Pilotes cachés mchInjDrv.sys - arexrdv.sys

Question

Bonjour,

Depuis une semaine AVG 8.0 accuse les pilotes cachés mchInjDrv.sys et akp9x9z.sys. J'essaye de les éffacer avec AVG, les fichiers sont verrouillés. Je passe AVG en mode sans échec. Je rédemarre, scanne de nouveau avec AVG et un de ces pilotes cachés, le akpw9x9z.sys a disparu mais il y a un autre: arexrdv.sys. MchInjDrv.sys continue.

J'ai recherché des solutions dans Commentcamarche. J'installe jv16, il n'arrive pas à nettoyer les bestioles. J'installe Regseeker qui pourtant a resolu le problème d'un autre personne sur commentcamarche. Regseeker me montre qu'il a nettoyé mchInjDrv. Je scanne de nouveau avec Regseeker et mchInjDrv est toujours la. Aucun de ces deux logiciels arrive à trouver le arexrdv.sys et pourtant AVG me montre qu'il continue la.

Je poste ci-dessous le rapport de jv16:

jv16 PowerTools 2008 [1.8.0.472]

Data fields are: Key, Entry's name, Value, Entry last modified

HKLM\system\controlset001\enum\root\legacy_mchinjdrv\, {KEY}, {KEY}, 19.10.2008, 00:14
HKLM\system\controlset001\enum\root\legacy_mchinjdrv\0000\, {KEY}, {KEY}, 19.10.2008, 00:14
HKLM\system\controlset001\enum\root\legacy_mchinjdrv\0000\, Service, mchInjDrv, 19.10.2008, 00:14
HKLM\system\controlset001\enum\root\legacy_mchinjdrv\0000\, DeviceDesc, mchInjDrv, 19.10.2008, 00:14
HKLM\system\currentcontrolset\enum\root\legacy_mchinjdrv\, {KEY}, {KEY}, 19.10.2008, 00:14
HKLM\system\currentcontrolset\enum\root\legacy_mchinjdrv\0000\, {KEY}, {KEY}, 19.10.2008, 00:14
HKLM\system\currentcontrolset\enum\root\legacy_mchinjdrv\0000\, Service, mchInjDrv, 19.10.2008, 00:14
HKLM\system\currentcontrolset\enum\root\legacy_mchinjdrv\0000\, DeviceDesc, mchInjDrv, 19.10.2008, 00:14
HKLM\system\controlset002\enum\root\legacy_mchinjdrv\, {KEY}, {KEY}, 18.10.2008, 20:22
HKLM\system\controlset002\enum\root\legacy_mchinjdrv\0000\, {KEY}, {KEY}, 19.10.2008, 00:00
HKLM\system\controlset002\enum\root\legacy_mchinjdrv\0000\, Service, mchInjDrv, 19.10.2008, 00:00
HKLM\system\controlset002\enum\root\legacy_mchinjdrv\0000\, DeviceDesc, mchInjDrv, 19.10.2008, 00:00

Comment je peux me débarasser de ces bestioles, svp.

Merci d'avance

Zeman

Destrio5 · Answer

Salut,

---> Désactive l'UAC le temps de la désinfection :
http://www.commentcamarche.net/faq/sujet 8343 vista desactiver l uac

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix\Combofix.txt

zeman · Answer

Merci!

Voici le rapport de Combofix. J'ai suivi tes intructions, mais j'ai oublié de désactiver l'UAC... :-(

ComboFix 08-10-18.03 - JS 2008-10-19 5:41:38.2 - NTFSx86
Microsoft® Windows Vista™ Professionnel 6.0.6001.1.1252.1.1036.18.858 [GMT 2:00]
Lancé depuis: C:\Users\JS\Desktop\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\afffdfdce2_z.dll

.
((((((((((((((((((((((((((((( Fichiers créés du 2008-09-19 au 2008-10-19 ))))))))))))))))))))))))))))))))))))
.

