cheval de troie et autres!!! Résolu

Question

Bonjour a tous et bien j ai un 2 cheval de troie et j ai des attact de reseau evidement mon ordi est pomal lente pourrier vous m aider svp merci!!!!

geoffrey5 · Answer

Salut !!

Fais un rapport hijackthis pour que je puisse vérifier les infections de ton pc stp

&#x25B6; Télécharge  hijackthis à cette adresse, tout est expliqué pour bien l installer et pour savoir s'en servir :

https://www.androidworld.fr/


Comment copier/coller le rapport :


Quand tu as le rapport à l écran, tu fais ctrl A pour "sélectionner tout" puis ctrl C pour "copier".

ensuite tu viens sur le forum pour me répondre et tu fais ctrl V pour "coller" le rapport.

Une explication des raccourcis clavier sont illustrés sur mon site web à cette adresse :

https://www.androidworld.fr/

st ya qc · Answer

salut geoffrey5 et bien il y a bien une fenetre mais je ne peux l enregistrer seulement executer!!!

geoffrey5 · Answer

ah bon ?! alors exécute

st ya qc · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:44:46, on 2008-10-23
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files	rend micro\HijackThis\hjt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Outil de mise à jour Google.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/229?8af95d6c2c8349d39dc76a3db8228774
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/230?8af95d6c2c8349d39dc76a3db8228774
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Statistiques de la protection du trafic Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing)
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing)
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll,C:\PROGRA~1\KASPER~1\KASPER~1\adialhk.dll,C:\PROGRA~1\KASPER~1\KASPER~1\kloehk.dll
O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

geoffrey5 · Answer

&#x25B6; Télécharge malwarebytes 
 
&#x25B6; Voici mon tuto pour bien l installer et bien l utiliser : 

https://www.androidworld.fr/

aide toi bien du tuto pour supprimer correctement ce qu il aura trouvé
 

Après l analyse, redémarre le pc et poste le rapport !!

st ya qc · Answer

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1311
Windows 5.1.2600 Service Pack 3

2008-10-23 20:34:23
mbam-log-2008-10-23 (20-34-23).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 113625
Temps écoulé: 1 hour(s), 32 minute(s), 29 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\LPVideoPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\LPVideoPlugin (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\System Volume Information\_restore{3FAFF195-A1AC-4F02-804F-DD8451AFDE75}\RP106\A0016851.exe (Rogue.ErrorExpertSetup) -> Quarantined and deleted successfully.

geoffrey5 · Answer

ok maintenant fais ceci stp :

&#x25B6; Télécharger SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 

(c est le numéro 8 en bas de la page)

 
&#x25B6; Double cliquer sur SDFix.exe et choisir Install pour l'extraire dans un dossier dédié sur ton disque C:.
 
/!\ Démarre en mode sans échec : après le bip et avant le logo windows tapoter sur la touche F8 (ou F5): menu M.S.E.. 

&#x25B6; Choisir son compte, pas celui de l'Administrateur ou autre. 

Dérouler la liste des instructions ci-dessous :
 
• Ouvrir le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuyer sur Y pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuyer sur une touche pour redémarrer le PC. 
• Le système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuyer sur une touche pour finir l'exécution du script et charger les icônes du Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt. 
• Enfin, copier/coller le contenu du fichier Report.txt dans la prochaine réponse sur le forum

st ya qc · Answer

salut geofrey5  et bien jcrois  que les cheval sont partir mais  mon pc a a bloquer 3 fois (geler) il a fallu le debrancher j ai toujours mes attact reseau et kaspersky m indique des driver beaucoup en faite et c quoi au juste des driver?bon je commence ce que tu ma demander et t envoi le rapport demander merci beaucoup!!

st ya qc · Answer

kaspersky me dit tres dangereux!!!

st ya qc · Answer

[b]SDFix: Version 1.237 [/b]
Run by Client on 2008-10-24 at 20:49

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\cbosbivk\1.png - Deleted
C:\WINDOWS\cbosbivk\2.png - Deleted
C:\WINDOWS\cbosbivk\3.png - Deleted
C:\WINDOWS\cbosbivk\4.png - Deleted
C:\WINDOWS\cbosbivk\5.png - Deleted
C:\WINDOWS\cbosbivk\6.png - Deleted
C:\WINDOWS\cbosbivk\7.png - Deleted
C:\WINDOWS\cbosbivk\8.png - Deleted
C:\WINDOWS\cbosbivk\9.png - Deleted
C:\WINDOWS\cbosbivk\bottom-rc.gif - Deleted
C:\WINDOWS\cbosbivk\config.png - Deleted
C:\WINDOWS\cbosbivk\content.png - Deleted
C:\WINDOWS\cbosbivk\download.gif - Deleted
C:\WINDOWS\cbosbivk\frame-bg.gif - Deleted
C:\WINDOWS\cbosbivk\frame-bottom-left.gif - Deleted
C:\WINDOWS\cbosbivk\frame-h1bg.gif - Deleted
C:\WINDOWS\cbosbivk\head.png - Deleted
C:\WINDOWS\cbosbivk\icon.png - Deleted
C:\WINDOWS\cbosbivk\indexwp.html - Deleted
C:\WINDOWS\cbosbivk\main.css - Deleted
C:\WINDOWS\cbosbivk\memory-prots.png - Deleted
C:\WINDOWS\cbosbivk
et.png - Deleted
C:\WINDOWS\cbosbivk\pc.gif - Deleted
C:\WINDOWS\cbosbivk\pc-mag.gif - Deleted
C:\WINDOWS\cbosbivk\poloska1.png - Deleted
C:\WINDOWS\cbosbivk\poloska2.png - Deleted
C:\WINDOWS\cbosbivk\poloska3.png - Deleted
C:\WINDOWS\cbosbivk\promowp1.html - Deleted
C:\WINDOWS\cbosbivk\promowp2.html - Deleted
C:\WINDOWS\cbosbivk\promowp3.html - Deleted
C:\WINDOWS\cbosbivk\promowp4.html - Deleted
C:\WINDOWS\cbosbivk\promowp5.html - Deleted
C:\WINDOWS\cbosbivkeg.png - Deleted
C:\WINDOWS\cbosbivkepair.png - Deleted
C:\WINDOWS\cbosbivk\scr-1.png - Deleted
C:\WINDOWS\cbosbivk\scr-2.png - Deleted
C:\WINDOWS\cbosbivk\start.png - Deleted
C:\WINDOWS\cbosbivk\styles.css - Deleted
C:\WINDOWS\cbosbivk	op-rc.gif - Deleted
C:\WINDOWS\cbosbivk\vline.gif - Deleted
C:\WINDOWS\cbosbivk\wp.png - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-24 21:00:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5c,85,ba,e5,51,cf,1d,9c,5f,a1,6e,33,df,c8,fa,4b,60,ec,95,6b,de,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cc,da,3d,6e,bc,7a,07,8c,a4,46,84,d9,d0,e9,6b,bd,c2,..
"khjeh"=hex:5e,6a,9b,f2,1c,11,97,01,80,e6,3e,05,b1,7d,c2,95,c1,16,36,a0,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:90,e1,73,69,8a,8b,c8,25,a4,f1,80,80,cd,c7,d9,3c,14,ca,22,cc,26,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5c,85,ba,e5,51,cf,1d,9c,5f,a1,6e,33,df,c8,fa,4b,60,ec,95,6b,de,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cc,da,3d,6e,bc,7a,07,8c,a4,46,84,d9,d0,e9,6b,bd,c2,..
"khjeh"=hex:5e,6a,9b,f2,1c,11,97,01,80,e6,3e,05,b1,7d,c2,95,c1,16,36,a0,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:90,e1,73,69,8a,8b,c8,25,a4,f1,80,80,cd,c7,d9,3c,14,ca,22,cc,26,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\FrostWire\FrostWire.exe"="C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:LimeWire"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:æTorrent"
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup"
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe:*:Disabled:Programme d'installation de Kaspersky Anti-Virus 7.0"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Disabled:BitLord"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 14 Feb 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]


