Je pense que c'est un virus Résolu

Question

Bonjour, j'ai exactement le même problème avec msn, il envoie "hey you got a photo album? anyways heres my new photo album :) accept k?" à mes contacts. Est j'ai fais le truc avec Hijack est sa ma donner sa:-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:29:10 PM, on 10/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20861)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\CTSvcCDA.exe
c:\docume~1\home\locals~1	emp\cdm\{4a9aaaac-eee3-429d-b7f3-775a61566db2}\STacSV.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\News\NewsUpd.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\WINDOWS\V0420Mon.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\home\LOCALS~1\Temp\Rar$EX00.172\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\SrchAstt\1.bin\MWSSRCAS.DLL (file missing)
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\Documents and Settings\home\dldckh.exe \o
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL (file missing)
O4 - HKLM\..\Run: [NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [pdn] C:\WINDOWS\system32\pdn.exe \j
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
O8 - Extra context menu item: Download with ImTOO Download YouTube Video - C:\Program Files\ImTOO\Download YouTube Video\upod_link.HTM
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB9D5A95-7C09-4BDA-8B40-41FE3AB98CC3}: NameServer = 202.123.2.35 202.123.2.11
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - c:\docume~1\home\locals~1	emp\cdm\{4a9aaaac-eee3-429d-b7f3-775a61566db2}\STacSV.exe

Destrio5 · Answer

Salut,

- Télécharge MSNFix.zip (de !aur3n7) sur le bureau: 
http://sosvirus.changelog.fr/MSNFix.zip 

- Décompresse-le (clic droit >> Extraire ici).

- Double-clique sur le fichier MSNFix.bat. 

- Exécute l'option R. 
Si l'infection est détectée, un message l'indiquera et il suffira de presser une touche pour lancer le nettoyage 

Note : Si une erreur de suppression est détectée un message s'affichera demandant de redémarrer l'ordinateur afin de terminer les opérations. Dans ce cas il suffit de redémarrer l'ordinateur en mode normal. 

- Le rapport sera enregistré dans le même dossier que MSNFix sous forme date_heure.t, poste-le.

Bauzau · Answer

Bonjour,j'ai telecharger MSNFIX.zip est j'ai fait un right click (click droit) est je fais extrac to the specified folder, est j'ai double cliquer sur msnfix...Mais y a rien qui ce passe est je ne comprend pas exactement quand tu me dis exécute l'option R, Aide moi S.T.P

Destrio5 · Answer

---> Télécharge Toolbar S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

* Lance l'installation du programme en exécutant le fichier téléchargé.
* Double-clique maintenant sur le raccourci de Toolbar-S&D.
* Sélectionne la langue souhaitée en tapant la lettre de ton choix puis en validant avec la touche Entrée.
* Choisis maintenant l'option 1 (Recherche). Patiente jusqu'à la fin de la recherche.
* Poste le rapport généré. (C:\TB.txt)

Bauzau · Answer

Salut Destrio 5,voici mon rappord 

 -----------\  ToolBar S&D 1.2.2   XP/Vista

   Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) D CPU 2.80GHz )
   BIOS : Default System BIOS
   USER : home ( Administrator )
   BOOT : Normal boot
   Antivirus : AVG 7.5.524 7.5.524 (Activated)
   C:\ (Local Disk) - NTFS - Total : 149 Go Free : 132 Go
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
   Option : [1] ( Tue 10/14/2008|15:18 )

   -----------\  Recherche de Fichiers / Dossiers ...

   [Service] MyWebSearchService
   C:\DOCUME~1\home\APPLIC~1\FunWebProducts
   C:\DOCUME~1\home\APPLIC~1\FunWebProducts\Data
   C:\Program Files\FunWebProducts
   C:\Program Files\FunWebProducts\ScreenSaver
   C:\Program Files\FunWebProducts\Shared
   C:\Program Files\Fun Web Products
   C:\Program Files\Fun Web Products\MSNMessenger
   C:\DOCUME~1\home\Cookies\home@myway[1].txt
   C:\Program Files\MyWebSearch
   C:\Program Files\MyWebSearch\bar
   C:\Program Files\MyWebSearch\SrchAstt
   C:\DOCUME~1\home\Cookies\home@mywebsearch[1].txt
   C:\WINDOWS\System32\f3PSSavr.scr
   C:\Program Files\Internet Explorer\msimg32.dll
   C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll

   -----------\  [..\Internet Explorer\Main]

Destrio5 · Answer

---> Redémarre en mode sans échec :
https://blog.sosordi.net/

---> Relance ToolBar S&D, fais l'option 2 et poste le rapport.

Bauzau · Answer

Voici le rapport,j'espère que je l'ai bien fais 

 -----------\  ToolBar S&D 1.2.2   XP/Vista

   Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) D CPU 2.80GHz )
   BIOS : Default System BIOS
   USER : home ( Administrator )
   BOOT : Normal boot
   Antivirus : AVG 7.5.524 7.5.524 (Activated)
   C:\ (Local Disk) - NTFS - Total : 149 Go Free : 132 Go
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
   Option : [1] ( Wed 10/15/2008|16:57 )

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\MyWebSearch
   C:\Program Files\MyWebSearch\bar

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="http://home.jhoos.com/"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - Tue 10/14/2008|15:19 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - Wed 10/15/2008|16:43 - Option : [2]
   3 - "C:\ToolBar SD\TB_3.txt" - Wed 10/15/2008|16:59 - Option : [1]

   -----------\  Fin du rapport a 16:59:27.75

Destrio5 · Answer

Non, désolé.

Bauzau · Answer

Que dois-je faire dans ce cas :-)

Destrio5 · Answer

Retente :
http://www.commentcamarche.net/forum/affich 8859734 je pense que c est un virus?#5

Bauzau · Answer

Mais quand je clique sur le lien que tu ma donner ,je tombe sur un autre forum

Destrio5 · Answer

Non, tu tombes sur mon message précédent.

---> Redémarre en mode sans échec :
https://blog.sosordi.net/

---> Relance ToolBar S&D, fais l'option 2 et poste le rapport.

Bauzau · Answer

Quand je redemar en "safe mode" j'ai plus access a l'internet !!!

Destrio5 · Answer

C'est normal mais tu t'en fiches puisque tu fais l'option 2 de ToolBar S&D puis tu enregistres le rapport.

Bauzau · Answer

Je pense que je l'ai bien fais maintenant a toi de me dire :-)

----------\  ToolBar S&D 1.2.2   XP/Vista

   Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3
   X86-based PC ( Multiprocessor Free :               Intel(R) Pentium(R) D CPU 2.80GHz )
   BIOS : Default System BIOS
   USER : home ( Administrator )
   BOOT : Fail-safe boot
   Antivirus : AVG 7.5.524 7.5.524 (Not Activated)
   C:\ (Local Disk) - NTFS - Total : 149 Go Free : 132 Go
   D:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 04-10-2008|21:00 )
   Option : [2] ( Wed 10/15/2008|18:03 )

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\MyWebSearch\bar
   Supprime! - C:\Program Files\MyWebSearch

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\WINDOWS\system32\blank.htm"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="http://home.jhoos.com/"
   "Url"="http://www.microsoft.com/athome/community/rss.xml"
   "Url"="http://www.microsoft.com/atwork/community/rss.xml"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="https://www.msn.com/fr-fr/"


   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !


   1 - "C:\ToolBar SD\TB_1.txt" - Tue 10/14/2008|15:19 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - Wed 10/15/2008|16:43 - Option : [2]
   3 - "C:\ToolBar SD\TB_3.txt" - Wed 10/15/2008|16:59 - Option : [1]
   4 - "C:\ToolBar SD\TB_4.txt" - Wed 10/15/2008|18:04 - Option : [2]

   -----------\  Fin du rapport a 18:04:44.75

Destrio5 · Answer

C'est OK.

---> Supprime ToolBar S&D et le dossier ToolBar SD situé dans C:\

- Télécharge et installe MalwareByte's Anti-Malware :
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.htm

- Mets-le à jour

- Redémarre en mode sans échec (Recommandé) :
https://blog.sosordi.net/

- Choisis ta session habituelle

- Fais un scan complet avec MalwareByte's Anti-Malware

- Supprime tout ce que le logiciel trouve, enregistre le rapport

- Redémarre en mode normal et poste le rapport ici

Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

Bauzau · Answer

J'ai fais tout ce que tu ma dis j'ai supprimer tout le fichier affecter qu'il ma donner, sa a pris plus qu'une heure temps est j'avais plus que 160 truc affecter ,je les ai "Save" mais le truc que j'arrive pas a le retrouver . :-) Dans ce cas comment savoir si c'est bon maintenant ?

Bauzau · Answer

Non je vois que sa continue de faire la même chose

Destrio5 · Answer

Fais un scan rapide.

Bauzau · Answer

Voila le rapport du scan rapide 

Malwarebytes' Anti-Malware 1.28
Version de la base de données: 1275
Windows 5.1.2600 Service Pack 3

10/16/2008 7:28:56 PM
mbam-log-2008-10-16 (19-28-56).txt

Type de recherche: Examen rapide
Eléments examinés: 42142
Temps écoulé: 7 minute(s), 24 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 135
Valeur(s) du Registre infectée(s): 7
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 21
Fichier(s) infecté(s): 42

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\funwebproducts.datacontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{c8cecde3-1ae1-4c4a-ad82-6d5b00212144} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17de5e5e-bfe3-4e83-8e1f-8755795359ec} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1f52a5fa-a705-4415-b975-88503b291728} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{a626cdbd-3d13-4f78-b819-440a28d7e8fc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.datacontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{8ca01f0e-987c-49c3-b852-2f1ac4a7094c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{1093995a-ba37-41d2-836e-091067c4ad17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{120927bf-1700-43bc-810f-fab92549b390} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{247a115f-06c2-4fb3-967d-2d62d3cf4f0a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e53e2cb-86db-4a4a-8bd9-ffeb7a64df82} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{90449521-d834-4703-bb4e-d3aa44042ff8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{991aac62-b100-47ce-8b75-253965244f69} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bbabdc90-f3d5-4801-863a-ee6ae529862d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{d6ff3684-ad3b-48eb-bbb4-b9e6c5a355c1} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{eb9e5c1c-b1f9-4c2b-be8a-27d6446fdaf8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0f8ecf4f-3646-4c3a-8881-8e138ffcaf70} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b813095c-81c0-4e40-aa14-67520372b987} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c9d7be3e-141a-4c85-8cd6-32461f3df2c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cff4ce82-3aa2-451f-9b77-7165605fb835} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historykillerscheduler.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.historyswattercontrolbar.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e47caee0-deea-464a-9326-3f2801535a4d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e1656ed-f60e-4597-b6aa-b6a58e171495} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.htmlmenu.2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.iecookiesmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.killerobjmanager.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{8e6f1830-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2b-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{63d0ed2d-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8e6f1832-9607-4440-8530-13be7c4b1d14} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a9571378-68a1-443d-b082-284f960c6d17} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswatterbarbutton.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproducts.popswattersettingscontrol.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{e79dfbc0-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{72ee7f04-15bd-4845-a005-d6711144d86a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbc9-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{e79dfbca-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.chatsessionplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{3e720450-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720451-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{3e720453-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3e720452-b472-4954-b7aa-33069eb53906} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{adb01e81-3c79-4272-a0f1-7b2be7a782dc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.outlookaddin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{7473d290-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d291-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d293-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d295-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{7473d297-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d292-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7473d294-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7473d296-b7bb-4f24-ae82-7e2ce94bb6a9} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearchtoolbar.toolbarplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{29d67d3c-509a-4544-903f-c8c1b8236554} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e3537fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{938aa51a-996c-4884-98ce-80dd16a5c9da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\screensavercontrol.screensaverinstaller.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{07b18eaa-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{07b18eac-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{6e74766c-4d93-4cc0-96d1-47b8e07ff9ca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{de38c398-b328-4f4c-a3ad-1b5e4ed93477} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e342af55-b78a-4cd0-a2bb-da7f52d9d25f} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{f87d7fb5-9dc5-4c8c-b998-d8dfe02e2978} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1E0DE227-5CE4-4ea3-AB0C-8B03E1AA76BC} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{53ced2d0-5e9a-4761-9005-648404e6f7e5} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{9afb8248-617f-460d-9366-d71cdeda3179} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d9fffb27-d62a-4d64-8cec-1ff006528805} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{0d26bc71-a633-4e71-ad31-eadc3a1b6a3a} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{07b18ea0-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{f42228fb-e84e-479e-b922-fbbd096e792c} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mywebsearchservice (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\mywebsearchservice (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mywebsearchservice (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyWebSearch bar Uninstall (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Outlook\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Word\Addins\MyWebSearch.OutlookAddin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch email plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mywebsearch plugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\my web search bar search scope monitor (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Media\WMSDK\Sources\f3PopularScreensavers (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Avatar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Game (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Message\COMMON (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Notifier (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\SrchAstt (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\SrchAstt\1.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\101x135 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\Cache (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\f3PSSavr.scr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\1.bin\_MWSBAR.DLL (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\CM.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\MFC.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\PSS.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\WB.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Cache\files.ini (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Destrio5 · Answer

---> Relance MBAM, va dans Quarantaine et supprime tout.