2008-10-19 05:36 . 2008-10-19 05:36 318,976 --a------ C:\Windows\System32\CF15442.exe
2008-10-19 03:42 . 2008-10-19 03:42 <REP> d-------- C:\Program Files\jv16 PowerTools 2008
2008-10-19 03:42 . 2008-10-19 03:42 23 --a------ C:\Windows\System32\cbcaadb6_z.ocx
2008-10-18 09:40 . 2008-10-18 09:40 <REP> d-------- C:\Program Files\Microsoft Silverlight
2008-10-18 09:36 . 2008-08-17 12:33 678,408 --a------ C:\Windows\System32\gpprefcl.dll
2008-10-16 11:35 . 2008-09-18 04:16 2,032,640 --a------ C:\Windows\System32\win32k.sys
2008-10-16 11:35 . 2008-09-03 05:59 468,992 --a------ C:\Windows\System32\newdev.dll
2008-10-16 11:35 . 2008-08-27 03:06 288,768 --a------ C:\Windows\System32\drivers\srv.sys
2008-10-16 11:35 . 2008-09-03 05:58 74,752 --a------ C:\Windows\System32\newdev.exe
2008-10-16 11:34 . 2008-09-18 07:09 3,601,464 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-10-16 11:34 . 2008-09-18 07:09 3,549,240 --a------ C:\Windows\System32\ntoskrnl.exe
2008-10-16 11:34 . 2008-10-02 03:32 1,383,424 --a------ C:\Windows\System32\mshtml.tlb
2008-10-16 11:34 . 2008-10-02 05:49 827,392 --a------ C:\Windows\System32\wininet.dll
2008-10-15 22:12 . 2008-10-15 22:12 99,904 --a------ C:\Windows\System32\drivers\AnyDVD.sys
2008-10-12 19:27 . 2008-10-12 19:27 <REP> d-------- C:\Users\JS\AppData\Roaming\r2 Studios
2008-10-12 19:27 . 2008-10-12 19:27 <REP> d-------- C:\Users\All Users\r2 Studios
2008-10-12 19:27 . 2008-10-12 19:27 <REP> d-------- C:\ProgramData\r2 Studios
2008-10-12 19:27 . 2008-10-12 19:27 <REP> d-------- C:\Program Files\r2 Studios
2008-10-08 16:12 . 2008-10-08 16:12 <REP> d-------- C:\Program Files\Common Files\Skype
2008-09-29 11:30 . 2008-09-29 11:32 <REP> d-------- C:\Program Files\Google