[b]SDFix: Version 1.237 [/b]
Run by Client on 2008-10-24 at 20:49

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\cbosbivk\1.png - Deleted
C:\WINDOWS\cbosbivk\2.png - Deleted
C:\WINDOWS\cbosbivk\3.png - Deleted
C:\WINDOWS\cbosbivk\4.png - Deleted
C:\WINDOWS\cbosbivk\5.png - Deleted
C:\WINDOWS\cbosbivk\6.png - Deleted
C:\WINDOWS\cbosbivk\7.png - Deleted
C:\WINDOWS\cbosbivk\8.png - Deleted
C:\WINDOWS\cbosbivk\9.png - Deleted
C:\WINDOWS\cbosbivk\bottom-rc.gif - Deleted
C:\WINDOWS\cbosbivk\config.png - Deleted
C:\WINDOWS\cbosbivk\content.png - Deleted
C:\WINDOWS\cbosbivk\download.gif - Deleted
C:\WINDOWS\cbosbivk\frame-bg.gif - Deleted
C:\WINDOWS\cbosbivk\frame-bottom-left.gif - Deleted
C:\WINDOWS\cbosbivk\frame-h1bg.gif - Deleted
C:\WINDOWS\cbosbivk\head.png - Deleted
C:\WINDOWS\cbosbivk\icon.png - Deleted
C:\WINDOWS\cbosbivk\indexwp.html - Deleted
C:\WINDOWS\cbosbivk\main.css - Deleted
C:\WINDOWS\cbosbivk\memory-prots.png - Deleted
C:\WINDOWS\cbosbivk
et.png - Deleted
C:\WINDOWS\cbosbivk\pc.gif - Deleted
C:\WINDOWS\cbosbivk\pc-mag.gif - Deleted
C:\WINDOWS\cbosbivk\poloska1.png - Deleted
C:\WINDOWS\cbosbivk\poloska2.png - Deleted
C:\WINDOWS\cbosbivk\poloska3.png - Deleted
C:\WINDOWS\cbosbivk\promowp1.html - Deleted
C:\WINDOWS\cbosbivk\promowp2.html - Deleted
C:\WINDOWS\cbosbivk\promowp3.html - Deleted
C:\WINDOWS\cbosbivk\promowp4.html - Deleted
C:\WINDOWS\cbosbivk\promowp5.html - Deleted
C:\WINDOWS\cbosbivkeg.png - Deleted
C:\WINDOWS\cbosbivkepair.png - Deleted
C:\WINDOWS\cbosbivk\scr-1.png - Deleted
C:\WINDOWS\cbosbivk\scr-2.png - Deleted
C:\WINDOWS\cbosbivk\start.png - Deleted
C:\WINDOWS\cbosbivk\styles.css - Deleted
C:\WINDOWS\cbosbivk	op-rc.gif - Deleted
C:\WINDOWS\cbosbivk\vline.gif - Deleted
C:\WINDOWS\cbosbivk\wp.png - Deleted





Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-24 21:00:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5c,85,ba,e5,51,cf,1d,9c,5f,a1,6e,33,df,c8,fa,4b,60,ec,95,6b,de,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cc,da,3d,6e,bc,7a,07,8c,a4,46,84,d9,d0,e9,6b,bd,c2,..
"khjeh"=hex:5e,6a,9b,f2,1c,11,97,01,80,e6,3e,05,b1,7d,c2,95,c1,16,36,a0,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:90,e1,73,69,8a,8b,c8,25,a4,f1,80,80,cd,c7,d9,3c,14,ca,22,cc,26,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:5c,85,ba,e5,51,cf,1d,9c,5f,a1,6e,33,df,c8,fa,4b,60,ec,95,6b,de,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,cc,da,3d,6e,bc,7a,07,8c,a4,46,84,d9,d0,e9,6b,bd,c2,..
"khjeh"=hex:5e,6a,9b,f2,1c,11,97,01,80,e6,3e,05,b1,7d,c2,95,c1,16,36,a0,4f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:90,e1,73,69,8a,8b,c8,25,a4,f1,80,80,cd,c7,d9,3c,14,ca,22,cc,26,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\FrostWire\FrostWire.exe"="C:\Program Files\FrostWire\FrostWire.exe:*:Enabled:LimeWire"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:æTorrent"
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe:*:Enabled:Kaspersky Anti-Virus 7.0 Setup"
"C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"="C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe:*:Disabled:Programme d'installation de Kaspersky Anti-Virus 7.0"
"C:\Program Files\eMule\emule.exe"="C:\Program Files\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\BitLord\BitLord.exe"="C:\Program Files\BitLord\BitLord.exe:*:Disabled:BitLord"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\Program Files\Messenger\msmsgs.exe"="C:\Program Files\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu 14 Feb 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]

geoffrey5 · Answer

Salut !!