---> Fais la manip' avec MSNFix.

Bauzau · Answer

Que veux tu dire par Relance MBAM ?

Destrio5 · Answer

Tu l'ouvres.

Bauzau · Answer

Excuse moi mais tu veux dire l'antivirus Malware ?

Destrio5 · Answer

MalwareByte's Anti-Malware

Bauzau · Answer

Sa me dis "please unzip MSN.fix"

Destrio5 · Answer

https://www.malekal.com/supprimer-virus-desinfecter-pc/

Bauzau · Answer

Mais quand sa deviens sur un fond bleu ,sa me dis "erreur erreur erreur"  ECHO is off

Destrio5 · Answer

Essaie ceci :
http://www.clubic.com/telecharger-fiche239998-clean-virus-msn.html

Bauzau · Answer

Sa dis aucun fichier infecter détecté

Destrio5 · Answer

Mais tu as toujours des problèmes sur MSN ?

Bauzau · Answer

Attend je vais voir

Bauzau · Answer

Oui c'est toujours pareil est sa m'énerve :-(

Bauzau · Answer

Tu na aucune idée qu'es que je pourrais faire ?

Destrio5 · Answer

Essaie MSNFix en mode sans échec :
https://blog.sosordi.net/

Bauzau · Answer

Sa me donne une liste mais y a pas de rapport est je peux même pas faire un copier coller

Destrio5 · Answer

Comment ça, une liste ?

Bauzau · Answer

Bon je vais essayer de les écrire

Destrio5 · Answer

Tu parles de quoi, melquior ?

Bauzau · Answer

famille IRCBot [>400 varientes]
famille Sdbot [>300 varientes]
famille small [>800 varientes]
famille downloader [>1000 varientes]

Des truc comme sa il y en a beaucoup encore

Bauzau · Answer

Tu pense que je dois delete mon msn est redownload un ?

Bauzau · Answer

Que dois-je faire dans ce cas?

Bauzau · Answer

Mais la vraiment sa fais peur :-) qu'es que je dois faire ?

Bauzau · Answer

AVG c'est mon antivirus

Bauzau · Answer

S.V.P dites moi ce que je dois faire

Destrio5 · Answer

A quoi tu joues melquior ????

Bauzau · Answer

Franchement je sais plu quoi faire

Destrio5 · Answer

C'est à cause de melquior qui débarque comme ça.

Destrio5 · Answer

Quel lien ???

Bauzau · Answer

Est-ce que c'est mieux de delete mon msn est redownload un autre ?

Bauzau · Answer

Tu veux dire sa "Télécharge MSNFix.zip (de !aur3n7) sur le bureau: "  ?

Destrio5 · Answer

Va te coucher melquior.

Bauzau ---> Voici une procédure.

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix\Combofix.txt

Bauzau · Answer

ok

melquior · Answer

ton lien sosvirus.nsmfix envoie un worm avec une configuration sous vista ca te rafraichie la memoire destro dodo militaire et gendarme ca peut etre outrage destro

Bauzau · Answer

Voici le rapport ComboFix 08-10-15.08 - home 2008-10-16 23:33:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.187 [GMT 1:00] Running from: C:\Documents and Settings\home\Desktop\ComboFix.exe * Created a new restore point [COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\home\Application Data\FunWebProducts C:\Program Files\FunWebProducts C:\Program Files\FunWebProducts\ScreenSaver\Cache\files.ini C:\Program Files\internet explorer\msimg32.dll C:\Program Files\MyWebSearch C:\Program Files\MyWebSearch\bar\1.bin\_MWSBAR.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR C:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE C:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL C:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST C:\Program Files\MyWebSearch\bar\1.bin\M3HIGHIN.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3MEDINT.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST C:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL C:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE C:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE C:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE C:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL C:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL C:\Program Files\MyWebSearch\bar\1.bin\MWSSVC.EXE C:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL C:\Program Files\MyWebSearch\bar\Cache\files.ini C:\Program Files\MyWebSearch\bar\icons\CM.ICO C:\Program Files\MyWebSearch\bar\icons\MFC.ICO C:\Program Files\MyWebSearch\bar\icons\PSS.ICO C:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO C:\Program Files\MyWebSearch\bar\icons\WB.ICO C:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO C:\WINDOWS\system32\f3PSSavr.scr . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MYWEBSEARCHSERVICE -------\Service_MyWebSearchService ((((((((((((((((((((((((( Files Created from 2008-09-16 to 2008-10-16 ))))))))))))))))))))))))))))))) . 2008-10-15 19:51 . 2008-10-15 19:51 d-------- C:\Documents and Settings\home\Application Data\Malwarebytes 2008-10-15 19:50 . 2008-10-16 22:20 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-15 19:50 . 2008-10-15 19:50 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-15 18:36 . 2008-10-15 18:36 d-------- C:\Program Files\AxBx 2008-10-15 18:10 . 2008-10-15 18:11 d-------- C:\Program Files\Fun Web Products 2008-10-15 05:46 . 2008-09-15 13:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-14 15:19 . 2008-10-15 18:04 1,966 --a------ C:\Documents and Settings\Orph.egd 2008-10-14 15:18 . 2008-10-15 18:04 d-------- C:\ToolBar SD 2008-10-13 18:09 . 2008-10-13 18:23 0 --a------ C:\WINDOWS\system32 mp.MSNFix 2008-10-12 14:48 . 2008-10-14 21:20 d-------- C:\Program Files\Windows Live Safety Center 2008-10-11 22:52 . 2008-10-16 23:39 d-------- C:\Documents and Settings\home\Tracing 2008-10-11 22:42 . 2008-10-11 22:42 d-------- C:\Program Files\Microsoft 2008-10-11 22:33 . 2008-10-11 22:33 d-------- C:\Program Files\Common Files\Windows Live 2008-10-11 13:17 . 2008-10-16 22:23 d-------- C:\Program Files\AdVantage 2008-10-11 13:15 . 2008-10-11 13:18 d-------- C:\Program Files\Jhoos 2008-10-11 13:15 . 2003-10-06 22:39 26,694 --a------ C:\WINDOWS\system32\customercare.ico 2008-10-11 13:15 . 2003-10-06 22:40 26,694 --a------ C:\WINDOWS\system32\cableguy.ico 2008-10-11 13:15 . 2003-10-06 22:37 26,694 --a------ C:\WINDOWS\system32\about.ico 2008-10-11 13:15 . 2001-10-13 01:06 10,134 --a------ C:\WINDOWS\system32 ubely.ico 2008-10-10 22:45 . 2008-10-07 10:01 19,968 --a------ C:\WINDOWS\system32\pdn.exe 2008-10-10 22:45 . 2008-10-07 10:01 19,968 ---h----- C:\Documents and Settings\home\dldckh.exe 2008-10-05 20:06 . 2008-10-05 20:06 d-------- C:\Program Files\Common Files\Ulead Systems 2008-10-05 20:06 . 1998-12-08 18:53 212,480 --------- C:\WINDOWS\system32\PCDLIB32.DLL 2008-10-05 20:06 . 2005-08-04 18:54 40,960 --------- C:\WINDOWS\system32\Ulead Photo Express ScreenSaver.scr 2008-10-05 20:05 . 2008-10-05 20:05 d-------- C:\Program Files\Ulead Systems 2008-10-05 20:04 . 2008-10-05 20:04 d-------- C:\Documents and Settings\home\Application Data\Ulead Systems 2008-10-05 20:04 . 2008-10-05 20:08 d-------- C:\Documents and Settings\All Users\Application Data\Ulead Systems 2008-10-05 19:58 . 2008-10-05 19:58 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-10-05 19:52 . 2008-10-05 19:52 d-------- C:\Program Files\Morpheus Photo Morpher 2008-10-05 19:52 . 2008-10-05 19:52 d-------- C:\Documents and Settings\home\Application Data\Morpheus Software 2008-10-05 15:01 . 2008-10-05 22:47 d-------- C:\Documents and Settings\home\Application Data\gtk-2.0 2008-10-05 15:01 . 2008-10-05 15:01 d-------- C:\Documents and Settings\home\.thumbnails 2008-10-05 14:56 . 2008-10-06 00:40 d-------- C:\Documents and Settings\home\.gimp-2.6 2008-10-05 14:56 . 2008-10-05 14:56 d-------- C:\Documents and Settings\home\.gegl-0.0 2008-10-05 14:55 . 2008-10-05 14:55 d-------- C:\Program Files\Gimp-2.0 2008-09-26 07:57 . 2008-10-10 22:51 d-------- C:\Program Files\Free Download Manager 2008-09-26 07:57 . 2008-10-16 22:23 d-------- C:\Documents and Settings\home\Application Data\Free Download Manager 2008-09-26 07:57 . 2008-09-26 07:57 d-------- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG 2008-09-24 20:06 . 2008-10-16 23:39 d-------- C:\Documents and Settings\home\Application Data\OpenOffice.org2 2008-09-17 19:34 . 2008-10-09 01:39 d-------- C:\Documents and Settings\home\Application Data\skypePM 2008-09-17 19:34 . 2008-09-17 19:34 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-09-17 19:26 . 2008-10-09 03:11 d-------- C:\Documents and Settings\home\Application Data\Skype 2008-09-17 19:20 . 2008-09-17 19:20 d-------- C:\Program Files\Skype 2008-09-17 19:20 . 2008-09-17 19:20 d-------- C:\Program Files\Common Files\Skype 2008-09-17 19:20 . 2008-09-17 19:20 d-------- C:\Documents and Settings\All Users\Application Data\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 19:33 --------- d-----w C:\Documents and Settings\home\Application Data\AVG7 2008-10-13 06:48 --------- d-----w C:\Documents and Settings\home\Application Data\DMCache 2008-10-11 21:50 --------- d-----w C:\Program Files\Windows Live 2008-10-11 07:25 --------- d-----w C:\Documents and Settings\home\Application Data\BearShare 2008-10-10 21:51 --------- d-----w C:\Program Files\Internet Download Manager 2008-10-05 19:05 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-26 07:12 --------- d-----w C:\Program Files\BitComet 2008-09-26 06:56 --------- d-----w C:\Documents and Settings\home\Application Data\IDM 2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-11 20:53 --------- d-----w C:\Documents and Settings\home\Application Data\Creative 2008-09-08 23:03 51,712 ----a-w C:\WINDOWS\system32\sirenacm.dll 2008-09-07 23:49 --------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-09-07 23:49 --------- d-----w C:\Program Files\Java 2008-09-05 14:56 287,744 ----a-w C:\WINDOWS\WLXPGSS.SCR 2008-08-23 20:48 --------- d-----w C:\Documents and Settings\home\Application Data\Digsby 2008-08-23 20:47 --------- d-----w C:\Program Files\Digsby 2008-08-21 10:00 --------- d-----w C:\Documents and Settings\home\Application Data\iMesh 2008-08-21 09:59 --------- d-----w C:\Program Files\iMesh Applications 2008-08-19 16:01 --------- d-----w C:\Program Files\VirtualDJ 2008-07-26 14:38 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-07-26 14:38 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 05:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-19 05:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-19 05:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 1998-08-24 19:09 10,000 ----a-w C:\WINDOWS\inf\unregpn.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-09 3513344] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-18 1249280] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-06-18 1122816] "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2008-02-25 2465839] "AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2008-08-11 883992] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NewsUpd"="C:\Program Files\Creative\News\NewsUpd.EXE" [2000-08-04 44032] "Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 189952] "SysTrayApp"="C:\Program Files\IDT\WDM\sttray.exe" [2008-04-11 413696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-07-27 579584] "V0420Mon.exe"="C:\WINDOWS\V0420Mon.exe" [2007-04-30 32768] "Ulead AutoDetector"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 94208] "Ulead Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 69632] "pdn"="C:\WINDOWS\system32\pdn.exe" [2008-10-07 19968] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-07-26 219136] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] C:\Documents and Settings\home\Start Menu\Programs\Startup\ OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-07-26 839680] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Grisoft\AVG7\avginet.exe"= "C:\Program Files\Grisoft\AVG7\avgamsvr.exe"= "C:\Program Files\Grisoft\AVG7\avgcc.exe"= "C:\Program Files\Grisoft\AVG7\avgemc.exe"= "C:\Program Files\BearShare Applications\BearShare\BearShare.exe"= "C:\Program Files\Mozilla Firefox\firefox.exe"= "C:\Program Files\SightSpeed\SightSpeed.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Documents and Settings\home\dldckh.exe"= "C:\WINDOWS\system32\pdn.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16174:TCP"= 16174:TCP:BitComet 16174 TCP "16174:UDP"= 16174:UDP:BitComet 16174 UDP R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-05 114616] R3 V0420VID;Live! Cam Vista IM (VF0420);C:\WINDOWS\system32\DRIVERS\V0420Vid.sys [2007-05-31 99648] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-03 63555] S3 autorun;autorun;C:\huadio.tmp [ ] . - - - - ORPHANS REMOVED - - - - HKCU-Run-BitComet - C:\Program Files\BitComet\BitComet.exe HKLM-Run-MyWebSearch Plugin - C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL HKLM-Run-My Web Search Bar Search Scope Monitor - C:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://go.microsoft.com/fwlink/?LinkId=69157 FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPMyWebS.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-16 23:38:09 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... C:\WINDOWS\system32\pdn.exe [2108] 0x82A55988 scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?X???????????????? C?????Disc Detector?B???A???????A?? ????B???@?$?@?? C?????U?@?????????@?B???A???????A?p ????B???@?????P???$?@? ??????~?B~??????????@??? ???????????????B?????| ???????????????????p????????B scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\autorun] "ImagePath"="\??\C:\huadio.tmp" . ------------------------ Other Running Processes ------------------------ . C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\Ctsvccda.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Creative\ShareDLL\Mediadet.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\dwwin.exe . ************************************************************************** . Completion time: 2008-10-16 23:44:01 - machine was rebooted ComboFix-quarantined-files.txt 2008-10-16 22:43:56 Pre-Run: 141,374,242,816 bytes free Post-Run: 141,477,892,096 bytes free 254 --- E O F --- 2008-10-16 13:51:47