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-19 03:43 --------- d-----w C:\Users\JS\AppData\Roaming\Skype
2008-10-19 03:33 --------- d---a-w C:\ProgramData\TEMP
2008-10-19 03:28 --------- d-----w C:\Program Files\ZoneTick
2008-10-19 02:36 351,783 ---ha-w C:\Windows\system32\drivers\vsconfig.xml
2008-10-19 02:19 4,102,144 ----a-w C:\Windows\Internet Logs\xDB96E1.tmp
2008-10-18 22:04 --------- d-----w C:\Users\JS\AppData\Roaming\skypePM
2008-10-18 22:04 --------- d-----w C:\Program Files\Malwarebytes' Anti-Malware
2008-10-18 19:48 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-10-17 08:16 --------- d-----w C:\ProgramData\Microsoft Help
2008-10-17 08:08 --------- d-----w C:\Program Files\Spyware Doctor
2008-10-16 23:02 --------- d-----w C:\Program Files\a-squared Free
2008-10-16 22:19 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-10-16 18:25 38,496 ----a-w C:\Windows\system32\drivers\mbamswissarmy.sys
2008-10-16 18:25 15,504 ----a-w C:\Windows\system32\drivers\mbam.sys
2008-10-16 14:10 --------- d-----w C:\Program Files\Windows Mail
2008-10-10 07:04 18,482,854 ----a-w C:\Windows\Internet Logs\tvDebug.zip
2008-10-08 14:12 --------- d-----w C:\ProgramData\Skype
2008-10-08 14:12 --------- d-----r C:\Program Files\Skype
2008-09-29 19:33 1,610,240 ----a-w C:\Windows\Internet Logs\xDB9BF0.tmp
2008-09-29 11:07 351,783 ---ha-w C:\Windows\system32\drivers\vsconfig(136).xml
2008-09-29 11:05 4,373,504 ----a-w C:\Windows\Internet Logs\xDBA1AB.tmp
2008-09-16 23:30 2,793,472 ----a-w C:\Windows\Internet Logs\xDB9E41.tmp
2008-09-15 19:44 3,435,520 ----a-w C:\Windows\Internet Logs\xDBA5B0.tmp
2008-09-12 15:00 --------- d-----w C:\ProgramData\RoboForm
2008-09-08 17:28 3,887,616 ----a-w C:\Windows\Internet Logs\xDB9F98.tmp
2008-09-07 21:53 3,120,640 ----a-w C:\Windows\Internet Logs\xDBAAA0.tmp
2008-09-07 14:45 --------- d-----w C:\Program Files\QuickTime Alternative
2008-09-02 22:32 --------- d-----w C:\Program Files\Bonjour
2008-09-02 19:20 351,783 ---ha-w C:\Windows\system32\drivers\vsconfig(140).xml
2008-09-01 05:57 4,409,856 ----a-w C:\Windows\Internet Logs\xDBA4A7.tmp
2008-08-30 07:58 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-08-29 09:15 --------- d-----w C:\Program Files\Weather Watcher Live
2008-08-29 09:07 --------- d-----w C:\ProgramData\Anuko
2008-08-25 10:36 81,288 ----a-w C:\Windows\system32\drivers\iksyssec.sys
2008-08-25 10:36 66,952 ----a-w C:\Windows\system32\drivers\iksysflt.sys
2008-08-25 10:36 40,840 ----a-w C:\Windows\system32\drivers\ikfilesec.sys
2008-08-19 13:29 --------- d-----w C:\ProgramData\CityPhotos
2008-08-17 21:31 4,720,128 ----a-w C:\Windows\Internet Logs\xDB9FB7.tmp
2008-08-10 22:14 4,943,360 ----a-w C:\Windows\Internet Logs\xDB9B25.tmp
2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll
2008-07-31 03:32 460,288 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-07-31 03:32 28,160 ----a-w C:\Windows\System32\Apphlpdm.dll
2008-07-31 03:32 2,154,496 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-07-31 03:32 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-07-31 01:13 4,240,384 ----a-w C:\Windows\System32\GameUXLegacyGDFs.dll
2008-07-25 13:00 2,932,224 ----a-w C:\Windows\Internet Logs\xDB9201.tmp
2008-07-25 08:36 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-07-24 13:05 2,679,296 ----a-w C:\Windows\Internet Logs\xDBA311.tmp
2008-07-23 16:50 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-07-23 16:50 129,784 ------w C:\Windows\System32\pxafs.dll
2008-07-23 16:50 120,056 ------w C:\Windows\System32\pxcpyi64.exe
2008-07-23 16:50 118,520 ------w C:\Windows\System32\pxinsi64.exe
2008-07-23 16:48 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-07-23 16:48 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-07-23 16:46 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-07-23 10:51 3,567,616 ----a-w C:\Windows\Internet Logs\xDB17A4.tmp
2008-07-23 10:30 443,904 ----a-w C:\Windows\Internet Logs\xDB8B4D.tmp
2008-07-23 08:18 392,704 ----a-w C:\Windows\Internet Logs\xDB8F91.tmp
2008-07-22 22:04 3,492,352 ----a-w C:\Windows\Internet Logs\xDB9665.tmp
2008-07-19 18:27 4,569,088 ----a-w C:\Windows\Internet Logs\xDB8F24.tmp
2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe
2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll
2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll
2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll
2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll
2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll
2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll
2008-06-05 17:42 190 ----a-w C:\Program Files\Common Files\psasetup.log
2008-04-16 21:30 691 ----a-w C:\Users\JS\AppData\Roaming\GetValue.vbs
2008-04-16 21:30 35 ----a-w C:\Users\JS\AppData\Roaming\SetValue.bat
2008-04-11 17:50 174 --sha-w C:\Program Files\desktop.ini
2008-04-10 10:40 32 ----a-w C:\Users\All Users\ezsid.dat
2008-04-10 10:40 32 ----a-w C:\ProgramData\ezsid.dat
2008-05-22 17:57 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-05-22 17:57 32,768 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-05-22 17:57 16,384 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" [2008-01-24 2476408]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-03-03 959976]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-26 1235736]
"StartupDelayer"="C:\Program Files\r2 Studios\Startup Delayer\Startup Launcher.exe" [2007-12-14 26112]
"Malwarebytes' Anti-Malware"="C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" [2008-10-16 398992]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]

C:\Users\JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3fhg"= mp3fhg.acm
"msacm.divxa32"= divxa32.acm
"VIDC.X264"= x264vfw.dll
"VIDC.HFYU"= huffyuv.dll
"vidc.i263"= i263_32.drv
"VIDC.MJPG"= Pvmjpg30.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"<NO NAME>"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
"<NO NAME>"=