Maintenant fais ceci stp :

&#x25B6; Télécharge a-squared free 3.5

&#x25B6; Un tutoriel est à ta disposition pour bien l utiliser.

&#x25B6; fais la mise à jour et une analyse complète.

&#x25B6; poste le rapport stp

ensuite refais un nouveau rapport hijackthis stp

st ya qc · Answer

salut geoffrey5 parfais je commence ca 
ps:j ai encore cheval de troie trojan downloader.... mautadine

geoffrey5 · Answer

Salut !!

Quel est le nom exact de ce trojan downloader et son emplacement exact ??

st ya qc · Answer

cheval de troie trojan downloader.JS.IFrame.vz
""    ""     ""       ""        ""         .JS.Agent.cey
""        ""  ""      ""       ""          .win32.obfuscated.ebl
 
pour l emplacement je croit que c des site!!!!!???

geoffrey5 · Answer

des site ??!! Si ils sont dans ton PC, ils sont quelque part sur ton disque C

laisse bien terminer l analyse d a-squared, supprime tout ce qu il trouvera et envois le rapport stp

st ya qc · Answer

je ne peux pas te  poster le rapport sa gèle!!!

geoffrey5 · Answer

Salut !!

est ce qu a-squared a trouvé quelque chose ??

st ya qc · Answer

salut geofrrey5 oui j ai toute mi en quanrantaine mais il na pa trouver mes cheval...

st ya qc · Answer

re geoffrey5 dsl pour ma faute de frappe j aimerais savoir si tu pourrais me conseiller un antivirus gratuit mon kaspersky termine aujourd hui et j ai pas beaucoup d argent c temps ci (surtout que jsuis surement infecter!!!)sauf avast qui je crois n est pas tres tres bon   merci a toi!!

geoffrey5 · Answer

Re,

vas vider la quarantaine d a-squared 

et vas aussi faire une analyse en ligne avec bitdefender à cette adresse (sous internet explorer) :

http://www.zebulon.fr/outils/antivirus/antivirus-en-ligne.php

et pour un antivirus gratuit, je te conseille Antivir

Un tutoriel sera à ta disposition sur mon site pour l'installer et l'utiliser correctement.

st ya qc · Answer

il me demande de telecharger internet explorer 8 je telecharge?

geoffrey5 · Answer

Tu es obligé ?

st ya qc · Answer

oui il me dise que internet explorer 4 ou plus est requis pour l analyse en ligne !!

geoffrey5 · Answer

ah ok.. Tu n avais meme pas internet explorer ??!!

st ya qc · Answer

j ai firefox!!

geoffrey5 · Answer

ok mais pour les mises à jour de windows tu faisais comment ?? lol

tu es obligé d avoir internet explorer pour les faire

st ya qc · Answer

loll ah bon !!mais il ne dois pas etre fort puisque j ai besoin de explorer 4 minimum lol

geoffrey5 · Answer

le numéro de version n a rien à voir... C est juste que certains modules qui permettent de faire l analyse n ont été mis qu à partir de la version 4

st ya qc · Answer

qeu dois je faire!!??

st ya qc · Answer

je le telecharge ?

st ya qc · Answer

tu ne veux plus m aider geoffrey5!!??

geoffrey5 · Answer

Pourquoi je ne voudrais plus t aider ??!! lol

je pensais que tu faisais l analyse en ligne  :s

Si tu dois prendre la version 8 bin prends là

st ya qc · Answer

lol ok voici mon rapport antivir si sa peux d aider!!

st ya qc · Answer

Avira AntiVir Personal
Report file date: 27 octobre 2008  21:46

Scanning for 995222 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 3)  [5.1.2600]
Boot mode:        Normally booted
Username:         SYSTEM
Computer name:    ORDINATE-E10E10

Version information:
BUILD.DAT     : 8.2.0.334      16933 Bytes  2008-10-16 14:55:00
AVSCAN.EXE    : 8.1.4.7       315649 Bytes  2008-06-26 14:57:53
AVSCAN.DLL    : 8.1.4.0        40705 Bytes  2008-05-26 13:56:40
LUKE.DLL      : 8.1.4.5       164097 Bytes  2008-06-12 18:44:19
LUKERES.DLL   : 8.1.4.0        12033 Bytes  2008-05-26 13:58:52
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  2008-10-27 01:28:47
ANTIVIR1.VDF  : 7.1.0.1         2048 Bytes  2008-10-27 01:29:00
ANTIVIR2.VDF  : 7.1.0.2         2048 Bytes  2008-10-27 01:29:00
ANTIVIR3.VDF  : 7.1.0.4        38912 Bytes  2008-10-27 01:29:04
Engineversion : 8.2.0.9   
AEVDF.DLL     : 8.1.0.6       102772 Bytes  2008-10-14 16:05:56
AESCRIPT.DLL  : 8.1.1.9       319867 Bytes  2008-10-28 01:29:28
AESCN.DLL     : 8.1.1.3       123252 Bytes  2008-10-14 16:05:56
AERDL.DLL     : 8.1.1.2       438644 Bytes  2008-09-12 12:06:02
AEPACK.DLL    : 8.1.2.4       369014 Bytes  2008-10-14 16:05:56
AEOFFICE.DLL  : 8.1.0.29      196988 Bytes  2008-10-28 01:29:25
AEHEUR.DLL    : 8.1.0.63     1479032 Bytes  2008-10-28 01:29:23
AEHELP.DLL    : 8.1.1.2       115062 Bytes  2008-10-14 16:05:56
AEGEN.DLL     : 8.1.0.42      319861 Bytes  2008-10-28 01:29:11
AEEMU.DLL     : 8.1.0.9       393588 Bytes  2008-10-14 16:05:56
AECORE.DLL    : 8.1.2.8       172406 Bytes  2008-10-28 01:29:07
AEBB.DLL      : 8.1.0.3        53618 Bytes  2008-10-14 16:05:56
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  2008-07-09 14:40:05
AVPREF.DLL    : 8.0.2.0        38657 Bytes  2008-05-16 15:28:01
AVREP.DLL     : 8.0.0.2        98344 Bytes  2008-10-28 01:29:05
AVREG.DLL     : 8.0.0.1        33537 Bytes  2008-05-09 17:26:40
AVARKT.DLL    : 1.0.0.23      307457 Bytes  2008-02-12 14:29:23
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  2008-06-12 18:27:49
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  2008-01-22 23:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  2008-06-12 18:49:40
NETNT.DLL     : 8.0.0.1         7937 Bytes  2008-01-25 18:05:10
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  2008-06-12 19:48:07
RCTEXT.DLL    : 8.0.52.0       86273 Bytes  2008-06-27 19:34:37