Bauzau · Answer

Je sais pas si c'est bon mais pour l'instant c'est bon  :-)

Destrio5 · Answer

/!\ Seul Bauzau peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

File::
C:\huadio.tmp 

Folder::
C:\Program Files\Fun Web Products 
C:\ToolBar SD 
C:\Program Files\AdVantage 

Driver::
autorun
 
FileLook::
C:\Program Files\Jhoos\Jhoos.exe
C:\WINDOWS\system32\customercare.ico 
C:\WINDOWS\system32\cableguy.ico 
C:\WINDOWS\system32\about.ico 
C:\WINDOWS\system32	ubely.ico 
C:\WINDOWS\system32\pdn.exe 
C:\Documents and Settings\home\dldckh.exe 
C:\WINDOWS\V0420Mon.exe
C:\WINDOWS\system32\pdn.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"AdVantage"=-






---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Redémarre en mode sans échec

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

Bauzau · Answer

Voila c'est la ComboFix 08-10-16.01 - home 2008-10-17 0:12:14.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.163 [GMT 1:00] Running from: C:\Documents and Settings\home\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\home\Desktop\CFScript.txt * Created a new restore point FILE :: C:\huadio.tmp . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Program Files\AdVantage C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome.manifest C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\advantage.png C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\contents.rdf C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.js C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\overlay.xul C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\content\vssver2.scc C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\overlay.dtd C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\chrome\locale\en-US\vssver2.scc C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\IMeMedia_FF.xpt C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\components\MeMedia_FF.dll C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.js C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\install.rdf C:\Program Files\AdVantage\{A89AED22-9133-424c-88E7-C8235C5FF302}\vssver2.scc C:\Program Files\AdVantage\AdVantage.db C:\Program Files\AdVantage\AdVantage.exe C:\Program Files\AdVantage\AdVantage.htm C:\Program Files\AdVantage\AdVUninst.exe C:\Program Files\AdVantage\ffext.mod C:\Program Files\AdVantage\TR.dll C:\Program Files\AdVantage\user.db C:\Program Files\Fun Web Products C:\ToolBar SD C:\ToolBar SD\Backup-TB\DOCUME~1\home\Cookies\home@myway[1].txt C:\ToolBar SD\Backup-TB\DOCUME~1\home\Cookies\home@mywebsearch[1].txt C:\ToolBar SD\Backup-TB\Program Files\FunWebProducts\[u]0/u0AB615A.dat C:\ToolBar SD\Changelog ToolBar.txt C:\ToolBar SD\Doss.tbsd C:\ToolBar SD\RegP2.txt C:\ToolBar SD\RegP3.txt C:\ToolBar SD\RegP4.txt C:\ToolBar SD\RegP5.txt C:\ToolBar SD\RegPCU.txt C:\ToolBar SD\RegPLM.txt C:\ToolBar SD\RKit.lsd C:\ToolBar SD\RoGUeS.lsd C:\ToolBar SD\RunTool.txt C:\ToolBar SD\TB_1.txt C:\ToolBar SD\TB_2.txt C:\ToolBar SD\TB_3.txt C:\ToolBar SD\TB_4.txt . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_AUTORUN -------\Service_autorun ((((((((((((((((((((((((( Files Created from 2008-09-16 to 2008-10-16 ))))))))))))))))))))))))))))))) . 2008-10-15 19:51 . 2008-10-15 19:51 d-------- C:\Documents and Settings\home\Application Data\Malwarebytes 2008-10-15 19:50 . 2008-10-16 22:20 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-15 19:50 . 2008-10-15 19:50 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-15 18:36 . 2008-10-15 18:36 d-------- C:\Program Files\AxBx 2008-10-15 05:46 . 2008-09-15 13:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-14 15:19 . 2008-10-15 18:04 1,966 --a------ C:\Documents and Settings\Orph.egd 2008-10-13 18:09 . 2008-10-13 18:23 0 --a------ C:\WINDOWS\system32\tmp.MSNFix 2008-10-12 14:48 . 2008-10-14 21:20 d-------- C:\Program Files\Windows Live Safety Center 2008-10-11 22:52 . 2008-10-17 00:17 d-------- C:\Documents and Settings\home\Tracing 2008-10-11 22:42 . 2008-10-11 22:42 d-------- C:\Program Files\Microsoft 2008-10-11 22:33 . 2008-10-11 22:33 d-------- C:\Program Files\Common Files\Windows Live 2008-10-11 13:15 . 2008-10-11 13:18 d-------- C:\Program Files\Jhoos 2008-10-11 13:15 . 2003-10-06 22:39 26,694 --a------ C:\WINDOWS\system32\customercare.ico 2008-10-11 13:15 . 2003-10-06 22:40 26,694 --a------ C:\WINDOWS\system32\cableguy.ico 2008-10-11 13:15 . 2003-10-06 22:37 26,694 --a------ C:\WINDOWS\system32\about.ico 2008-10-11 13:15 . 2001-10-13 01:06 10,134 --a------ C:\WINDOWS\system32\tubely.ico 2008-10-10 22:45 . 2008-10-07 10:01 19,968 --a------ C:\WINDOWS\system32\pdn.exe 2008-10-10 22:45 . 2008-10-07 10:01 19,968 ---h----- C:\Documents and Settings\home\dldckh.exe 2008-10-05 20:06 . 2008-10-05 20:06 d-------- C:\Program Files\Common Files\Ulead Systems 2008-10-05 20:06 . 1998-12-08 18:53 212,480 --------- C:\WINDOWS\system32\PCDLIB32.DLL 2008-10-05 20:06 . 2005-08-04 18:54 40,960 --------- C:\WINDOWS\system32\Ulead Photo Express ScreenSaver.scr 2008-10-05 20:05 . 2008-10-05 20:05 d-------- C:\Program Files\Ulead Systems 2008-10-05 20:04 . 2008-10-05 20:04 d-------- C:\Documents and Settings\home\Application Data\Ulead Systems 2008-10-05 20:04 . 2008-10-05 20:08 d-------- C:\Documents and Settings\All Users\Application Data\Ulead Systems 2008-10-05 19:58 . 2008-10-05 19:58 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-10-05 19:52 . 2008-10-05 19:52 d-------- C:\Program Files\Morpheus Photo Morpher 2008-10-05 19:52 . 2008-10-05 19:52 d-------- C:\Documents and Settings\home\Application Data\Morpheus Software 2008-10-05 15:01 . 2008-10-05 22:47 d-------- C:\Documents and Settings\home\Application Data\gtk-2.0 2008-10-05 15:01 . 2008-10-05 15:01 d-------- C:\Documents and Settings\home\.thumbnails 2008-10-05 14:56 . 2008-10-06 00:40 d-------- C:\Documents and Settings\home\.gimp-2.6 2008-10-05 14:56 . 2008-10-05 14:56 d-------- C:\Documents and Settings\home\.gegl-0.0 2008-10-05 14:55 . 2008-10-05 14:55 d-------- C:\Program Files\Gimp-2.0 2008-09-26 07:57 . 2008-10-10 22:51 d-------- C:\Program Files\Free Download Manager 2008-09-26 07:57 . 2008-10-17 00:11 d-------- C:\Documents and Settings\home\Application Data\Free Download Manager 2008-09-26 07:57 . 2008-09-26 07:57 d-------- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG 2008-09-24 20:06 . 2008-10-16 23:39 d-------- C:\Documents and Settings\home\Application Data\OpenOffice.org2 2008-09-17 19:34 . 2008-10-09 01:39 d-------- C:\Documents and Settings\home\Application Data\skypePM 2008-09-17 19:34 . 2008-09-17 19:34 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat 2008-09-17 19:26 . 2008-10-09 03:11 d-------- C:\Documents and Settings\home\Application Data\Skype 2008-09-17 19:20 . 2008-09-17 19:20 d-------- C:\Program Files\Skype 2008-09-17 19:20 . 2008-09-17 19:20 d-------- C:\Program Files\Common Files\Skype 2008-09-17 19:20 . 2008-09-17 19:20 d-------- C:\Documents and Settings\All Users\Application Data\Skype . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-16 19:33 --------- d-----w C:\Documents and Settings\home\Application Data\AVG7 2008-10-13 06:48 --------- d-----w C:\Documents and Settings\home\Application Data\DMCache 2008-10-11 21:50 --------- d-----w C:\Program Files\Windows Live 2008-10-11 07:25 --------- d-----w C:\Documents and Settings\home\Application Data\BearShare 2008-10-10 21:51 --------- d-----w C:\Program Files\Internet Download Manager 2008-10-05 19:05 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-26 07:12 --------- d-----w C:\Program Files\BitComet 2008-09-26 06:56 --------- d-----w C:\Documents and Settings\home\Application Data\IDM 2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys 2008-09-11 20:53 --------- d-----w C:\Documents and Settings\home\Application Data\Creative 2008-09-08 23:03 51,712 ----a-w C:\WINDOWS\system32\sirenacm.dll 2008-09-07 23:49 --------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-09-07 23:49 --------- d-----w C:\Program Files\Java 2008-09-05 14:56 287,744 ----a-w C:\WINDOWS\WLXPGSS.SCR 2008-08-23 20:48 --------- d-----w C:\Documents and Settings\home\Application Data\Digsby 2008-08-23 20:47 --------- d-----w C:\Program Files\Digsby 2008-08-21 10:00 --------- d-----w C:\Documents and Settings\home\Application Data\iMesh 2008-08-21 09:59 --------- d-----w C:\Program Files\iMesh Applications 2008-08-19 16:01 --------- d-----w C:\Program Files\VirtualDJ 2008-07-26 14:38 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-07-26 14:38 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 05:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-19 05:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-19 05:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 1998-08-24 19:09 10,000 ----a-w C:\WINDOWS\inf\unregpn.exe . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\home\dldckh.exe -- Unable to find Resource table header. MD5: 61798814e7e4639b9d2cf1b9180b6884 ---- C:\Program Files\Jhoos\Jhoos.exe ---- Company: Jhoos File Description: File Version: 1.00 Product Name: Jhoos Chat Copyright: Original file name: JhoosChat.exe MD5: 9efa2ef176c69075c564d952b136025b C:\WINDOWS\system32\about.ico -- Not a PE file. MD5: d0b7b077cd6f06ad3ccd4442d9198d3f C:\WINDOWS\system32\cableguy.ico -- Not a PE file. MD5: 0fcdec162e697e4637c8208cfc7ec610 C:\WINDOWS\system32\customercare.ico -- Not a PE file. MD5: 75a3b4031d5c839e34153a8cca74ad72 C:\WINDOWS\system32\pdn.exe -- Unable to find Resource table header. MD5: 61798814e7e4639b9d2cf1b9180b6884 C:\WINDOWS\system32\tubely.ico -- Not a PE file. MD5: 4fd9f2c9d91ae936d59348aba4e3fcdb ---- C:\WINDOWS\V0420Mon.exe ---- Company: Creative Technology Ltd. File Description: Live! Cam Console Auto Launcher File Version: 1.00.01.00 Product Name: Copyright: Copyright (c) Creative Technology Ltd., 2007 Original file name: V0420Mon.exe MD5: f5948132d8a0dfa7390f7b1e58bb6057 ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-09 3513344] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-18 1249280] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-06-18 1122816] "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2008-02-25 2465839] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NewsUpd"="C:\Program Files\Creative\News\NewsUpd.EXE" [2000-08-04 44032] "Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 189952] "SysTrayApp"="C:\Program Files\IDT\WDM\sttray.exe" [2008-04-11 413696] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-07-27 579584] "V0420Mon.exe"="C:\WINDOWS\V0420Mon.exe" [2007-04-30 32768] "Ulead AutoDetector"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 94208] "Ulead Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 69632] "pdn"="C:\WINDOWS\system32\pdn.exe" [2008-10-07 19968] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-07-26 219136] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] C:\Documents and Settings\home\Start Menu\Programs\Startup\ OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-07-26 839680] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Grisoft\AVG7\avginet.exe"= "C:\Program Files\Grisoft\AVG7\avgamsvr.exe"= "C:\Program Files\Grisoft\AVG7\avgcc.exe"= "C:\Program Files\Grisoft\AVG7\avgemc.exe"= "C:\Program Files\BearShare Applications\BearShare\BearShare.exe"= "C:\Program Files\Mozilla Firefox\firefox.exe"= "C:\Program Files\SightSpeed\SightSpeed.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "C:\Documents and Settings\home\dldckh.exe"= "C:\WINDOWS\system32\pdn.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16174:TCP"= 16174:TCP:BitComet 16174 TCP "16174:UDP"= 16174:UDP:BitComet 16174 UDP R3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-05 114616] R3 V0420VID;Live! Cam Vista IM (VF0420);C:\WINDOWS\system32\DRIVERS\V0420Vid.sys [2007-05-31 99648] S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-03 63555] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-17 00:15:39 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... C:\WINDOWS\system32\pdn.exe [2848] 0x8221E978 scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?X???(???????????? C?????Disc Detector?B???A???????A?? ????B???@?$?@?? C?????U?@?????????@?B???A???????A?p ????B???@?????P???$?@? ??????~?B~??????????@???????????????????B?????| ???????????????????P????????B scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\system32\Ctsvccda.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Creative\ShareDLL\Mediadet.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.exe C:\Program Files\OpenOffice.org 2.4\program\soffice.bin C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe . ************************************************************************** . Completion time: 2008-10-17 0:21:22 - machine was rebooted ComboFix-quarantined-files.txt 2008-10-16 23:21:15 ComboFix2.txt 2008-10-16 22:44:03 Pre-Run: 141,431,910,400 bytes free Post-Run: 141,427,773,440 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 266 --- E O F --- 2008-10-16 13:51:47