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{ED0E2B27-5D12-4E4E-87BF-31ADA9A69E10}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{5BF98E0C-F62B-4B70-82D1-AEFF0A2D5238}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe
"{1B44C2C4-C304-4E0F-B330-B5CBF767A057}"= C:\Program Files\AVG\AVG8\avgnsx.exe:avgnsx.exe
"{95F4CE44-0469-49BA-B90F-64EEDB35D4B1}"= UDP:C:\Program Files\SmartFTP Client\SmartFTP.exe:SmartFTP Client
"{F56286C3-3DEC-4D4F-BD9E-3F30AC98B92F}"= TCP:C:\Program Files\SmartFTP Client\SmartFTP.exe:SmartFTP Client
"{59F8EA1D-916B-492A-8DE8-C4349E5BF7C5}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{96A0044C-661E-4DEF-B91D-864BD56257FD}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{28A12F32-B809-4379-995B-B5B9D5FE5613}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{E722109A-8C72-453A-99D3-079470B48DF7}C:\\users\\js\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm94yw56\\housecall66[1].exe"= UDP:C:\users\js\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm94yw56\housecall66[1].exe:housecall66[1].exe
"UDP Query User{B27D1734-A3AB-4A25-AD6C-AD0408EF750E}C:\\users\\js\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm94yw56\\housecall66[1].exe"= TCP:C:\users\js\appdata\local\microsoft\windows\temporary internet files\content.ie5\mm94yw56\housecall66[1].exe:housecall66[1].exe
"TCP Query User{CF96B4AF-E103-4CD2-9A04-6B55A3BA0F32}C:\\users\\js\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\kldulmas\\housecall66[1].exe"= UDP:C:\users\js\appdata\local\microsoft\windows\temporary internet files\content.ie5\kldulmas\housecall66[1].exe:housecall66[1].exe
"UDP Query User{7D8948FC-3C0A-4599-9E3B-C7543202FBC1}C:\\users\\js\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\kldulmas\\housecall66[1].exe"= TCP:C:\users\js\appdata\local\microsoft\windows\temporary internet files\content.ie5\kldulmas\housecall66[1].exe:housecall66[1].exe
"TCP Query User{D104485D-50AA-4830-800E-6E84EA35D5C0}C:\\program files\\skype\\phone\\skype.exe"= Disabled:UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{A1A24CBB-2434-47BA-BD42-A4EFEA842615}C:\\program files\\skype\\phone\\skype.exe"= Disabled:TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{B67455D3-C0CA-4600-9EF8-025CC1FB354A}"= UDP:C:\Program Files\Nonoh.net\Nonoh\Nonoh.exe:Nonoh
"{F2634459-9077-4595-BCE1-3E0593483E60}"= TCP:C:\Program Files\Nonoh.net\Nonoh\Nonoh.exe:Nonoh
"{CE5E1914-645D-4020-AAC8-0F568A36272D}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{7DD42F0C-DFDE-4E64-817A-3353EE7593FD}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\RM.exe:Render Manager
"{D267F130-6CFB-46EC-9E9C-A706D7DEC1FF}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{CA54965C-1527-43C6-9694-975AFA2F3444}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\Studio.exe:Studio
"{CF15F5A6-B935-427A-B73C-F565FD1A2B10}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{EED0C968-15A9-4C23-8B27-C2B344405A0A}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe:PMSRegisterFile
"{8444EEA4-CE19-4146-AB55-BA97BB4826DC}"= UDP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
"{98E99882-472C-4622-969A-4064B3A23C36}"= TCP:C:\Program Files\Pinnacle\Studio 11\programs\umi.exe:umi
"{18127985-1322-41B7-81B0-CA2F970E3C32}"= UDP:C:\Windows\System32\lxdjcoms.exe:Lexmark Communications System
"{2A32C1E5-2ABD-4781-8A77-EE6188A1AAC9}"= TCP:C:\Windows\System32\lxdjcoms.exe:Lexmark Communications System
"{B5E7EEA2-EBD0-4792-81F3-3DAE6353D018}"= UDP:C:\Program Files\Lexmark 1400 Series\lxdjamon.exe:Lexmark Device Monitor
"{A7197A04-EE38-4445-8834-3F5A72B6DB7A}"= TCP:C:\Program Files\Lexmark 1400 Series\lxdjamon.exe:Lexmark Device Monitor
"{F1AC7F79-727C-449B-B19B-216EAFFF1568}"= UDP:C:\Program Files\Lexmark 1400 Series\App4R.exe:Lexmark Imaging Studio
"{37F8108E-EC36-43BD-BF12-6B61E3D43909}"= TCP:C:\Program Files\Lexmark 1400 Series\App4R.exe:Lexmark Imaging Studio
"{132F5F94-4DEA-47CC-BDCF-04FBCD5B21AD}"= UDP:C:\Users\JS\AppData\Local\Temp\lxdj\wireless\FRENCH\lxdjwpss.exe:
