield
   [06/02/2006|01:40] C:\Program Files\Fichiers communs\Java
   [14/07/2007|20:44] C:\Program Files\Fichiers communs\Logitech
   [09/07/2008|00:34] C:\Program Files\Fichiers communs\Microsoft Shared
   [06/02/2006|01:37] C:\Program Files\Fichiers communs\MSSoap
   [06/02/2006|12:30] C:\Program Files\Fichiers communs\ODBC
   [28/05/2006|17:08] C:\Program Files\Fichiers communs\Real
   [06/02/2006|01:37] C:\Program Files\Fichiers communs\Services
   [06/02/2006|12:30] C:\Program Files\Fichiers communs\SpeechEngines
   [25/02/2008|20:05] C:\Program Files\Fichiers communs\System
   [17/03/2008|20:38] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [28/05/2006|17:08] C:\Program Files\Fichiers communs\xing shared

   --------------------\  Process

   ( 57 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-10-07 17:15:31
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 505
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Humberto\Local Settings\Temporary Internet Files\Content.IE5\1HXS972K\Crack_(informatique)[1].htm


   [F:1619][D:18]-> C:\DOCUME~1\Humberto\LOCALS~1\Temp
   [F:2465][D:0]-> C:\DOCUME~1\Humberto\Cookies
   [F:13063][D:39]-> C:\DOCUME~1\Humberto\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 07/10/2008|16:48 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 07/10/2008|17:17 - Option : [2]

   --------------------\  Fin du rapport a 17:17:08





et enfin le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:22:39, on 07/10/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Logitech\QuickCam10\QuickCam10.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\UMStor\Res.EXE
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Mio Technology\MioSync\mioSync.exe
C:\Program Files\Fichiers communs\Logitech\LComMgr\LVComSX.exe
C:\Program Files\Wireless LAN Utility\SiWake.exe
C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe
C:\Program Files\Logitech\QuickCam10\COCIManager.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Wireless LAN Utility\SiSCFG.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jucheck.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.01net.com/telecharger/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.01net.com/telecharger/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\Logitech\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\WINDOWS\UMStor\Res.EXE
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ATI CATALYST System Tray.lnk = C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MioSync.lnk = C:\Program Files\Mio Technology\MioSync\mioSync.exe
O4 - Global Startup: SiWake.lnk = C:\Program Files\Wireless LAN Utility\SiWake.exe
O4 - Global Startup: Wireless Configuration Utility HW.32.lnk = ?
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Organise-notes - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/FR-FR/a-UNO1/GAME_UNO1.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcappcapd.exe
O23 - Service: SiS WirelessLan Service (SiSWLSvc) - Unknown owner - C:\Program Files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe
O24 - Desktop Component 0: (no name) - http://81.93.240.201/~wzonfrnf/warez-online/forum/clientscript/vbulletin_global.js

g!rly · Answer

Ok

bien joué :)

supprime encore ceci avec ot_move it :

C:\DOCUME~1\Humberto\Local Settings\Temporary Internet Files\Content.IE5\1HXS972K\Crack_(informatique)[1].htm

tu copie la ligne ci dessus ect... comme tout a l´heure :)

puis a l´aide de hijack this coche et fix :

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot 
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') 
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

comment fixer :

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

puis passe encore :

Télécharge Clean:

-> http://www.malekal.com/download/clean.zip

-> Dézippe tout le contenu dans un dossier que tu auras cré au préalable (sur ton bureau par exemple). Double clic sur clean ou clean.cmd choisie l'option 1.
   
   Un rapport va s'ouvrir, copie et colle le contenu sur le forum.

-> pour ceux ou celles qui auraient un doute sur comment deziper un fichier :

   http://www.tutopat.com/viewtopic.php?t=933&sid=34215b238376bfb22ef9e8eca9995914

ps : si on te demande d´envoyer un fichier sur le site de malekal ne le fait pas, contente toi de suivre les indications de la fenetre noir (cmd)

@+

Virus"tou have a security problem"

15 réponses

Votre réponse

Discussions similaires

Newsletters