Destrio5 · Answer

/!\ Seul Bauzau peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

File::
C:\Documents and Settings\home\dldckh.exe
C:\WINDOWS\system32\about.ico
C:\WINDOWS\system32\cableguy.ico 
C:\WINDOWS\system32\customercare.ico 
C:\WINDOWS\system32	ubely.ico
C:\WINDOWS\system32\pdn.exe 

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"SunJavaUpdateSched"=-
"pdn"=-






---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Redémarre en mode sans échec

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

Bauzau · Answer

Bonjour, je l'ai refais j'espère que c'est bon maintenant !!! Command switches used :: C:\Documents and Settings\home\Desktop\CFScript.txt FILE :: C:\Documents and Settings\home\dldckh.exe C:\WINDOWS\system32\about.ico C:\WINDOWS\system32\cableguy.ico C:\WINDOWS\system32\customercare.ico C:\WINDOWS\system32\pdn.exe C:\WINDOWS\system32 ubely.ico . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\home\dldckh.exe C:\WINDOWS\system32\about.ico C:\WINDOWS\system32\cableguy.ico C:\WINDOWS\system32\customercare.ico C:\WINDOWS\system32\pdn.exe C:\WINDOWS\system32 ubely.ico . ((((((((((((((((((((((((( Files Created from 2008-09-19 to 2008-10-19 ))))))))))))))))))))))))))))))) . 2008-10-15 19:51 . 2008-10-15 19:51 d-------- C:\Documents and Settings\home\Application Data\Malwarebytes 2008-10-15 19:50 . 2008-10-16 22:20 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-15 19:50 . 2008-10-15 19:50 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-10-15 18:36 . 2008-10-15 18:36 d-------- C:\Program Files\AxBx 2008-10-15 16:30 . 2008-09-08 11:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-15 05:46 . 2008-09-15 13:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-14 19:54 . 2008-08-14 11:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache toskrnl.exe 2008-10-14 19:54 . 2008-08-14 11:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache tkrnlmp.exe 2008-10-14 19:54 . 2008-08-14 10:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache tkrnlpa.exe 2008-10-14 19:54 . 2008-08-14 10:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache tkrpamp.exe 2008-10-14 15:19 . 2008-10-15 18:04 1,966 --a------ C:\Documents and Settings\Orph.egd 2008-10-13 18:09 . 2008-10-13 18:23 0 --a------ C:\WINDOWS\system32 mp.MSNFix 2008-10-12 14:48 . 2008-10-14 21:20 d-------- C:\Program Files\Windows Live Safety Center 2008-10-11 22:52 . 2008-10-19 10:49 d-------- C:\Documents and Settings\home\Tracing 2008-10-11 22:42 . 2008-10-11 22:42 d-------- C:\Program Files\Microsoft 2008-10-11 22:33 . 2008-10-11 22:33 d-------- C:\Program Files\Common Files\Windows Live 2008-10-11 13:15 . 2008-10-11 13:18 d-------- C:\Program Files\Jhoos 2008-10-05 20:06 . 2008-10-05 20:06 d-------- C:\Program Files\Common Files\Ulead Systems 2008-10-05 20:06 . 1998-12-08 18:53 212,480 --------- C:\WINDOWS\system32\PCDLIB32.DLL 2008-10-05 20:06 . 2005-08-04 18:54 40,960 --------- C:\WINDOWS\system32\Ulead Photo Express ScreenSaver.scr 2008-10-05 20:05 . 2008-10-05 20:05 d-------- C:\Program Files\Ulead Systems 2008-10-05 20:04 . 2008-10-05 20:04 d-------- C:\Documents and Settings\home\Application Data\Ulead Systems 2008-10-05 20:04 . 2008-10-05 20:08 d-------- C:\Documents and Settings\All Users\Application Data\Ulead Systems 2008-10-05 19:58 . 2008-10-05 19:58 7,680 --ahs---- C:\WINDOWS\Thumbs.db 2008-10-05 19:52 . 2008-10-05 19:52 d-------- C:\Program Files\Morpheus Photo Morpher 2008-10-05 19:52 . 2008-10-05 19:52 d-------- C:\Documents and Settings\home\Application Data\Morpheus Software 2008-10-05 15:01 . 2008-10-05 22:47 d-------- C:\Documents and Settings\home\Application Data\gtk-2.0 2008-10-05 15:01 . 2008-10-05 15:01 d-------- C:\Documents and Settings\home\.thumbnails 2008-10-05 14:56 . 2008-10-06 00:40 d-------- C:\Documents and Settings\home\.gimp-2.6 2008-10-05 14:56 . 2008-10-05 14:56 d-------- C:\Documents and Settings\home\.gegl-0.0 2008-10-05 14:55 . 2008-10-05 14:55 d-------- C:\Program Files\Gimp-2.0 2008-09-26 07:57 . 2008-10-10 22:51 d-------- C:\Program Files\Free Download Manager 2008-09-26 07:57 . 2008-10-19 10:49 d-------- C:\Documents and Settings\home\Application Data\Free Download Manager 2008-09-26 07:57 . 2008-09-26 07:57 d-------- C:\Documents and Settings\All Users\Application Data\FreeDownloadManager.ORG 2008-09-24 20:06 . 2008-10-19 10:49 d-------- C:\Documents and Settings\home\Application Data\OpenOffice.org2 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-19 09:05 --------- d-----w C:\Documents and Settings\home\Application Data\AVG7 2008-10-13 06:48 --------- d-----w C:\Documents and Settings\home\Application Data\DMCache 2008-10-11 21:50 --------- d-----w C:\Program Files\Windows Live 2008-10-11 07:25 --------- d-----w C:\Documents and Settings\home\Application Data\BearShare 2008-10-10 21:51 --------- d-----w C:\Program Files\Internet Download Manager 2008-10-09 02:11 --------- d-----w C:\Documents and Settings\home\Application Data\Skype 2008-10-09 00:39 --------- d-----w C:\Documents and Settings\home\Application Data\skypePM 2008-10-05 19:05 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-26 07:12 --------- d-----w C:\Program Files\BitComet 2008-09-26 06:56 --------- d-----w C:\Documents and Settings\home\Application Data\IDM 2008-09-17 18:20 --------- d-----w C:\Program Files\Skype 2008-09-17 18:20 --------- d-----w C:\Program Files\Common Files\Skype 2008-09-17 18:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype 2008-09-11 20:53 --------- d-----w C:\Documents and Settings\home\Application Data\Creative 2008-09-08 10:41 333,824 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-09-07 23:49 --------- d-----w C:\Program Files\OpenOffice.org 2.4 2008-09-07 23:49 --------- d-----w C:\Program Files\Java 2008-09-05 14:56 287,744 ----a-w C:\WINDOWS\WLXPGSS.SCR 2008-08-23 20:48 --------- d-----w C:\Documents and Settings\home\Application Data\Digsby 2008-08-23 20:47 --------- d-----w C:\Program Files\Digsby 2008-08-21 10:00 --------- d-----w C:\Documents and Settings\home\Application Data\iMesh 2008-08-21 09:59 --------- d-----w C:\Program Files\iMesh Applications 2008-08-19 16:01 --------- d-----w C:\Program Files\VirtualDJ . ((((((((((((((((((((((((((((( snapshot@2008-10-16_23.43.37.42 ))))))))))))))))))))))))))))))))))))))))) . + 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB956391\spmsg.dll + 2007-11-30 12:39:22 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB956391\spuninst.exe + 2007-11-30 12:39:22 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB956391\update\spcustom.dll + 2007-11-30 12:39:22 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB956391\update\update.exe + 2007-11-30 12:39:22 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB956391\update\updspapi.dll + 2008-08-14 10:34:26 138,496 ----a-w C:\WINDOWS\$hf_mig$\KB956803\SP3QFE\afd.sys + 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB956803\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB956803\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB956803\update\spcustom.dll + 2007-11-30 11:18:51 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB956803\update\update.exe + 2007-11-30 11:18:51 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB956803\update\updspapi.dll + 2008-08-14 10:39:28 2,145,280 ----a-w C:\WINDOWS\$hf_mig$\KB956841\SP3QFE tkrnlmp.exe + 2008-08-14 14:39:46 2,066,048 ----a-w C:\WINDOWS\$hf_mig$\KB956841\SP3QFE tkrnlpa.exe + 2008-08-14 10:09:44 2,023,936 ----a-w C:\WINDOWS\$hf_mig$\KB956841\SP3QFE tkrpamp.exe + 2008-08-14 15:11:10 2,189,184 ----a-w C:\WINDOWS\$hf_mig$\KB956841\SP3QFE toskrnl.exe + 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB956841\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB956841\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB956841\update\spcustom.dll + 2007-11-30 11:18:51 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB956841\update\update.exe + 2008-07-09 07:38:37 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB956841\update\updspapi.dll + 2008-09-08 11:37:19 333,824 ----a-w C:\WINDOWS\$hf_mig$\KB957095\SP3QFE\srv.sys + 2007-11-30 11:18:51 17,272 ----a-w C:\WINDOWS\$hf_mig$\KB957095\spmsg.dll + 2007-11-30 11:18:51 231,288 ----a-w C:\WINDOWS\$hf_mig$\KB957095\spuninst.exe + 2007-11-30 11:18:51 26,488 ----a-w C:\WINDOWS\$hf_mig$\KB957095\update\spcustom.dll + 2007-11-30 11:18:51 755,576 ----a-w C:\WINDOWS\$hf_mig$\KB957095\update\update.exe + 2007-11-30 11:18:51 382,840 ----a-w C:\WINDOWS\$hf_mig$\KB957095\update\updspapi.dll + 2007-11-30 12:39:22 231,288 -c----w C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe + 2007-11-30 12:39:22 382,840 -c----w C:\WINDOWS\$NtUninstallKB956391$\spuninst\updspapi.dll + 2008-06-20 11:40:08 138,496 -c----w C:\WINDOWS\$NtUninstallKB956803$\afd.sys + 2007-11-30 11:18:51 231,288 -c----w C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe + 2007-11-30 11:18:51 382,840 -c----w C:\WINDOWS\$NtUninstallKB956803$\spuninst\updspapi.dll + 2008-04-13 18:31:21 2,023,936 -c----w C:\WINDOWS\$NtUninstallKB956841$ tkrnlpa.exe + 2008-04-13 19:24:37 2,145,280 -c----w C:\WINDOWS\$NtUninstallKB956841$ toskrnl.exe + 2007-11-30 11:18:51 231,288 -c----w C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe + 2008-07-09 07:38:37 382,840 -c----w C:\WINDOWS\$NtUninstallKB956841$\spuninst\updspapi.dll + 2007-11-30 11:18:51 231,288 -c----w C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe + 2007-11-30 11:18:51 382,840 -c----w C:\WINDOWS\$NtUninstallKB957095$\spuninst\updspapi.dll + 2008-04-13 19:15:11 334,848 -c----w C:\WINDOWS\$NtUninstallKB957095$\srv.sys + 2008-08-14 10:09:26 2,145,280 ------w C:\WINDOWS\Driver Cache\i386 tkrnlmp.exe + 2008-08-14 09:33:16 2,066,048 ------w C:\WINDOWS\Driver Cache\i386 tkrnlpa.exe + 2008-08-14 09:33:16 2,023,936 ------w C:\WINDOWS\Driver Cache\i386 tkrpamp.exe + 2008-08-14 10:11:02 2,189,184 ------w C:\WINDOWS\Driver Cache\i386 toskrnl.exe + 2008-06-23 16:01:38 124,928 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\advpack.dll + 2008-06-23 16:01:38 347,136 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\dxtmsft.dll + 2008-06-23 16:01:39 214,528 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\dxtrans.dll + 2008-06-23 16:01:39 132,608 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\extmgr.dll + 2008-06-23 16:01:39 63,488 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\icardie.dll + 2008-06-23 08:23:18 70,656 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ie4uinit.exe + 2008-06-23 16:01:39 153,088 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieakeng.dll + 2008-06-23 16:01:39 230,400 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieaksie.dll + 2008-06-21 05:23:53 161,792 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieakui.dll + 2008-06-23 16:01:40 383,488 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieapfltr.dll + 2008-06-23 16:01:40 388,608 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iedkcs32.dll + 2008-06-23 16:01:43 6,068,736 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieframe.dll + 2008-06-23 16:01:43 44,544 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iernonce.dll + 2008-06-23 16:01:44 267,776 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iertutil.dll + 2008-06-23 08:23:18 13,824 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\ieudinit.exe + 2008-06-23 08:23:52 625,664 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe + 2008-06-23 16:01:46 27,648 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\jsproxy.dll + 2008-06-23 16:01:46 459,264 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msfeeds.dll + 2008-06-23 16:01:46 52,224 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msfeedsbs.dll + 2008-06-23 16:01:49 3,594,240 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mshtml.dll + 2008-06-23 16:01:49 477,696 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mshtmled.dll + 2008-06-23 16:01:49 193,024 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\msrating.dll + 2008-06-23 16:01:50 671,232 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\mstime.dll + 2008-06-23 16:01:50 102,912 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\occache.dll + 2008-06-23 16:01:50 44,544 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\pngfilt.dll + 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe + 2007-03-06 01:23:51 371,424 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\updspapi.dll + 2008-06-23 16:01:50 105,984 