"{39B24EDB-7739-4832-8D79-B04B2A407A02}"= TCP:C:\Users\JS\AppData\Local\Temp\lxdj\wireless\FRENCH\lxdjwpss.exe:
"{F946CB62-8081-498B-AE98-6B85293BA946}"= UDP:C:\Windows\System32\lxdjcfg.exe:
"{960DCF40-022E-4738-A993-E61352B73EC7}"= TCP:C:\Windows\System32\lxdjcfg.exe:
"{E848D408-BB08-43A7-8B64-151DEA7934D4}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjpswx.exe:
"{48D52041-8585-4E8B-9C1C-943F99DE6341}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjpswx.exe:
"{1FA2D391-7D29-4738-BC4C-652A17100232}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjjswx.exe:
"{D79843B8-F1CC-44F9-94FC-C496C433A0F8}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjjswx.exe:
"{E9E4A8CA-9D8C-424B-A6D2-363F561FE8B4}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjpswx.exe:
"{FCF01314-43F5-41AA-B60C-5CB64C40BBE0}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjpswx.exe:
"{BEE90761-9552-4498-B40A-99607E2C349A}"= UDP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjjswx.exe:
"{3FFD1605-872E-4275-8445-D7E791F611AA}"= TCP:C:\Windows\System32\spool\drivers\w32x86\3\lxdjjswx.exe:
"{5A541E25-6FE9-4949-8F3D-E41F6A3DA644}"= C:\Program Files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AvgRkx86;avgrkx86.sys;C:\Windows\system32\Drivers\avgrkx86.sys [2008-06-20 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-07-26 97928]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-26 231704]
R2 Maximizer-CMGR-Service;Maximizer Email Service;C:\Program Files\Maximizer\Campaign Manager\AutoProgService.exe [2006-07-24 49152]
R2 Maximizer-PrintFax-Service;Maximizer PrintFax Service;C:\Program Files\Maximizer\Campaign Manager\AutoPrintservice.exe [2006-07-24 184320]
R2 Pervasive Workgroup Engine;Pervasive Workgroup Engine;C:\PVSW\bin\psql_svc.exe run [ ]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2008-07-07 809296]
R2 ZTime;ZoneTick Time;C:\Program Files\ZoneTick\timesync.exe [2008-10-18 77824]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2007-03-14 2427392]
R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-06-20 69128]
R3 MBAMProtector;MBAMProtector;C:\Windows\system32\drivers\mbam.sys [2008-10-16 15504]
R3 RimSerPort;RIM Virtual Serial Port;C:\Windows\system32\DRIVERS\RimSerial.sys [2004-08-06 17920]
R3 TMPassthruMP;TMPassthruMP;C:\Windows\system32\DRIVERS\TMPassthru.sys [2007-11-27 35216]
S2 gupdate1c922161d603900;Google Update Service (gupdate1c922161d603900);C:\Program Files\Google\Update\GoogleUpdate.exe [2008-09-29 133104]
S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-10-16 172688]
S2 RUBotted;Trend Micro RUBotted Service;C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe [ ]
S2 Workflow Automation Powered by KnowledgeSync;Workflow Automation Powered by KnowledgeSync;C:\Program Files\Maximizer\Workflow Automation\Bin\KS_Serv.exe [2004-12-29 507904]
S3 TMPassthru;Trend Micro Passthru Ndis Service;C:\Windows\system32\DRIVERS\TMPassthru.sys [2007-11-27 35216]
S3 WMSvc;Service de gestion Web;C:\Windows\system32\inetsrv\wmsvc.exe [2008-01-19 11264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1bf5f1e2-9528-11dd-b274-00197ee62c13}]
\shell\AutoRun\command - G:\PortableRoboForm.exe
\shell\RoboForm2Go\command - G:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6d3b5a39-94ff-11dd-8a9c-00197ee62c13}]
\shell\AutoRun\command - E:\PortableRoboForm.exe
\shell\RoboForm2Go\command - E:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{97daa9b0-5e10-11dd-935b-00197ee62c13}]
\shell\AutoRun\command - E:\PortableRoboForm.exe
\shell\RoboForm2Go\command - E:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b88d3cfb-8a16-11dd-8751-00197ee62c13}]
\shell\AutoRun\command - E:\PortableRoboForm.exe
\shell\RoboForm2Go\command - E:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f86ecca8-5304-11dd-84a0-00197ee62c13}]
\shell\AutoRun\command - E:\PortableRoboForm.exe
\shell\RoboForm2Go\command - E:\PortableRoboForm.exe