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, 
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: 27 octobre 2008  21:46

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'hpqimzone.exe' - '1' Module(s) have been scanned
Scan process 'ONENOTEM.EXE' - '1' Module(s) have been scanned
Scan process 'GoogleUpdater.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'dvdtray.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'SMax4PNP.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'SMAgent.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'LSSrvc.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'GoogleUpdaterService.exe' - '1' Module(s) have been scanned
Scan process 'CDAC11BA.EXE' - '1' Module(s) have been scanned
Scan process 'a2service.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
36 processes with 36 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
    [INFO]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
    [INFO]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '51' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
    [WARNING]   The file could not be opened!
C:\pagefile.sys
    [WARNING]   The file could not be opened!
C:\System Volume Information\_restore{3FAFF195-A1AC-4F02-804F-DD8451AFDE75}\RP66\A0014408.dll
    [DETECTION] Is the TR/Killav.28714 Trojan
    [NOTE]      The file was deleted!
C:\WINDOWS\system32\drivers\sptd.sys
    [WARNING]   The file could not be opened!


End of the scan: 27 octobre 2008  22:36
Used time: 50:38 Minute(s)

The scan has been done completely.

   6688 Scanning directories
 276671 Files were scanned
      1 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      1 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      3 Files cannot be scanned
 276667 Files not concerned
   7921 Archives were scanned
      3 Warnings
      1 Notes

st ya qc · Answer

et bien je ne peux toujours pas faire ca j ai pourtant telecharger explorer 8 mais il me dise la meme chose!!!

geoffrey5 · Answer

Salut !!

refais une analyse complete avec malwarebytes en mode sans échec stp

geoffrey5 · Answer

fais une mise à jour avant !

st ya qc · Answer

salut geoffrey5! dsl pour le delais voici mon rapport de MBAM!



Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1356
Windows 5.1.2600 Service Pack 3

2008-11-02 12:43:25
mbam-log-2008-11-02 (12-43-25).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 115491
Temps écoulé: 1 hour(s), 45 minute(s), 9 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

geoffrey5 · Answer

Salut !!

télécharge TrojanRemover à cette adresse, tu auras un tutoriel à ta disposition :

https://www.androidworld.fr/

et poste le rapport stp

st ya qc · Answer

***** NORMAL SCAN FOR ACTIVE MALWARE *****
Trojan Remover Ver 6.7.3.2550. For information, email support@simplysup1.com
[Unregistered version]
Scan started at: 15:23:54 06 nov. 2008
Using Database v7191
Operating System:  Windows XP SP3 [Windows XP Professional Service Pack 3 (Build 2600)]
File System:       NTFS
Data directory:     C:\Documents and Settings\Client\Application Data\Simply Super Software\Trojan Remover\
Database directory: C:\Program Files\Trojan Remover\
Logfile directory:  C:\Documents and Settings\Client\Mes documents\Simply Super Software\Trojan Remover Logfiles\
Program directory:  C:\Program Files\Trojan Remover\
Running with Administrator privileges

************************************************************
The following Anti-Malware program(s) are loaded:
Avira AntiVir

************************************************************


************************************************************
15:23:54: Scanning ----------WIN.INI-----------
WIN.INI found in C:\WINDOWS

************************************************************
15:23:54: Scanning --------SYSTEM.INI---------
SYSTEM.INI found in C:\WINDOWS

************************************************************
15:23:54: ----- SCANNING FOR ROOTKIT SERVICES -----
No hidden Services were detected.

************************************************************
15:23:56: Scanning -----WINDOWS REGISTRY-----
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon
This key's "Shell" value calls the following program(s):
File: Explorer.exe
C:\WINDOWS\Explorer.exe
1037824 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
This key's "Userinit" value calls the following program(s):
File: C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\userinit.exe
26624 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
This key's "System" value appears to be blank
----------
This key's "UIHost" value calls the following program:
File: logonui.exe
C:\WINDOWS\system32\logonui.exe
515584 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
--------------------
Checking HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
Value Name: load
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Value Name: SoundMAXPnP
Value Data: C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
790528 bytes
Created:  2007-10-29
Modified: 2003-05-29
Company:  Analog Devices, Inc.
--------------------
Value Name: SunJavaUpdateSched
Value Data: "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
144784 bytes
Created:  2008-08-18
Modified: 2008-06-10
Company:  Sun Microsystems, Inc.
--------------------
Value Name: NeroFilterCheck
Value Data: C:\WINDOWS\system32\NeroCheck.exe
C:\WINDOWS\system32\NeroCheck.exe
155648 bytes
Created:  2007-11-03
Modified: 2001-07-09
Company:  Ahead Software Gmbh
--------------------
Value Name: DVDTray
Value Data: C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
65536 bytes
Created:  2007-11-03
Modified: 2004-09-03
Company:  Hewlett-Packard Company
--------------------
Value Name: avgnt
Value Data: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
266497 bytes
Created:  2008-10-27
Modified: 2008-06-12
Company:  Avira GmbH
--------------------
Value Name: TrojanScanner
Value Data: C:\Program Files\Trojan Remover\Trjscan.exe /boot
C:\Program Files\Trojan Remover\Trjscan.exe
968072 bytes
Created:  2008-11-06
Modified: 2008-10-25
Company:  Simply Super Software
--------------------
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\Run
Value Name: MsnMsgr
Value Data: "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
5724184 bytes
Created:  2007-10-18
Modified: 2007-10-18
Company:  Microsoft Corporation
--------------------
Value Name: ctfmon.exe
Value Data: C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon.exe
15360 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
--------------------
Value Name: NBJ
Value Data: "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
1961984 bytes
Created:  2007-11-03
Modified: 2005-07-14
Company:  Ahead Software AG
--------------------
Value Name: MSMSGS
Value Data: "C:\Program Files\Messenger\msmsgs.exe" /background
C:\Program Files\Messenger\msmsgs.exe [file not found to scan]
--------------------
Value Name: DAEMON Tools Lite
Value Data: "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
C:\Program Files\DAEMON Tools Lite\daemon.exe
490952 bytes
Created:  2008-07-24
Modified: 2008-07-24
Company:  DT Soft Ltd
--------------------
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServices
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
This Registry Key appears to be empty
--------------------
Checking HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
This Registry Key appears to be empty

************************************************************
15:23:58: Scanning -----SHELLEXECUTEHOOKS-----
ValueName: {AEB6717E-7E19-11d0-97EE-00C04FD91972}
File:      shell32.dll - this file is expected and has been left in place
----------

************************************************************
15:23:58: Scanning -----HIDDEN REGISTRY ENTRIES-----
Taskdir check completed
----------
No Hidden File-loading Registry Entries found
----------

************************************************************
15:23:58: Scanning -----ACTIVE SCREENSAVER-----
No active ScreenSaver found to scan.