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\url.dll + 2008-06-23 16:01:51 1,162,752 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\urlmon.dll + 2008-06-23 16:01:51 233,472 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\webcheck.dll + 2008-06-23 16:01:51 827,904 -c----w C:\WINDOWS\ie7updates\KB956390-IE7\wininet.dll - 2008-06-23 16:01:38 124,928 ----a-w C:\WINDOWS\system32\advpack.dll + 2008-08-26 09:08:35 124,928 ----a-w C:\WINDOWS\system32\advpack.dll - 2008-06-23 16:01:38 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll + 2008-08-26 09:08:35 124,928 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll - 2008-06-20 11:40:08 138,496 -c----w C:\WINDOWS\system32\dllcache\afd.sys + 2008-08-14 10:04:36 138,496 -c----w C:\WINDOWS\system32\dllcache\afd.sys - 2008-06-23 16:01:38 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll + 2008-08-26 09:08:36 347,136 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll - 2008-06-23 16:01:39 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll + 2008-08-26 09:08:36 214,528 -c--a-w C:\WINDOWS\system32\dllcache\dxtrans.dll - 2008-06-23 16:01:39 132,608 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll + 2008-08-26 09:08:36 132,608 -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll - 2008-06-23 16:01:39 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll + 2008-08-26 09:08:36 63,488 -c----w C:\WINDOWS\system32\dllcache\icardie.dll - 2008-06-23 08:23:18 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2008-08-25 08:43:21 70,656 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2008-06-23 16:01:39 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll + 2008-08-26 09:08:36 153,088 -c--a-w C:\WINDOWS\system32\dllcache\ieakeng.dll - 2008-06-23 16:01:39 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll + 2008-08-26 09:08:36 230,400 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll - 2008-06-21 05:23:53 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll + 2008-08-23 05:54:50 161,792 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll - 2008-06-23 16:01:40 383,488 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll + 2008-08-26 09:08:36 380,928 -c----w C:\WINDOWS\system32\dllcache\ieapfltr.dll - 2008-06-23 16:01:40 388,608 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll + 2008-08-26 09:08:37 388,608 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll - 2008-06-23 16:01:43 6,068,736 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll + 2008-10-03 17:26:50 6,068,224 -c----w C:\WINDOWS\system32\dllcache\ieframe.dll - 2008-06-23 16:01:43 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll + 2008-08-26 09:08:39 44,544 -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll - 2008-06-23 16:01:44 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll + 2008-08-26 09:08:39 267,776 -c----w C:\WINDOWS\system32\dllcache\iertutil.dll - 2008-06-23 08:23:18 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe + 2008-08-25 08:43:21 13,824 -c----w C:\WINDOWS\system32\dllcache\ieudinit.exe - 2008-06-23 08:23:52 625,664 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe + 2008-08-23 05:56:16 635,848 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe - 2008-06-23 16:01:46 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll + 2008-08-26 09:08:40 27,648 -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll - 2008-06-23 16:01:46 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll + 2008-08-26 09:08:40 459,264 -c----w C:\WINDOWS\system32\dllcache\msfeeds.dll - 2008-06-23 16:01:46 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll + 2008-08-26 09:08:40 52,224 -c----w C:\WINDOWS\system32\dllcache\msfeedsbs.dll - 2008-06-23 16:01:49 3,594,240 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll + 2008-08-26 09:08:43 3,594,752 -c--a-w C:\WINDOWS\system32\dllcache\mshtml.dll - 2008-06-23 16:01:49 477,696 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll + 2008-08-26 09:08:43 477,696 -c--a-w C:\WINDOWS\system32\dllcache\mshtmled.dll - 2008-06-23 16:01:49 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll + 2008-08-26 09:08:44 193,024 -c--a-w C:\WINDOWS\system32\dllcache\msrating.dll - 2008-06-23 16:01:50 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll + 2008-08-26 09:08:44 671,232 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll - 2008-06-23 16:01:50 102,912 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll + 2008-08-26 09:08:44 102,912 -c--a-w C:\WINDOWS\system32\dllcache\occache.dll - 2008-06-23 16:01:50 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll + 2008-08-26 09:08:44 44,544 -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll - 2008-06-23 16:01:50 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll + 2008-08-26 09:08:44 105,984 -c--a-w C:\WINDOWS\system32\dllcache\url.dll - 2008-06-23 16:01:51 1,162,752 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll + 2008-08-26 09:08:45 1,162,752 -c--a-w C:\WINDOWS\system32\dllcache\urlmon.dll - 2008-06-23 16:01:51 233,472 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll + 2008-08-26 09:08:45 233,472 -c--a-w C:\WINDOWS\system32\dllcache\webcheck.dll - 2008-06-23 16:01:51 827,904 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll + 2008-08-26 09:08:45 827,904 -c--a-w C:\WINDOWS\system32\dllcache\wininet.dll - 2008-06-20 11:40:08 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys + 2008-08-14 10:04:36 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys - 2008-06-23 16:01:38 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll + 2008-08-26 09:08:36 347,136 ----a-w C:\WINDOWS\system32\dxtmsft.dll - 2008-06-23 16:01:39 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll + 2008-08-26 09:08:36 214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll - 2008-06-23 16:01:39 132,608 ----a-w C:\WINDOWS\system32\extmgr.dll + 2008-08-26 09:08:36 132,608 ----a-w C:\WINDOWS\system32\extmgr.dll - 2008-06-23 16:01:39 63,488 ----a-w C:\WINDOWS\system32\icardie.dll + 2008-08-26 09:08:36 63,488 ----a-w C:\WINDOWS\system32\icardie.dll - 2008-06-23 08:23:18 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe + 2008-08-25 08:43:21 70,656 ----a-w C:\WINDOWS\system32\ie4uinit.exe - 2008-06-23 16:01:39 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll + 2008-08-26 09:08:36 153,088 ----a-w C:\WINDOWS\system32\ieakeng.dll - 2008-06-23 16:01:39 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll + 2008-08-26 09:08:36 230,400 ----a-w C:\WINDOWS\system32\ieaksie.dll - 2008-06-21 05:23:53 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll + 2008-08-23 05:54:50 161,792 ----a-w C:\WINDOWS\system32\ieakui.dll - 2008-06-23 16:01:40 383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll + 2008-08-26 09:08:36 380,928 ----a-w C:\WINDOWS\system32\ieapfltr.dll - 2008-06-23 16:01:40 388,608 ----a-w C:\WINDOWS\system32\iedkcs32.dll + 2008-08-26 09:08:37 388,608 ----a-w C:\WINDOWS\system32\iedkcs32.dll - 2008-06-23 16:01:43 6,068,736 ----a-w C:\WINDOWS\system32\ieframe.dll + 2008-10-03 17:26:50 6,068,224 ----a-w C:\WINDOWS\system32\ieframe.dll - 2008-06-23 16:01:43 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll + 2008-08-26 09:08:39 44,544 ----a-w C:\WINDOWS\system32\iernonce.dll - 2008-06-23 16:01:44 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll + 2008-08-26 09:08:39 267,776 ----a-w C:\WINDOWS\system32\iertutil.dll - 2008-06-23 08:23:18 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe + 2008-08-25 08:43:21 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe - 2008-06-23 16:01:46 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll + 2008-08-26 09:08:40 27,648 ----a-w C:\WINDOWS\system32\jsproxy.dll - 2008-06-23 16:01:46 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll + 2008-08-26 09:08:40 459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll - 2008-06-23 16:01:46 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll + 2008-08-26 09:08:40 52,224 ----a-w C:\WINDOWS\system32\msfeedsbs.dll - 2008-06-23 16:01:49 3,594,240 ----a-w C:\WINDOWS\system32\mshtml.dll + 2008-08-26 09:08:43 3,594,752 ----a-w C:\WINDOWS\system32\mshtml.dll - 2008-06-23 16:01:49 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll + 2008-08-26 09:08:43 477,696 ----a-w C:\WINDOWS\system32\mshtmled.dll - 2008-06-23 16:01:49 193,024 ----a-w C:\WINDOWS\system32\msrating.dll + 2008-08-26 09:08:44 193,024 ----a-w C:\WINDOWS\system32\msrating.dll - 2008-06-23 16:01:50 671,232 ----a-w C:\WINDOWS\system32\mstime.dll + 2008-08-26 09:08:44 671,232 ----a-w C:\WINDOWS\system32\mstime.dll - 2008-04-13 18:31:21 2,023,936 ----a-w C:\WINDOWS\system32 tkrnlpa.exe + 2008-08-14 09:33:16 2,023,936 ----a-w C:\WINDOWS\system32 tkrnlpa.exe - 2008-04-13 19:24:37 2,145,280 ----a-w C:\WINDOWS\system32 toskrnl.exe + 2008-08-14 10:09:26 2,145,280 ----a-w C:\WINDOWS\system32 toskrnl.exe - 2008-06-23 16:01:50 102,912 ----a-w C:\WINDOWS\system32\occache.dll + 2008-08-26 09:08:44 102,912 ----a-w C:\WINDOWS\system32\occache.dll - 2008-06-23 16:01:50 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll + 2008-08-26 09:08:44 44,544 ----a-w C:\WINDOWS\system32\pngfilt.dll - 2007-11-30 12:39:22 17,272 ----a-w C:\WINDOWS\system32\spmsg.dll + 2007-11-30 11:18:51 17,272 ------w C:\WINDOWS\system32\spmsg.dll - 2008-06-23 16:01:50 105,984 ----a-w C:\WINDOWS\system32\url.dll + 2008-08-26 09:08:44 105,984 ----a-w C:\WINDOWS\system32\url.dll - 2008-06-23 16:01:51 1,162,752 ----a-w C:\WINDOWS\system32\urlmon.dll + 2008-08-26 09:08:45 1,162,752 ----a-w C:\WINDOWS\system32\urlmon.dll - 2008-06-23 16:01:51 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll + 2008-08-26 09:08:45 233,472 ----a-w C:\WINDOWS\system32\webcheck.dll - 2008-06-23 16:01:51 827,904 ----a-w C:\WINDOWS\system32\wininet.dll + 2008-08-26 09:08:45 827,904 ----a-w C:\WINDOWS\system32\wininet.dll . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-09 3513344] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-18 1249280] "PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2008-06-18 1122816] "Creative Live! Cam Manager"="C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-06-07 155648] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2008-02-25 2465839] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NewsUpd"="C:\Program Files\Creative\News\NewsUpd.EXE" [2000-08-04 44032] "Disc Detector"="C:\Program Files\Creative\ShareDLL\CtNotify.exe" [1999-08-30 189952] "SysTrayApp"="C:\Program Files\IDT\WDM\sttray.exe" [2008-04-11 413696] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-10-17 590848] "V0420Mon.exe"="C:\WINDOWS\V0420Mon.exe" [2007-04-30 32768] "Ulead AutoDetector"="C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe" [2005-07-28 94208] "Ulead Calendar Checker"="C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe" [2005-08-22 69632] "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-07-26 219136] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "ShowDeskFix"="shell32" [X] C:\Documents and Settings\home\Start Menu\Programs\Startup\ OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-07-26 839680] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\Network Diagnostic\xpnetdiag.exe"= "%windir%\system32\sessmgr.exe"= "C:\Program Files\Messenger\msmsgs.exe"= "C:\Program Files\Grisoft\AVG7\avginet.exe"= "C:\Program Files\Grisoft\AVG7\avgamsvr.exe"= "C:\Program Files\Grisoft\AVG7\avgcc.exe"= "C:\Program Files\Grisoft\AVG7\avgemc.exe"= "C:\Program Files\BearShare Applications\BearShare\BearShare.exe"= "C:\Program Files\Mozilla Firefox\firefox.exe"= "C:\Program Files\SightSpeed\SightSpeed.exe"= "C:\Program Files\Skype\Phone\Skype.exe"= "C:\Program Files\Windows Live\Messenger\wlcsdk.exe"= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16174:TCP"= 16174:TCP:BitComet 16174 TCP "16174:UDP"= 16174:UDP:BitComet 16174 UDP S2 IKANLOADER2;General Purpose USB Driver (e4ldr.sys);C:\WINDOWS\system32\Drivers\e4ldr.sys [2006-03-03 63555] S3 e4usbaw;USB ADSL2 WAN Adapter;C:\WINDOWS\system32\DRIVERS\e4usbaw.sys [2006-05-05 114616] S3 V0420VID;Live! Cam Vista IM (VF0420);C:\WINDOWS\system32\DRIVERS\V0420Vid.sys [2007-05-31 99648] . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-19 11:09:56 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-10-19 11:15:44 - machine was rebooted ComboFix-quarantined-files.txt 2008-10-19 10:15:40 ComboFix2.txt 2008-10-16 23:21:24 ComboFix3.txt 2008-10-16 22:44:03 Pre-Run: 141,322,035,200 bytes free Post-Run: 141,314,326,528 bytes free 358 --- E O F --- 2008-10-17 00:01:04