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contenu du dossier 'Tâches planifiées'

2008-10-19 C:\Windows\Tasks\GoogleUpdateTaskMachine.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2008-09-29 11:49]

2008-10-16 C:\Windows\Tasks\GoogleUpdateTaskUser.job
- C:\Users\JS\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-17 01:10]

2008-10-19 C:\Windows\Tasks\Malwarebytes' Scheduled Update for SYSTEM.job
- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2008-10-16 20:25]

2008-10-16 C:\Windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-07 09:42]
.
- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-TMRUBottedTray - C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe

.
------- Examen supplémentaire -------
.
R0 -: HKCU-Main,Local Page = hxxp://www.google.com/
R0 -: HKCU-Main,Start Page = hxxp://www.google.fr/
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: Append to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: E&xporter vers Microsoft Excel - C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000

O16 -: {03BCF80B-B975-498C-B9CC-1F517915995A} - hxxps://secure.interfax.net/Office2003.ocx
C:\Windows\Downloaded Program Files\Office2003.ocx

O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.de/scan_de/scan8/oscan8.cab
C:\Windows\Downloaded Program Files\oscan8.inf
C:\Windows\bdoscandellang.ini
C:\Windows\bdoscandel.exe
C:\Windows\Downloaded Program Files\live.ini
C:\Windows\Downloaded Program Files\scanoptions.tsi
C:\Windows\Downloaded Program Files\lang.ini
C:\Windows\Downloaded Program Files\ipsupd.dll
C:\Windows\Downloaded Program Files\bdupd.dll
C:\Windows\Downloaded Program Files\libfn.dll
C:\Windows\Downloaded Program Files\bdcore.dll
C:\Windows\Downloaded Program Files\oscan8.ocx

O16 -: {A996E48C-D3DC-4244-89F7-AFA33EC60679} - hxxps://gestaoar.certisign.com.br/gestaoar/capicom.cab
C:\Windows\Downloaded Program Files\capicom.inf
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-19 05:48:00
Windows 6.0.6001 Service Pack 1 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
Heure de fin: 2008-10-19 5:50:13
ComboFix-quarantined-files.txt 2008-10-19 03:49:49

Avant-CF: 20,241,436,672 octets libres
Après-CF: 20,015,333,376 octets libres

292 --- E O F --- 2008-10-18 07:42:01

Destrio5 · Answer

- Télécharge HijackThis v2.0.2 sur ton Bureau :
http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe

- Double-clique sur HJTInstall afin de lancer l'installation.

- Clique sur Install ensuite sur I Accept.

- Clique sur Do a system scan and save a logfile.

- Le bloc-notes s'ouvrira, fais un copier/coller de tout son contenu ici dans ton prochain message.

zeman · Answer

Merci!

Spyware Doctor vient de trouver un nouveau trojan: Bancos. Hier il n'avait trouvé ce trojan. J'ai arrivé a le nettoyer, mais cette infection par Bancos arrive quand je suis déconecte de l'Internet toute la journé... 

SD trouve aussi des 'host hijack' et n'arrive pas à les nettoyer.

Voici le rapport de Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:52, on 2008-10-19
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32	askeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32	askeng.exe
C:\Program Files\a-squared Free\a2service.exe
C:\Windows\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Windows\system32\lxdjcoms.exe
C:\Program Files\Maximizer\Campaign Manager\AutoProgService.exe
C:\Program Files\Maximizer\Campaign Manager\AutoPrintservice.exe
C:\PVSW\bin\psql_svc.exe
C:\Windows\system32\svchost.exe
C:\PVSW\bin\w3dbsmgr.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\svchost.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ZoneTick	imesync.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\JiWire\BOT Mapping\JiWireBOT.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Weather Watcher Live\ww.exe
C:\Program Files\ZoneTick\zonetick.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Lexmark 1400 Series\lxdjamon.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file)
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [StartupDelayer] "C:\Program Files2 Studios\Startup Delayer\Startup Launcher.exe"
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: CCC.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: (no name) - {4E660F19-E91E-41E1-88EF-D1DFAB118F67} - (no file)
O9 - Extra 'Tools' menuitem: Mouse Gestures... - {4E660F19-E91E-41E1-88EF-D1DFAB118F67} - (no file)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {03BCF80B-B975-498C-B9CC-1F517915995A} (Office2003.Install) - https://secure.interfax.net/Office2003.ocx
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www3.snapfish.fr/SnapfishActivia.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.de/scan_de/scan8/oscan8.cab
O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) - https://gestaoar.certisign.com.br/gestaoar/capicom.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c922161d603900) (gupdate1c922161d603900) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxdj_device -   - C:\Windows\system32\lxdjcoms.exe
O23 - Service: Maximizer Email Service (Maximizer-CMGR-Service) - Maximizer Software Inc. - C:\Program Files\Maximizer\Campaign Manager\AutoProgService.exe
O23 - Service: Maximizer PrintFax Service (Maximizer-PrintFax-Service) - Maximizer Software Inc. - C:\Program Files\Maximizer\Campaign Manager\AutoPrintservice.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
O23 - Service: Pervasive Workgroup Engine - Unknown owner - C:\PVSW\bin\psql_svc.exe
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Unknown owner - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe (file missing)
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: Workflow Automation Powered by KnowledgeSync - Vineyardsoft Corporation - C:\Program Files\Maximizer\Workflow Automation\Bin\KS_Serv.exe
O23 - Service: ZoneTick Time (ZTime) - WR Consulting - C:\Program Files\ZoneTick	imesync.exe