************************************************************
15:23:58: Scanning ----- REGISTRY ACTIVE SETUP KEYS -----
Key:  {6BF52A52-394A-11d3-B153-00C04F79FAA6}
Path: rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmp11.inf,PerUserStub
C:\WINDOWS\INF\wmp11.inf
2441 bytes
Created:  2006-11-03
Modified: 2006-11-03
Company:  
----------

************************************************************
15:23:59: Scanning ----- SERVICEDLL REGISTRY KEYS -----
Key:  6to4
Path: %SystemRoot%\System32\6to4svc.dll
C:\WINDOWS\System32\6to4svc.dll
100352 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
--------------------
Key: HidServ
%SystemRoot%\System32\hidserv.dll - file is globally excluded (file cannot be found)
--------------------
Key:  hpqcxs08
Path: C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll
225280 bytes
Created:  2007-01-19
Modified: 2007-01-19
Company:  Hewlett-Packard Co.
--------------------
Key:  hpqddsvc
Path: C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll
131072 bytes
Created:  2007-01-19
Modified: 2007-01-19
Company:  Hewlett-Packard Co.
--------------------
Key:  Net Driver HPZ12
Path: C:\WINDOWS\system32\HPZinw12.dll
C:\WINDOWS\system32\HPZinw12.dll
43520 bytes
Created:  2006-11-08
Modified: 2006-11-08
Company:  Hewlett-Packard
--------------------
Key:  NWCWorkstation
Path: %SystemRoot%\System32
wwks.dll
C:\WINDOWS\System32
wwks.dll
65536 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
--------------------
Key:  Pml Driver HPZ12
Path: C:\WINDOWS\system32\HPZipm12.dll
C:\WINDOWS\system32\HPZipm12.dll
53248 bytes
Created:  2006-11-08
Modified: 2006-11-08
Company:  Hewlett-Packard
--------------------