Destrio5 · Answer

---> Poste un nouveau rapport HijackThis.

Ton PC va mieux ?

Bauzau · Answer

Non c'est toujours pareil  :-(

Bauzau · Answer

Voici le rapport avec hijackThis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:47:03 PM, on 10/19/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20900)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\CTSvcCDA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\News\NewsUpd.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\V0420Mon.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.jhoos.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O4 - HKLM\..\Run: [NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [pdn] C:\WINDOWS\system32\pdn.exe \j
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
O8 - Extra context menu item: Download with ImTOO Download YouTube Video - C:\Program Files\ImTOO\Download YouTube Video\upod_link.HTM
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB9D5A95-7C09-4BDA-8B40-41FE3AB98CC3}: NameServer = 202.123.2.35 202.123.2.11
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Audio Service (STacSV) - Unknown owner - c:\docume~1\home\locals~1	emp\cdm\{4a9aaaac-eee3-429d-b7f3-775a61566db2}\STacSV.exe (file missing)

Destrio5 · Answer

Installe la version 8 d'AVG.

Pourquoi tu n'as pas fait MSNFix ?

Bauzau · Answer

Mais tu ma dis de faire avec HijackThis,maintenant tu me demande de le faire avec MSNfix ?

Destrio5 · Answer

Refais MSNFix pour voir si tu as l'erreur ECHO.

Bauzau · Answer

Non il y a aucun erreur  qui apparait avec MSNFix

Destrio5 · Answer

http://www.commentcamarche.net/forum/affich 8859734 je pense que c est un virus?page=2#27

Bauzau · Answer

Oui sa met toujour ECHO is off

Destrio5 · Answer

* Télécharge SDFix (par Andy Manchesta) et sauvegarde-le sur ton bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

* Double-clique sur SDFix.exe et choisis Install pour l'extraire dans son dossier sur le bureau.
* Redémarre le PC en mode sans échec :
https://blog.sosordi.net/
* Choisis ton compte.

Déroule la liste des instructions ci-dessous :
* Ouvre le dossier SDFix qui vient d'être créé sur le bureau et double-clique sur RunThis.bat pour lancer le script.
* Appuie sur Y pour commencer le nettoyage.
* Quand il te le demandera, appuie sur une touche pour redémarrer le PC.
* Ton système sera plus long à redémarrer car l'outil va continuer à s'exécuter et supprimer des fichiers.
* Après le chargement du bureau, l'outil aura terminé et affichera Finished.
* Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton bureau.
* Le rapport SDFix s'ouvrira et il sera enregistré dans le dossier SDFix sous le nom Report.txt.
* Enfin, copie/colle le rapport du fichier Report.txt.

Bauzau · Answer

Quand je double clicque sur SDFix en mode sans échec sa me donne cette Rapport 

SDFix has been extracted to %systemdrive%\SDFix\
(Drive that contains the Windows directory - typically C:\SDFix)

Open the SDFix folder in Safe Mode and double click the RunThis.bat file to start the fixtool
If RunThis.bat is started in Normal Mode, options to download and run Anti-Virus command line scanners are displayed

Catchme.exe Stealth Malware Detector by GMER is also included in the SDFix folder

Additional SDFix Instructions & screen shots can be found here - http://www.bleepingcomputer.com/forums/topic131299.html






SDFix a été extrait dans %systemdrive%\SDFix\
(Le disque qui contient le répertoire Windows - typiquement C:\SDFix)

Ouvrez le dossier SDFix en mode sans échec et double clique sur le fichier RunThis.bat pour démarrer l'outil.
Si RunThis.bat est lancé en mode normal, les options pour télécharger et lancer les scanners Antivirus en ligne de commande seront affichées

Catchme.exe Stealth Malware Detector de GMER est également inclus dans le dossier SDFix

Instructions supplémentaires pour SDFix & captures d'écran peuvent être trouvées ici - http://www.bleepingcomputer.com/forums/topic131299.html

Destrio5 · Answer

Il est où ton dossier SDFix ?

Bauzau · Answer

Sur bureau

Bauzau · Answer

Mais la je le vois plus

Bauzau · Answer

Mais la je le vois plu

Destrio5 · Answer

Mets le dossier SDFix qui contient le fichier RunThis dans C:\

Bauzau · Answer

Comment faire sa  :-)

Destrio5 · Answer

Tu ne sais pas déplacer un dossier ?

Bauzau · Answer

J'ai regarder dans c:\ est j'ai vu le dossier SDFix dans apps

Destrio5 · Answer

Dans Apps ??

Bauzau · Answer

Oui quand j'ouvre SDFix

Bauzau · Answer

Enfin c'est dans LOCAL DISK (c:)

Destrio5 · Answer

Quand tu ouvres ton local disk, tu vois le dossier SDFix ?

Bauzau · Answer

Oui c'est sa

Destrio5 · Answer

Et dedans, tu as le fichier RunThis ?

Bauzau · Answer

Non je vois pas

Destrio5 · Answer

Supprime le dossier SDFix et prends celui qui est sur le Bureau.

Bauzau · Answer

Je fais quoi avec celui qui est sur bureau ?

Destrio5 · Answer

Tu le mets dans C:\

De façon à avoir :

C:\SDFix\RunThis.bat

Bauzau · Answer

C'est bon maintenant quand je rentre dans Local Disk je vois  RUNThis

Bauzau · Answer

Est j'ai 2 thread qui est parti dans virus vault

Destrio5 · Answer

Je ne comprends pas.

Bauzau · Answer

Moi non plu mais quand j'ai fais le fichier devenir C:\SDFix\RunThis y a mon antivus (AVG) qui c'est ouvert est ma dis 2 thread move into virus vault

Bauzau · Answer

Bon je pense que je dois faire quelque chose avec le RUNThis en safe mode ?

Destrio5 · Answer

Je n'arriverais pas à te faire comprendre ce que je voudrais.

Bauzau · Answer

Mais quand je clique sur RUNThis y a le tableau bleu qui s'ouvre ques-ce que je dois faire ensuite ?

Destrio5 · Answer

En mode sans échec, il faut le faire.

Bauzau · Answer

Oui est après ?

Destrio5 · Answer

http://www.commentcamarche.net/forum/affich 8859734 je pense que c est un virus?page=4#79

Bauzau · Answer

Mais il n'y a pas Y dans le RUNThis y a que  1.2,3,4   A,B, C,D, H,R est U

Destrio5 · Answer

Tu es en mode normal ?

Bauzau · Answer

Oui , ah d'accord sa veux dire que sa va changer ,ok !

Destrio5 · Answer

...........................

En mode sans échec, tu n'as pas les mêmes options qu'en mode normal.

Bauzau · Answer

Bonsoir ,
Cette fois ci je pense que je l'ai bien fais :-)

[b]SDFix: Version 1.236 [/b]
Run by home on Mon 10/20/2008 at 06:38 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\Documents and Settings\home\Desktop\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\DOCUME~1\home\LOCALS~1\Temp\photo.zip - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-20 18:50:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Grisoft\AVG7\avginet.exe"="C:\Program Files\Grisoft\AVG7\avginet.exe:*:Enabled:avginet.exe"
"C:\Program Files\Grisoft\AVG7\avgamsvr.exe"="C:\Program Files\Grisoft\AVG7\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\Program Files\Grisoft\AVG7\avgcc.exe"="C:\Program Files\Grisoft\AVG7\avgcc.exe:*:Enabled:avgcc.exe"
"C:\Program Files\Grisoft\AVG7\avgemc.exe"="C:\Program Files\Grisoft\AVG7\avgemc.exe:*:Enabled:avgemc.exe"
"C:\Program Files\BearShare Applications\BearShare\BearShare.exe"="C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"
"C:\Program Files\SightSpeed\SightSpeed.exe"="C:\Program Files\SightSpeed\SightSpeed.exe:*:Enabled:SightSpeed"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Documents and Settings\home\dldckh.exe"="C:\Documents and Settings\home\dldckh.exe:*:Enabled:ENABLE"
"C:\WINDOWS\system32\pdn.exe"="C:\WINDOWS\system32\pdn.exe:*:Enabled:ENABLE"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\DOCUME~1\home\Desktop\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Tue  7 Oct 2008        19,968 ...H. --- "C:\Documents and Settings\home\dldckh.exe"
Thu 25 Sep 2008         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

[b]Finished![/b]

Destrio5 · Answer

Bien, analyse le fichier suivant : 

C:\Documents and Settings\home\dldckh.exe

Sur VirusTotal :
https://www.virustotal.com/gui/

Bauzau · Answer

Voila sa me dis 


Le fichier a déjà été analysé:
MD5: 	61798814e7e4639b9d2cf1b9180b6884
First received: 	2008.10.07 20:31:00 (CET)
Date 	2008.10.18 14:02:23 (CET) [>2D]
Résultats 	25/35
Permalink: 	analisis/77007725e099e24925969d75948f39a2

Destrio5 · Answer

Tu peux pas me fournir un lien à la place ?

Bauzau · Answer

http://www.virustotal.com/fr/analisis/2617ba19fc89167676f4a4ee7415bd03

Destrio5 · Answer

---> Désinstalle AVG8.

---> Installe Antivir :
http://www.commentcamarche.net/telecharger/telecharger 55 antivir

---> Configure-le avec ce tuto (Les images peuvent différées) :
http://speedweb1.free.fr/frames2.php?page=tuto5

---> Fais un scan complet et poste le rapport.

Bauzau · Answer

J'ai désinstaller tout mon Antivirus AVG maintenant antivir est en train de télécharger

Lyonnais92 · Answer

Bonjour,

je ne sais pas ce qu'il y a à tirer de ça :

https://r.virscan.org/4ab7e95d599398b7ba82cceb7cc4be97

mais ce fichier à la même taille et le même MD5 que 

2008-10-10 22:45 . 2008-10-07 10:01 19,968 --a------ C:\WINDOWS\system32\pdn.exe 


peut être aussi regarder de ce côté :

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Disc Detector = C:\Program Files\Creative\ShareDLL\CtNotify.exe?X???(???????????? C?????Disc Detector?B???A???????A?? ????B???@?$?@?? C?????U?@?????????@?B???A???????A?p ????B???@?????P???$?@? ??????~?B~??????????@???????????????????B?????| ???????????????????P????????B

Destrio5 · Answer

Ça fait partie du nouveau virus MSN.