Destrio5 · Answer

- Télécharge et installe MalwareByte's Anti-Malware :
http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware

- Mets-le à jour.

- Redémarre en mode sans échec (Recommandé) :
https://blog.sosordi.net/

- Choisis ta session habituelle.

- Fais un scan complet avec MalwareByte's Anti-Malware.

- Supprime tout ce que le logiciel trouve, enregistre le rapport.

- Redémarre en mode normal et poste le rapport ici.

Tutorial :
https://www.malekal.com/tutoriel-malwarebyte-anti-malware/

zeman · Answer

Merci Destrio et voici le rapport de Malwarebytes:

Malwarebytes' Anti-Malware 1.29
Version de la base de données: 1303
Windows 6.0.6001 Service Pack 1

21/10/2008 21:32:59
mbam-log-2008-10-21 (21-32-59).txt

Type de recherche: Examen complet (C:\|D:\|F:\|)
Eléments examinés: 189008
Temps écoulé: 46 minute(s), 58 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Rien trouvé. Mais depuis hier, Malwarebytes ouvre une fenêtre "Echéc de l'opération demandé. Code:2" lors de chaque demarrage du ordi. La protection était désactivé, j'arrive à l'actver mais il montre en suite une fenêtre que me dit "Erreur code 3078". Mais la protection continue active. 

J'essaye de desintaler Malwarebytes, il me dit que "ne trouve pas le fichier unins000.msg". Le dit format de fichier est d'Outlook. Très bizarre. 

La même chose se passe avec SpywareDoctor 6.0. J'essaye de le supprimer manuelement, il y a un fichier verrouillé. J'utilise Malwarebytes pour effacer ce fichier. Je reinstalle Spyware Doctor, il semble fonctionner bien mainentant. Son Intelliscan ne trouve rien.

Peut-être il faut vérifier de nouveau ave Hijackthis?

Zeman

Destrio5 · Answer

Oui.

zeman · Answer

Merci Destrio :-) Voici-le. AVG continue a trouver les pilotes masqués: mchInjDrv.sys et ahbendcj.sys. Le premier ne change pas son nom. Le seconde, il me semble qu'il change son nom a chaque scan d'AVG.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:20:35, on 21/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\csrss.exe
C:\Windows\SYSTEM32\wininit.exe
C:\Windows\SYSTEM32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\ZoneLabs\vsmon.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\SYSTEM32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\a-squared Free\a2service.exe
C:\Windows\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Windows\SYSTEM32	askeng.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Windows\system32\lxdjcoms.exe
C:\Program Files\Maximizer\Campaign Manager\AutoProgService.exe
C:\Program Files\Maximizer\Campaign Manager\AutoPrintservice.exe
C:\PVSW\bin\psql_svc.exe
C:\Windows\system32\svchost.exe
C:\PVSW\bin\w3dbsmgr.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\ZoneTick	imesync.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\JiWire\BOT Mapping\JiWireBOT.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\ZoneTick\zonetick.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Weather Watcher Live\ww.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Lexmark 1400 Series\lxdjamon.exe
C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe
C:\Program Files\Labtec\WebCam10\WebCam10.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Windows\system32\conime.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe
C:\Program Files\Common Files\Research In Motion\RIMDeviceManager\RIMDeviceManager.exe
C:\Program Files\Common Files\Research In Motion\USB Drivers\BbDevMgr.exe
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\Program Files\Genie-Soft\GBMPro8\GBMAgent.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgscanx.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\System32\mobsync.exe
c:\windows\system32\inetsrv\w3wp.exe
C:\Program Files\Internet Explorer\IEUser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVGTOOLBAR - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: (no name) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [StartupDelayer] "C:\Program Files2 Studios\Startup Delayer\Startup Launcher.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: CCC.lnk = ?
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~2.0_0\bin\ssv.dll
O9 - Extra button: (no name) - {4E660F19-E91E-41E1-88EF-D1DFAB118F67} - (no file)
O9 - Extra 'Tools' menuitem: Mouse Gestures... - {4E660F19-E91E-41E1-88EF-D1DFAB118F67} - (no file)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {03BCF80B-B975-498C-B9CC-1F517915995A} (Office2003.Install) - https://secure.interfax.net/Office2003.ocx
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.de/scan_de/scan8/oscan8.cab
O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) - https://gestaoar.certisign.com.br/gestaoar/capicom.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c922161d603900) (gupdate1c922161d603900) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: lxdj_device -   - C:\Windows\system32\lxdjcoms.exe
O23 - Service: Maximizer Email Service (Maximizer-CMGR-Service) - Maximizer Software Inc. - C:\Program Files\Maximizer\Campaign Manager\AutoProgService.exe
O23 - Service: Maximizer PrintFax Service (Maximizer-PrintFax-Service) - Maximizer Software Inc. - C:\Program Files\Maximizer\Campaign Manager\AutoPrintservice.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\Windows\system32\drivers\pclepci.sys
O23 - Service: Pervasive Workgroup Engine - Unknown owner - C:\PVSW\bin\psql_svc.exe
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\Windows\System32\ZoneLabs\vsmon.exe
O23 - Service: Workflow Automation Powered by KnowledgeSync - Vineyardsoft Corporation - C:\Program Files\Maximizer\Workflow Automation\Bin\KS_Serv.exe
O23 - Service: ZoneTick Time (ZTime) - WR Consulting - C:\Program Files\ZoneTick	imesync.exe