************************************************************
15:24:00: Scanning ----- SERVICES REGISTRY KEYS -----
Key:       a2free
ImagePath: "C:\Program Files\a-squared Free\a2service.exe"
C:\Program Files\a-squared Free\a2service.exe
418936 bytes
Created:  2008-10-26
Modified: 2008-10-26
Company:  Emsi Software GmbH
----------
Key:       ADM8511
ImagePath: system32\DRIVERS\NET8511.SYS
C:\WINDOWS\system32\DRIVERS\NET8511.SYS
24424 bytes
Created:  2006-08-22
Modified: 2000-12-12
Company:  ADMtek
----------
Key:       aeaudio
ImagePath: system32\drivers\aeaudio.sys
C:\WINDOWS\system32\drivers\aeaudio.sys
100224 bytes
Created:  2007-10-29
Modified: 2007-10-29
Company:  Andrea Electronics Corporation
----------
Key:       AntiVirScheduler
ImagePath: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe"
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
68865 bytes
Created:  2008-10-27
Modified: 2008-10-15
Company:  Avira GmbH
----------
Key:       AntiVirService
ImagePath: "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe"
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
151297 bytes
Created:  2008-10-27
Modified: 2008-10-15
Company:  Avira GmbH
----------
Key:       aspnet_state
ImagePath: %SystemRoot%\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe
32768 bytes
Created:  2004-07-15
Modified: 2004-07-15
Company:  Microsoft Corporation
----------
Key:       avgio
ImagePath: \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
11840 bytes
Created:  2008-10-27
Modified: 2007-02-27
Company:  Avira GmbH
----------
Key:       avgntflt
ImagePath: \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
52032 bytes
Created:  2008-10-27
Modified: 2008-05-20
Company:  Avira GmbH
----------
Key:       avipbb
ImagePath: system32\DRIVERS\avipbb.sys
C:\WINDOWS\system32\DRIVERS\avipbb.sys
75072 bytes
Created:  2008-10-27
Modified: 2008-06-27
Company:  Avira GmbH
----------
Key:       C-DillaCdaC11BA
ImagePath: C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
54784 bytes
Created:  2008-01-07
Modified: 2008-01-07
Company:  Macrovision
----------
Key:       catchme
ImagePath: \??\C:\DOCUME~1\Client\LOCALS~1\Temp\catchme.sys - this file is globally excluded
----------
Key:       CdaC15BA
ImagePath: \??\C:\WINDOWS\system32\drivers\CdaC15BA.SYS
C:\WINDOWS\system32\drivers\CdaC15BA.SYS
12464 bytes
Created:  2008-01-07
Modified: 2008-01-07
Company:  Macrovision Europe Ltd
----------
Key:       EL2000
ImagePath: system32\DRIVERS\EL2K_XP.sys
C:\WINDOWS\system32\DRIVERS\EL2K_XP.sys
147328 bytes
Created:  2003-07-17
Modified: 2007-10-29
Company:  3Com Corporation
----------
Key:       gusvc
ImagePath: "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
168432 bytes
Created:  2008-01-24
Modified: 2008-11-01
Company:  Google
----------
Key:       HPZid412
ImagePath: system32\DRIVERS\HPZid412.sys
C:\WINDOWS\system32\DRIVERS\HPZid412.sys
-R- 49920 bytes
Created:  2007-12-29
Modified: 2006-12-06
Company:  HP
----------
Key:       HPZipr12
ImagePath: system32\DRIVERS\HPZipr12.sys
C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
-R- 16496 bytes
Created:  2007-12-29
Modified: 2006-12-06
Company:  HP
----------
Key:       HPZius12
ImagePath: system32\DRIVERS\HPZius12.sys
C:\WINDOWS\system32\DRIVERS\HPZius12.sys
-R- 21568 bytes
Created:  2007-12-29
Modified: 2006-12-06
Company:  HP
----------
Key:       ImapiService
ImagePath: %systemroot%\system32\imapi.exe
C:\WINDOWS\system32\imapi.exe
150528 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
Key:       LightScribeService
ImagePath: "C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe"
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
53248 bytes
Created:  2005-06-20
Modified: 2005-06-20
Company:  Hewlett-Packard Company
----------
Key:       MidiSyn
ImagePath: system32\drivers\MidiSyn.sys
C:\WINDOWS\system32\drivers\MidiSyn.sys
235100 bytes
Created:  2007-10-29
Modified: 2007-10-29
Company:  Analog Devices Inc
----------
Key:       NwlnkIpx
ImagePath: system32\DRIVERS
wlnkipx.sys
C:\WINDOWS\system32\DRIVERS
wlnkipx.sys
88320 bytes
Created:  2004-08-03
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
Key:       NwlnkNb
ImagePath: system32\DRIVERS
wlnknb.sys
C:\WINDOWS\system32\DRIVERS
wlnknb.sys
63232 bytes
Created:  2001-08-28
Modified: 2001-08-28
Company:  Microsoft Corporation
----------
Key:       NwlnkSpx
ImagePath: system32\DRIVERS
wlnkspx.sys
C:\WINDOWS\system32\DRIVERS
wlnkspx.sys
55936 bytes
Created:  2001-08-28
Modified: 2001-08-28
Company:  Microsoft Corporation
----------
Key:       NWRDR
ImagePath: system32\DRIVERS
wrdr.sys
C:\WINDOWS\system32\DRIVERS
wrdr.sys
163584 bytes
Created:  2004-08-03
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
Key:       odserv
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\OFFICE12\ODSERV.EXE
443776 bytes
Created:  2007-08-24
Modified: 2007-08-24
Company:  Microsoft Corporation
----------
Key:       ose
ImagePath: "C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE"
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
145184 bytes
Created:  2006-10-26
Modified: 2006-10-26
Company:  Microsoft Corporation
----------
Key:       pcouffin
ImagePath: System32\Drivers\pcouffin.sys
C:\WINDOWS\System32\Drivers\pcouffin.sys
47360 bytes
Created:  2008-04-19
Modified: 2008-04-19
Company:  VSO Software
----------
Key:       smwdm
ImagePath: system32\drivers\smwdm.sys
C:\WINDOWS\system32\drivers\smwdm.sys
578304 bytes
Created:  2007-10-29
Modified: 2003-06-02
Company:  Analog Devices, Inc.
----------
Key:       SoundMAX Agent Service (default)
ImagePath: C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
45056 bytes
Created:  2007-10-29
Modified: 2002-09-20
Company:  Analog Devices, Inc.
----------
Key:       sptd
ImagePath: System32\Drivers\sptd.sys - this file is globally excluded
----------
Key:       ssmdrv
ImagePath: system32\DRIVERS\ssmdrv.sys
C:\WINDOWS\system32\DRIVERS\ssmdrv.sys
28352 bytes
Created:  2008-10-27
Modified: 2007-03-01
Company:  Avira GmbH
----------
Key:       SwPrv
ImagePath: C:\WINDOWS\system32\dllhost.exe /Processid:{0B4CED16-F13D-4913-99D7-F60E56E37D14}
C:\WINDOWS\system32\dllhost.exe 
5120 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
Key:       Tcpip6
ImagePath: system32\DRIVERS	cpip6.sys
C:\WINDOWS\system32\DRIVERS	cpip6.sys
225856 bytes
Created:  2004-08-03
Modified: 2008-06-20
Company:  Microsoft Corporation
----------
Key:       usnjsvc
ImagePath: "C:\Program Files\Windows Live\Messenger\usnsvc.exe"
C:\Program Files\Windows Live\Messenger\usnsvc.exe
98328 bytes
Created:  2007-10-18
Modified: 2007-10-18
Company:  Microsoft Corporation
----------
Key:       WLSetupSvc
ImagePath: "C:\Program Files\Windows Live\installer\WLSetupSvc.exe"
C:\Program Files\Windows Live\installer\WLSetupSvc.exe
266240 bytes
Created:  2007-10-25
Modified: 2007-10-25
Company:  Microsoft Corporation
----------
Key:       WmBEnum
ImagePath: system32\drivers\WmBEnum.sys
C:\WINDOWS\system32\drivers\WmBEnum.sys
19352 bytes
Created:  2007-09-13
Modified: 2007-09-13
Company:  Logitech Inc.
----------
Key:       WmFilter
ImagePath: system32\drivers\WmFilter.sys
C:\WINDOWS\system32\drivers\WmFilter.sys
29976 bytes
Created:  2007-09-13
Modified: 2007-09-13
Company:  Logitech Inc.
----------
Key:       WmVirHid
ImagePath: system32\drivers\WmVirHid.sys
C:\WINDOWS\system32\drivers\WmVirHid.sys
14744 bytes
Created:  2007-09-13
Modified: 2007-09-13
Company:  Logitech Inc.
----------
Key:       WmXlCore
ImagePath: system32\drivers\WmXlCore.sys
C:\WINDOWS\system32\drivers\WmXlCore.sys
51608 bytes
Created:  2007-09-13
Modified: 2007-09-13
Company:  Logitech Inc.
----------

************************************************************
15:24:07: Scanning -----VXD ENTRIES-----
Checking the following VxD entries:

************************************************************
15:24:07: Scanning ----- WINLOGON\NOTIFY DLLS -----

************************************************************
15:24:07: Scanning ----- CONTEXTMENUHANDLERS -----
Key:   Shell Extension for Malware scanning
CLSID: {45AC2688-0253-4ED8-97DE-B5370FA7D48A}
Path:  C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
C:\Program Files\Avira\AntiVir PersonalEdition Classic\shlext.dll
65793 bytes
Created:  2008-10-27
Modified: 2008-06-12
Company:  Avira GmbH
----------
Key:   ShellExtension
CLSID: [empty]
----------
Key:   WinRAR
CLSID: [empty]
----------

************************************************************
15:24:08: Scanning ----- FOLDER\COLUMNHANDLERS -----
Key:  {9E96C1F5-0EFA-4348-9460-15D6802C70AA}
File: [CLSID does not appear to reference a file]