Bauzau · Answer

Moi je comprend rien a tout sa :-)   Destrio5  antivir est toujours en train de télécharger

Destrio5 · Answer

Ok mais ça fait un peu long le téléchargement.

Bauzau · Answer

Dis moi le scan complet je le fais en safe mode ou pas nécessairement ?

Destrio5 · Answer

Mode sans échec préférable.

Bauzau · Answer

J'ai fais sans échec mais le rapport a disparu donc je l'ai refais en mode normal 

 Avira AntiVir Personal
Report file date: Monday, October 20, 2008  21:46

Scanning for 1369550 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 3)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    HOME-80C6BB336C

Version information:
BUILD.DAT     : 8.1.0.331      16934 Bytes   8/12/2008 11:46:00
AVSCAN.EXE    : 8.1.4.7       315649 Bytes   6/26/2008 09:57:53
AVSCAN.DLL    : 8.1.4.0        40705 Bytes   5/26/2008 08:56:40
LUKE.DLL      : 8.1.4.5       164097 Bytes   6/12/2008 13:44:19
LUKERES.DLL   : 8.1.4.0        12033 Bytes   5/26/2008 08:58:52
ANTIVIR0.VDF  : 6.40.0.0    11030528 Bytes   7/18/2007 11:33:34
ANTIVIR1.VDF  : 7.0.5.1      8182784 Bytes   6/24/2008 14:54:15
ANTIVIR2.VDF  : 7.0.5.20      142336 Bytes   6/30/2008 06:20:53
ANTIVIR3.VDF  : 7.0.5.23       17408 Bytes   6/30/2008 10:24:47
Engineversion : 8.1.1.19  
AEVDF.DLL     : 8.1.0.5       102772 Bytes   2/25/2008 10:58:21
AESCRIPT.DLL  : 8.1.0.63      311673 Bytes    8/6/2008 14:13:47
AESCN.DLL     : 8.1.0.23      119156 Bytes   7/10/2008 13:44:49
AERDL.DLL     : 8.1.0.20      418165 Bytes   4/24/2008 13:37:48
AEPACK.DLL    : 8.1.2.1       364917 Bytes   7/15/2008 13:58:35
AEOFFICE.DLL  : 8.1.0.21      192891 Bytes   7/18/2008 07:35:21
AEHEUR.DLL    : 8.1.0.47     1368437 Bytes    8/6/2008 14:13:47
AEHELP.DLL    : 8.1.0.15      115063 Bytes   7/10/2008 13:44:48
AEGEN.DLL     : 8.1.0.35      315764 Bytes    8/6/2008 15:38:47
AEEMU.DLL     : 8.1.0.7       430452 Bytes   7/31/2008 09:33:21
AECORE.DLL    : 8.1.1.8       172406 Bytes   7/31/2008 09:33:21
AEBB.DLL      : 8.1.0.1        53617 Bytes   7/10/2008 13:44:48
AVWINLL.DLL   : 1.0.0.12       15105 Bytes    7/9/2008 09:40:05
AVPREF.DLL    : 8.0.2.0        38657 Bytes   5/16/2008 10:28:01
AVREP.DLL     : 7.0.0.1       155688 Bytes   6/30/2008 15:35:20
AVREG.DLL     : 8.0.0.1        33537 Bytes    5/9/2008 12:26:40
AVARKT.DLL    : 1.0.0.23      307457 Bytes   2/12/2008 09:29:23
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes   6/12/2008 13:27:49
SQLITE3.DLL   : 3.3.17.1      339968 Bytes   1/22/2008 18:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes   6/12/2008 13:49:40
NETNT.DLL     : 8.0.0.1         7937 Bytes   1/25/2008 13:05:10
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes   6/12/2008 14:48:07
RCTEXT.DLL    : 8.0.52.0       86273 Bytes   6/27/2008 14:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: Monday, October 20, 2008  21:46

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'update.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'NclRSSrv.exe' - '1' Module(s) have been scanned
Scan process 'NclUSBSrv.exe' - '1' Module(s) have been scanned
Scan process 'MPAPI3s.exe' - '1' Module(s) have been scanned
Scan process 'ServiceLayer.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'CTLCMgr.exe' - '1' Module(s) have been scanned
Scan process 'PCSuite.exe' - '1' Module(s) have been scanned
Scan process 'PcSync2.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'CalCheck.exe' - '1' Module(s) have been scanned
Scan process 'Monitor.exe' - '1' Module(s) have been scanned
Scan process 'Mediadet.exe' - '1' Module(s) have been scanned
Scan process 'V0420Mon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'sttray.exe' - '1' Module(s) have been scanned
Scan process 'CTNotify.exe' - '1' Module(s) have been scanned
Scan process 'NewsUpd.exe' - '1' Module(s) have been scanned
Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ctsvccda.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
43 processes with 43 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '59' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!


End of the scan: Monday, October 20, 2008  22:15
Used time: 28:49 Minute(s)

The scan has been done completely.

   5123 Scanning directories
 259605 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 259604 Files not concerned
   1880 Archives were scanned
      1 Warnings
      0 Notes

Destrio5 · Answer

Il avait trouvé des choses ?

Tu peux avoir le rapport en cherchant un peu dans Antivir.

Bauzau · Answer

Non je trouve pas , Mais je me rappelle que il y avais trouver qu'un warning la même chose quand je l'ai fais en mode normal

Destrio5 · Answer

Ok, sinon, ça va mieux ?

Bauzau · Answer

Non sa refais la même chose , y a des fenêtre de mes contact qui font des flash sur mon écran est quand j'essaie de me déconnecter sa bloc a peut prés trois second

Destrio5 · Answer

* Rends-toi à l'onglet Affichage
* Menu "Outils "
* Clique sur "Options des dossiers... "
* Puis clique sur l'onglet "Affichage"
* Coche la case "Afficher les fichiers et dossiers cachés"
* Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"
* Clique sur le bouton "Appliquer à tous les dossiers" puis clique sur "OK"

Bauzau · Answer

Dans le windows live messenger tu me demande ?

Destrio5 · Answer

Non, dans Mes Documents par exemple.

Bauzau · Answer

Ok je l'ai fais

Destrio5 · Answer

Refais un scan avec Antivir en mode normal.

Bauzau · Answer

Voila 

Avira AntiVir Personal
Report file date: Monday, October 20, 2008  23:31

Scanning for 1369550 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 3)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    HOME-80C6BB336C

Version information:
BUILD.DAT     : 8.1.0.331      16934 Bytes   8/12/2008 11:46:00
AVSCAN.EXE    : 8.1.4.7       315649 Bytes   6/26/2008 09:57:53
AVSCAN.DLL    : 8.1.4.0        40705 Bytes   5/26/2008 08:56:40
LUKE.DLL      : 8.1.4.5       164097 Bytes   6/12/2008 13:44:19
LUKERES.DLL   : 8.1.4.0        12033 Bytes   5/26/2008 08:58:52
ANTIVIR0.VDF  : 6.40.0.0    11030528 Bytes   7/18/2007 11:33:34
ANTIVIR1.VDF  : 7.0.5.1      8182784 Bytes   6/24/2008 14:54:15
ANTIVIR2.VDF  : 7.0.5.20      142336 Bytes   6/30/2008 06:20:53
ANTIVIR3.VDF  : 7.0.5.23       17408 Bytes   6/30/2008 10:24:47
Engineversion : 8.1.1.19  
AEVDF.DLL     : 8.1.0.5       102772 Bytes   2/25/2008 10:58:21
AESCRIPT.DLL  : 8.1.0.63      311673 Bytes    8/6/2008 14:13:47
AESCN.DLL     : 8.1.0.23      119156 Bytes   7/10/2008 13:44:49
AERDL.DLL     : 8.1.0.20      418165 Bytes   4/24/2008 13:37:48
AEPACK.DLL    : 8.1.2.1       364917 Bytes   7/15/2008 13:58:35
AEOFFICE.DLL  : 8.1.0.21      192891 Bytes   7/18/2008 07:35:21
AEHEUR.DLL    : 8.1.0.47     1368437 Bytes    8/6/2008 14:13:47
AEHELP.DLL    : 8.1.0.15      115063 Bytes   7/10/2008 13:44:48
AEGEN.DLL     : 8.1.0.35      315764 Bytes    8/6/2008 15:38:47
AEEMU.DLL     : 8.1.0.7       430452 Bytes   7/31/2008 09:33:21
AECORE.DLL    : 8.1.1.8       172406 Bytes   7/31/2008 09:33:21
AEBB.DLL      : 8.1.0.1        53617 Bytes   7/10/2008 13:44:48
AVWINLL.DLL   : 1.0.0.12       15105 Bytes    7/9/2008 09:40:05
AVPREF.DLL    : 8.0.2.0        38657 Bytes   5/16/2008 10:28:01
AVREP.DLL     : 7.0.0.1       155688 Bytes   6/30/2008 15:35:20
AVREG.DLL     : 8.0.0.1        33537 Bytes    5/9/2008 12:26:40
AVARKT.DLL    : 1.0.0.23      307457 Bytes   2/12/2008 09:29:23
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes   6/12/2008 13:27:49
SQLITE3.DLL   : 3.3.17.1      339968 Bytes   1/22/2008 18:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes   6/12/2008 13:49:40
NETNT.DLL     : 8.0.0.1         7937 Bytes   1/25/2008 13:05:10
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes   6/12/2008 14:48:07
RCTEXT.DLL    : 8.0.52.0       86273 Bytes   6/27/2008 14:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: Monday, October 20, 2008  23:31

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'NclRSSrv.exe' - '1' Module(s) have been scanned
Scan process 'NclUSBSrv.exe' - '1' Module(s) have been scanned
Scan process 'MPAPI3s.exe' - '1' Module(s) have been scanned
Scan process 'ServiceLayer.exe' - '1' Module(s) have been scanned
Scan process 'soffice.bin' - '1' Module(s) have been scanned
Scan process 'soffice.exe' - '1' Module(s) have been scanned
Scan process 'dslmon.exe' - '1' Module(s) have been scanned
Scan process 'CTLCMgr.exe' - '1' Module(s) have been scanned
Scan process 'PCSuite.exe' - '1' Module(s) have been scanned
Scan process 'PcSync2.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'CalCheck.exe' - '1' Module(s) have been scanned
Scan process 'Monitor.exe' - '1' Module(s) have been scanned
Scan process 'Mediadet.exe' - '1' Module(s) have been scanned
Scan process 'V0420Mon.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'sttray.exe' - '1' Module(s) have been scanned
Scan process 'CTNotify.exe' - '1' Module(s) have been scanned
Scan process 'NewsUpd.exe' - '1' Module(s) have been scanned
Scan process 'WgaTray.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'Ctsvccda.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
44 processes with 44 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '59' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
    [WARNING]   The file could not be opened!


End of the scan: Tuesday, October 21, 2008  00:03
Used time: 31:18 Minute(s)

The scan has been done completely.

   5123 Scanning directories
 259378 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      1 Files cannot be scanned
 259377 Files not concerned
   1906 Archives were scanned
      1 Warnings
      0 Notes

Destrio5 · Answer

- Fais un scan en ligne ici https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr (Avec Internet Explorer)

- En bas à droite, clique sur Démarrer Online-scanner

- Dans la nouvelle fenêtre qui s'affiche, clique sur J'accepte

- Accepte les Contrôles ActiveX

- Choisis Poste de travail pour le scan.

- Celui-ci terminé, sauvegarde (Choisis fichier texte) et poste le rapport

- Pour t'aider à utiliser le scan en ligne :
https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId291566

NOTE : Si tu reçois le message "La licence de Kaspersky On-line Scanner est périmée", va dans Ajout/Suppression de programmes puis désinstalle On-Line Scanner, reconnecte-toi sur le site de Kaspersky pour retenter le scan en ligne.