Destrio5 · Answer

---> Fais ce scan en ligne et poste le rapport :
https://www.pandasecurity.com/en/homeusers/online-antivirus/?ref=activescan

zeman · Answer

Salut Destrio,

Mon ordi s'est arreté pendantle scan de Panda. J'ai du faire plusieurs restaurations du système dans le mode sans échéc. Une de ces restaurations heureusement a marché, Vista est stable maintenant. 
Scan Spyware Doctor: nettoyé 8 infections
Scan Spybot: rien trouvé
Scan en ligne AVG: je ne trouve pas le rapport avgrep.txt
Scan ASquared free, rien trouvé.

Je viens de faire un nouveau scan avec Panda, voici le rapport:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-10-23 22:53:08
PROTECTIONS: 1
MALWARE: 4
SUSPECTS: 1
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
Windows Defender                             1.1.4005.0                    No        No
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00170559  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Users\JS\AppData\Roaming\Microsoft\Windows\Cookies\js@uol.com[1].txt
00170559  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Users\JS\AppData\Roaming\Microsoft\Windows\Cookies\Low\js@uol.com[2].txt
00170559  Cookie/Com.com                     TrackingCookie      No        0         Yes            No           C:\Users\JS\Documents\My Backups\New Backup Job.gbp[MP/IE/Cookies/monte@uol.com[2].txt]
03009106  W32/Xor-encoded.A                  Virus               No        0         No             No           C:\Users\JS\AppData\Local\Microsoft\Windows\WER\ReportArchive\Report10ead039\Report.cab[mbamgui.exe.xor]
03738686  Generic Malware                    Virus/Trojan        No        0         No             No           C:\Users\JS\Downloads\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
03906751  Adware/MalwareAlarm                Adware              No        1         Yes            No           C:\Windows\System32\IEDFix.exe
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              &#65533;&#65533;2 &#65533;os5
;===================================================================================================================================================================================
No        C:\Users\JS\Downloads\ComboFix.exe[32788R22FWJFW\psexec.cfexe]                                                                                                                                                                                                                                                                                                                                                                                                                                                        &#65533;&#65533;2 &#65533;os5
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                &#65533;&#65533;2 &#65533;os5
;===================================================================================================================================================================================
;===================================================================================================================================================================================

Destrio5 · Answer

Je pense ne pas pouvoir régler ton problème qui a l'air complexe.

Je préfère en rester là.

Si tu veux que quelqu'un d'autre regarde, il serait préférable que tu refasses un nouveau topic et je ferai supprimer celui-ci pour ne pas faire de doublon.

zeman · Answer

Merci Destrio, je prefers réinstaller l'ordi. Il faut le faire chaque deux ans, grâce à des problèmes de qualié avec les logiciels de Bill Gates. :-) Stp n'éffaces pas cette discussion. Cordialement.

Destrio5 · Answer

Ok, cette discussion ne sera pas supprimée.

Bonne journée ;)

zeman · Answer

Merci pour ton temps et bonne journée á toi. Au revoir.

Pilotes cachés mchInjDrv.sys - arexrdv.sys

14 réponses

Votre réponse

Discussions similaires

Newsletters