************************************************************
15:24:08: Scanning ----- BROWSER HELPER OBJECTS -----
Key: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}
BHO: C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
509328 bytes
Created:  2008-08-18
Modified: 2008-06-10
Company:  Sun Microsystems, Inc.
----------
Key: {9030D464-4C02-4ABF-8ECC-5164760863C6}
BHO: C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
328752 bytes
Created:  2007-09-20
Modified: 2007-09-20
Company:  Microsoft Corporation
----------
Key: {AA58ED58-01DD-4d91-8333-CF10577473F7}
BHO: c:\program files\google\googletoolbar1.dll
c:\program files\google\googletoolbar1.dll
-R- 2582136 bytes
Created:  2008-08-18
Modified: 2008-08-18
Company:  Google Inc.
----------
Key: {AE84A6AA-A333-4B92-B276-C11E2212E4FE}
BHO: C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
599472 bytes
Created:  2006-12-15
Modified: 2006-12-15
Company:  Hewlett-Packard Co.
----------
Key: {AF69DE43-7D58-4638-B6FA-CE66B5AD205D}
BHO: C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
657904 bytes
Created:  2008-11-01
Modified: 2008-11-01
Company:  Google Inc.
----------
Key: {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
BHO: C:\Program Files\Windows Live Toolbar\msntb.dll
C:\Program Files\Windows Live Toolbar\msntb.dll
546320 bytes
Created:  2007-10-19
Modified: 2007-10-19
Company:  Microsoft Corporation
----------

************************************************************
15:24:08: Scanning ----- SHELLSERVICEOBJECTS -----
Key:   SysTray
CLSID: {35CEC8A3-2BE6-11D2-8773-92E220524153}
Path:  %systemroot%\system32\stobject.dll
C:\WINDOWS\system32\stobject.dll
122368 bytes
Created:  2004-08-19
Modified: 2008-04-13
Company:  Microsoft Corporation
----------
Key:   WPDShServiceObj
CLSID: {AAA288BA-9A4C-45B0-95D7-94D524869DB5}
Path:  C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
133632 bytes
Created:  2006-10-18
Modified: 2006-10-18
Company:  Microsoft Corporation
----------

************************************************************
15:24:09: Scanning ----- SHAREDTASKSCHEDULER ENTRIES -----

************************************************************
15:24:09: Scanning ----- IMAGEFILE DEBUGGERS -----
No "Debugger" entries found.

************************************************************
15:24:09: Scanning ----- APPINIT_DLLS -----
The AppInit_DLLs value is blank or does not exist

************************************************************
15:24:09: Scanning ----- SECURITY PROVIDER DLLS -----

************************************************************
15:24:09: Scanning ------ COMMON STARTUP GROUP ------
[C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage]
The Common Startup Group attempts to load the following file(s) at boot time:
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\desktop.ini
-HS- 84 bytes
Created:  2003-08-07
Modified: 2003-08-07
Company:  
--------------------
C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
73728 bytes
Created:  2006-02-10
Modified: 2006-02-10
Company:  Hewlett-Packard Development Company, L.P.
Démarrage rapide de HP Photosmart Premier.lnk - links to C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
--------------------

************************************************************
No User Startup Groups were located to check

************************************************************
15:24:10: Scanning ----- SCHEDULED TASKS -----
Taskname:      Vérifier les mises à jour de Windows Live Toolbar.job
File:          C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
99856 bytes
Created:  2007-10-19
Modified: 2007-10-19
Company:  Microsoft Corporation
Parameters:    [blank]
Next Run Time: 2008-11-06 15:37:00
Status:        La tâche est prête à s'exécuter à l'heure prévue
Creator:       SYSTEM
Comments:      [blank]
----------

************************************************************
15:24:10: Scanning ----- SHELLICONOVERLAYIDENTIFIERS -----

************************************************************
15:24:10: ----- ADDITIONAL CHECKS -----
PE386 rootkit checks completed
----------
Winlogon registry rootkit checks completed
----------
Heuristic checks for hidden files/drivers completed
----------
Layered Service Provider entries checks completed
----------
Windows Explorer Policies checks completed
----------
Desktop Wallpaper: C:\Documents and Settings\Client\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Client\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
54294 bytes
Created:  2008-01-04
Modified: 2008-11-05
Company:  
----------
Web Desktop Wallpaper: %USERPROFILE%\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
C:\Documents and Settings\Client\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
54294 bytes
Created:  2008-01-04
Modified: 2008-11-05
Company:  
----------
Additional checks completed

************************************************************
15:24:11: Scanning ----- RUNNING PROCESSES -----

C:\WINDOWS\System32\smss.exe
--------------------
C:\WINDOWS\system32\csrss.exe
--------------------
C:\WINDOWS\system32\winlogon.exe
--------------------
C:\WINDOWS\system32\services.exe
--------------------
C:\WINDOWS\system32\lsass.exe
--------------------
C:\WINDOWS\system32\svchost.exe
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\system32\spoolsv.exe
--------------------
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe - file already scanned
--------------------
C:\Program Files\a-squared Free\a2service.exe - file already scanned
--------------------
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe - file already scanned
--------------------
C:\WINDOWS\system32\drivers\CDAC11BA.EXE - file already scanned
--------------------
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\svchost.exe - file already scanned
--------------------
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe - file already scanned
--------------------
C:\WINDOWS\system32\svchost.exe - file already scanned
--------------------
C:\WINDOWS\System32\alg.exe
--------------------
C:\WINDOWS\Explorer.EXE - file already scanned
--------------------
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe - file already scanned
--------------------
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe - file already scanned
--------------------
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe - file already scanned
--------------------
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe - file already scanned
--------------------
C:\WINDOWS\system32\ctfmon.exe - file already scanned
--------------------
C:\Program Files\DAEMON Tools Lite\daemon.exe - file already scanned
--------------------
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
--------------------
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
--------------------
C:\Program Files\Windows Live\Messenger\usnsvc.exe - file already scanned
--------------------
C:\WINDOWS\system32\wuauclt.exe
--------------------
C:\Program Files\Windows Live\Messenger\msnmsgr.exe - file already scanned
--------------------
C:\Program Files\Mozilla Firefox\firefox.exe
--------------------
C:\Documents and Settings\Client\Application Data\Simply Super Software\Trojan Remover\mtp27.exe
FileSize:          2618232
[This is a Trojan Remover component]
--------------------
--------------------