- Lis ceci en cas de problème d'installation du Contrôle ActiveX :
http://cybersecurite.xooit.com/t123-Les-controles-ActiveX.htm

Bauzau · Answer

Voici le rapport 

-------------------------------------------------------------------------------
 KASPERSKY ON-LINE SCANNER REPORT
 Tuesday, October 21, 2008 4:59:57 PM
 Système d'exploitation : Microsoft Windows XP Professional, Service Pack 3 (Build 2600)
 Kaspersky On-line Scanner version : 5.0.84.2
 Dernière mise à jour de la base antivirus Kaspersky : 21/10/2008
 Enregistrements dans la base antivirus Kaspersky : 1192296
-------------------------------------------------------------------------------

Paramètres d'analyse:
	Analyser avec la base antivirus suivante: standard
	Analyser les archives: vrai
	Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
	C:\
	D:\

Statistiques de l'analyse:
	Total d'objets analysés: 65581
	Nombre de virus trouvés: 1
	Nombre d'objets infectés: 20 / 0
	Nombre d'objets suspects: 0
	Durée de l'analyse: 01:09:32

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\cert8.db	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\content-prefs.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\cookies.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\downloads.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\formhistory.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\key3.db	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\parent.lock	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\permissions.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\places.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\places.sqlite-journal	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\search.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Cookies\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Desktop\SDFix\backups\backups.zip/backups/photo.zip/photo1226.jpeg-www.myspace.com	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\Documents and Settings\home\Desktop\SDFix\backups\backups.zip/backups/photo.zip	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\Documents and Settings\home\Desktop\SDFix\backups\backups.zip	ZIP: infecté - 2	ignoré
C:\Documents and Settings\home\dldckh.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\Documents and Settings\home\dldckh.MSNFix	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Adobe\Acrobat\9.0\Updater\updater.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Adobe\Updater6\aumLib.log	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_001_	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_002_	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_003_	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_MAP_	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\urlclassifier3.sqlite	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\History\History.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings	emp\A9R7D06.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings	emp\etilqs_HHFicldavZR4rLmugoI2	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings	emp\NGLALog.txt	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings	emp\photo.zip/photo1226.jpeg-www.myspace.com	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\Documents and Settings\home\Local Settings	emp\photo.zip	ZIP: infecté - 1	ignoré
C:\Documents and Settings\home\Local Settings	emp\~DF6216.tmp	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\Local Settings\Temporary Internet Files\Content.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\home\My Documents\Mes fichiers reçus\photo.zip/photo1226.jpeg-www.myspace.com	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\Documents and Settings\home\My Documents\Mes fichiers reçus\photo.zip	ZIP: infecté - 1	ignoré
C:\Documents and Settings\home
tuser.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\home
tuser.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Cookies\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService
tuser.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\LocalService
tuser.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT	L'objet est verrouillé	ignoré
C:\Documents and Settings\NetworkService
tuser.dat.LOG	L'objet est verrouillé	ignoré
C:\Qoobox\Quarantine\C\Documents and Settings\home\dldckh.exe.vir	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\Qoobox\Quarantine\C\WINDOWS\system32\pdn.exe.vir	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase	L'objet est verrouillé	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP102\change.log	L'objet est verrouillé	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP70\A0017183.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP71\A0018335.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP87\A0023066.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP87\A0023070.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP89\A0023438.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP89\A0023442.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP90\A0023711.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\System Volume Information\_restore{A9A67712-FBB8-418B-B2CB-232F766D474E}\RP90\A0023715.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\WINDOWS\Debug\PASSWD.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\SchedLgU.Txt	L'objet est verrouillé	ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log	L'objet est verrouillé	ignoré
C:\WINDOWS\Sti_Trace.log	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\CatRoot2\edb.log	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\CatRoot2	mp.edb	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\AppEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\default	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\default.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\Internet.evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SAM	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SAM.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SecEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SECURITY	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SECURITY.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\software	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\software.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\SysEvent.Evt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\system	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\config\system.LOG	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\h323log.txt	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\pdn.exe	Infecté : Backdoor.Win32.Agent.tdw	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA	L'objet est verrouillé	ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP	L'objet est verrouillé	ignoré
C:\WINDOWS\wiadebug.log	L'objet est verrouillé	ignoré
C:\WINDOWS\wiaservc.log	L'objet est verrouillé	ignoré
C:\WINDOWS\WindowsUpdate.log	L'objet est verrouillé	ignoré

Analyse terminée.

Destrio5 · Answer

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:files 
C:\Documents and Settings\home\dldckh.exe
C:\Documents and Settings\home\dldckh.MSNFix
C:\Documents and Settings\home\Local Settings	emp\photo.zip/photo1226.jpeg-www.myspace.com
C:\Documents and Settings\home\Local Settings	emp\photo.zip ZIP
C:\Documents and Settings\home\My Documents\Mes fichiers reçus\photo.zip/photo1226.jpeg-www.myspace.com
C:\Documents and Settings\home\My Documents\Mes fichiers reçus\photo.zip
C\WINDOWS\system32\pdn.exe

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Bauzau · Answer

Voila c'est la Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! Error: Unable to interpret in the current context! ========== COMMANDS ========== File delete failed. C:\DOCUME~1\home\LOCALS~1\Temp\etilqs_xfeKqE6VFTbxBOV4w3AA scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\home\LOCALS~1\Temp\NGLALog.txt scheduled to be deleted on reboot. File delete failed. C:\DOCUME~1\home\LOCALS~1\Temp\~DF8034.tmp scheduled to be deleted on reboot. User's Temp folder emptied. User's Temporary Internet Files folder emptied. User's Internet Explorer cache folder emptied. Local Service Temp folder emptied. File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. Local Service Temporary Internet Files folder emptied. Windows Temp folder emptied. Java cache emptied. File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_001_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_002_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_003_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\urlclassifier3.sqlite scheduled to be deleted on reboot. FireFox cache emptied. Temp folders emptied. Explorer started successfully OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10212008_211754 Files moved on Reboot... File C:\DOCUME~1\home\LOCALS~1\Temp\etilqs_xfeKqE6VFTbxBOV4w3AA not found! C:\DOCUME~1\home\LOCALS~1\Temp\NGLALog.txt moved successfully. C:\DOCUME~1\home\LOCALS~1\Temp\~DF8034.tmp moved successfully. File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_001_ moved successfully. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_002_ moved successfully. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_003_ moved successfully. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_MAP_ moved successfully. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\urlclassifier3.sqlite moved successfully.

Destrio5 · Answer

Je me suis un peu trompé.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous :





:processes
explorer.exe

:files
C:\Documents and Settings\home\dldckh.exe
C:\Documents and Settings\home\dldckh.MSNFix
C:\Documents and Settings\home\Local Settings	emp\photo.zip
C:\Documents and Settings\home\My Documents\Mes fichiers reçus\photo.zip
C:\WINDOWS\system32\pdn.exe

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Bauzau · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
File/Folder C:\Documents and Settings\home\dldckh.exe not found.
File/Folder C:\Documents and Settings\home\dldckh.MSNFix not found.
C:\Documents and Settings\home\Local Settings	emp\photo.zip moved successfully.
C:\Documents and Settings\home\My Documents\Mes fichiers reçus\photo.zip moved successfully.
C:\WINDOWS\system32\pdn.exe moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\home\LOCALS~1\Temp\etilqs_xejxfKwohgugqZfbHnpH scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\home\LOCALS~1\Temp\NGLALog.txt scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\home\LOCALS~1\Temp\~DFCC9E.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10212008_215907

Files moved on Reboot...
File C:\DOCUME~1\home\LOCALS~1\Temp\etilqs_xejxfKwohgugqZfbHnpH not found!
C:\DOCUME~1\home\LOCALS~1\Temp\NGLALog.txt moved successfully.
C:\DOCUME~1\home\LOCALS~1\Temp\~DFCC9E.tmp moved successfully.
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\pxotx1im.default\urlclassifier3.sqlite moved successfully.

Destrio5 · Answer

On dirait que ça a marché. Qu'en dis-tu ?

Bauzau · Answer

je sais pas...je vais te faire savoir

Bauzau · Answer

Effectivement sa a marché :-) , mille merci ,dis moi tu es le fils de Bill gates :-) ?

Destrio5 · Answer

On va finir quand même.

---> Poste un nouveau rapport HijackThis.

Bauzau · Answer

Voila c'est la Mr.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:13:21 PM, on 10/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20900)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\CTSvcCDA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\News\NewsUpd.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\V0420Mon.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O4 - HKLM\..\Run: [NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [pdn] C:\WINDOWS\system32\pdn.exe \j
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000
O8 - Extra context menu item: Download with ImTOO Download YouTube Video - C:\Program Files\ImTOO\Download YouTube Video\upod_link.HTM
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB9D5A95-7C09-4BDA-8B40-41FE3AB98CC3}: NameServer = 202.123.2.35 202.123.2.11
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Audio Service (STacSV) - Unknown owner - c:\docume~1\home\locals~1	emp\cdm\{4a9aaaac-eee3-429d-b7f3-775a61566db2}\STacSV.exe (file missing)

Destrio5 · Answer

---> Relance HijackThis et choisis Do a system scan only

---> Coche les cases qui sont devant les lignes suivantes :

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"     

O4 - HKLM\..\Run: [pdn] C:\WINDOWS\system32\pdn.exe \j 

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"     

O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZRfox000 

O23 - Service: Audio Service (STacSV) - Unknown owner - c:\docume~1\home\locals~1	emp\cdm\{4a9aaaac-eee3-429d-b7f3-775a61566db2}\STacSV.exe (file missing)     

---> Clique en bas sur Fix checked. Mets oui si HijackThis te demande quelque chose.

---> Redémarre ton PC et poste un nouveau rapport HijackThis.

Bauzau · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:31:35 PM, on 10/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20900)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\CTSvcCDA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\News\NewsUpd.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\V0420Mon.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O4 - HKLM\..\Run: [NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: Download with ImTOO Download YouTube Video - C:\Program Files\ImTOO\Download YouTube Video\upod_link.HTM
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB9D5A95-7C09-4BDA-8B40-41FE3AB98CC3}: NameServer = 202.123.2.35 202.123.2.11
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Audio Service (STacSV) - Unknown owner - c:\docume~1\home\locals~1	emp\cdm\{4a9aaaac-eee3-429d-b7f3-775a61566db2}\STacSV.exe (file missing)

Destrio5 · Answer

---> Menu Démarrer > Exécuter > Tape cmd et valide par Entrée.

---> Dans la fenêtre noire, tape sc delete STacSV et valide.

Bauzau · Answer

Sa me dis 
[sc] DeleteService SUCCESS

Destrio5 · Answer

Cool, poste un nouveau rapport HijackThis.

Bauzau · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:43:52 PM, on 10/22/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20900)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\CTSvcCDA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\News\NewsUpd.EXE
C:\Program Files\Creative\ShareDLL\CtNotify.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\V0420Mon.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\Program Files\Creative\ShareDLL\MediaDet.Exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O4 - HKLM\..\Run: [NewsUpd] C:\Program Files\Creative\News\NewsUpd.EXE /q
O4 - HKLM\..\Run: [Disc Detector] C:\Program Files\Creative\ShareDLL\CtNotify.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe
O4 - HKLM\..\Run: [Ulead AutoDetector] C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
O4 - HKLM\..\Run: [Ulead Calendar Checker] C:\Program Files\Ulead Systems\Ulead Photo Express 6\CalCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Creative Live! Cam Manager] "C:\Program Files\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe"
O4 - HKCU\..\Run: [Free Download Manager] "C:\Program Files\Free Download Manager\fdm.exe" -autorun
O4 - HKUS\S-1-5-19\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [ShowDeskFix] regsvr32 /s /n /i:u shell32 (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: Download with ImTOO Download YouTube Video - C:\Program Files\ImTOO\Download YouTube Video\upod_link.HTM
O8 - Extra context menu item: Tout télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Télécharger avec Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: Télécharger la sélection avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Télécharger la vidéo avec Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
O16 - DPF: {A1F2F2CE-06AF-483C-9F12-D3BAA72477D6} (BatchDownloader Class) - http://appdirectory.messenger.msn.com/AppDirectory/P4Apps/PhotoSwap/DigWXMSN.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CB9D5A95-7C09-4BDA-8B40-41FE3AB98CC3}: NameServer = 202.123.2.35 202.123.2.11
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSvcCDA.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

Destrio5 · Answer

Pour finir :

---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.

---> Télécharge Tools Cleaner sur ton Bureau :
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner
* Clique sur Recherche et laisse le scan agir.
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives.
* Clique sur Quitter pour obtenir le rapport. 
* Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

---> Il est nécessaire de désactiver puis réactiver la restauration système pour la purger :
http://www.infos-du-net.com/forum/272480-11-desactiver-activer-restauration-systeme

---> Je te conseille de créer un point de restauration que tu pourras utiliser plus tard si tu as un problème :
https://www.vulgarisation-informatique.com/creer-point-restauration.php

Bauzau · Answer

[ Rapport ToolsCleaner version 2.2.4 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Documents and Settings\home\Desktop\ComboFix.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\WINDOWS\system32\*.msnfix: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\home\Desktop\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: ERREUR DE SUPPRESSION !!
C:\WINDOWS\system32\*.msnfix: ERREUR DE SUPPRESSION !!
C:\Program Files\Trend Micro\HijackThis: ERREUR DE SUPPRESSION !!

Sauvegarde du registre crée !

Destrio5 · Answer

Supprime HijackThis, ComboFix et Tools Cleaner.

Des questions ?

Bauzau · Answer

Oui tu es d'ou ?  :-)

Destrio5 · Answer

Ile de France.

Bauzau · Answer

Ah ok, moi ile maurice

Destrio5 · Answer

Ok ;)

Je pense que c'est un virus - Page 8

Discussions similaires

Newsletters