************************************************************
15:24:13: Checking AUTOEXEC.BAT file
AUTOEXEC.BAT found in C:\
No malicious entries were found in the AUTOEXEC.BAT file

************************************************************
15:24:13: Checking AUTOEXEC.NT file
AUTOEXEC.NT found in C:\WINDOWS\system32
No malicious entries were found in the AUTOEXEC.NT file

************************************************************
15:24:13: Checking HOSTS file
No malicious entries were found in the HOSTS file

************************************************************
------ INTERNET EXPLORER HOME/START/SEARCH SETTINGS ------
HKLM\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://www.msn.com/fr-fr/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKLM\Software\Microsoft\Internet Explorer\Main\"Search Page":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Page_URL":
https://www.msn.com/fr-fr/?ocid=iehp
HKLM\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
HKLM\Software\Microsoft\Internet Explorer\Search\"CustomizeSearch":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchcust.htm
HKLM\Software\Microsoft\Internet Explorer\Search\"SearchAssistant":
https://www.bing.com/?toHttps=1&redig=8F3F334EA60E4B1CB4D040DCFE393A89{SUB_RFC1766}/srchasst/srchasst.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Start Page":
https://www.msn.com/fr-fr/?ocid=iehp
HKCU\Software\Microsoft\Internet Explorer\Main\"Local Page":
C:\WINDOWS\system32\blank.htm
HKCU\Software\Microsoft\Internet Explorer\Main\"Search Page":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main\"Default_Search_URL":
http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch

************************************************************
=== NO CHANGES HAVE BEEN MADE TO YOUR SYSTEM FILES ===
Scan completed at: 15:24:13 06 nov. 2008
Total Scan time: 00:00:18
************************************************************

geoffrey5 · Answer

Salut !!

maintenant fais ceci stp :

&#x25B6; Telecharge UsbFix sur ton bureau

&#x25B6; Lance l installation avec les parametres par default

&#x25B6; Branche tes sources de données externes à ton PC, (clé USB, disque dur externe, etc...) suceptible d avoir été infectés sans les ouvrir

&#x25B6; Double clic sur le raccourci UsbFix sur ton bureau

&#x25B6; Le pc va redémarer

&#x25B6; Apres redémarrage post le rapport UsbFix.txt

* Note : le rapport UsbFix.txt est sauvegardé a la racine du disque

* Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , 
"Nouvelle tâche" , tapes explorer.exe et valides

st ya qc · Answer

BRANCHER mes sources de donnees externe a mon pc??

geoffrey5 · Answer

(clé USB, disque dur externe, etc...)

st ya qc · Answer

j ai pas de cle USB et bon voila en fait je comprend vraiment pas desole!!!
et pour disque dur externe ?? je  connais seulement mon disque c lol!!

geoffrey5 · Answer

ok alors lance le sans rien brancher  lol

st ya qc · Answer

ok il me dise que ...

 le répertoire destination n'existe pas. Voulez vous le creer

je fais oui?

geoffrey5 · Answer

oui

st ya qc · Answer

-------------- UsbFix V2.395 ---------------

* User : Client - ORDINATE-E10E10
* Outils mis a jours le 06/11/2008 par Chiquitine29 et Chimay8
* Recherche effectuée à 19:19:33 le 2008-11-06
* Windows Xp - Internet Explorer 8.0.6001.18241 
  
  
--------------- [ Processus actifs ] ----------------   
  
 
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avwsc.exe
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\system32\WgaTray.exe
C:\DOCUME~1\Client\LOCALS~1\Temp\1.tmp\b2e.exe
  
--------------- [ Informations lecteurs ] ----------------   
  
C: - Lecteur fixe

  
--------------- [ Registre / Startup ] ----------------   
 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    SoundMAXPnP	REG_SZ	C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
    SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    NeroFilterCheck	REG_SZ	C:\WINDOWS\system32\NeroCheck.exe
    DVDTray	REG_SZ	C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
    avgnt	REG_SZ	"C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
    TrojanScanner	REG_SZ	C:\Program Files\Trojan Remover\Trjscan.exe /boot

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\avp6_post_uninstall

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    MsnMsgr	REG_SZ	"C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    NBJ	REG_SZ	"C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
    MSMSGS	REG_SZ	"C:\Program Files\Messenger\msmsgs.exe" /background
    DAEMON Tools Lite	REG_SZ	"C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
  
--------------- [ Registre / Mountpoint2 ] ----------------   
  
Supprimé ! - HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{81e183ce-94bf-11dd-8e41-000c6e407e8f}\Shell\AutoRun\command  
  
--------------- [ Nettoyage des disques ] ----------------   
   
Supprimé ! - [2008-02-09 14:12] C:\WINDOWS\system32	mp.txt    
  
--------------- [ Listing des fichiers présents ] ----------------   
  
 -> /!\ Le resultat doit etre interprété par un spécialiste  /!\   
  
[2003-08-07 20:28][--a--c---] C:\AUTOEXEC.BAT   
[2004-08-03 17:38][-rahs----] C:\NTDETECT.COM   
[2008-08-17 15:40][---hsc---] C:\boot.ini   
 
--------------- ! Fin du rapport ! ----------------

geoffrey5 · Answer

Salut !! maintenant fais ceci stp : ▶ Télécharge RAV Antivirus (d'Evosla) ▶ Si tu as une clé USB, disque dur externe, etc, branche-les sans les ouvrir avant de lancer ce FIX ▶ Fais un clic droit sur le fichier .ZIP > Extraire sur > le Bureau ▶ Doucle-clique sur >> RAV.exe << afin de lancer l'outil. ▶ Une fois RAV ANTIVIRUS lancé, laisse-le réagir , il scanne automatiquement tout les lecteurs (disques fixes et amovibles) ▶ Si infection > un log s'établira, sinon le soft affichera (très rapide) ==>Votre Ordinateur est sain . ▶ Retire tes disques amovibles et redémarrez votre ordinateur. ▶ Poste le rapport, si infection!

st ya qc · Answer

salut geoffrey5!

il na pas decouvert d infection (ligne bleu de gauche a droite) !!
et comment aller a disque amovible pour retirer??        merci!!

geoffrey5 · Answer

Salut !!

&#x25B6; Télécharge Combofix de sUBs 


&#x25B6; et enregistre le sur le Bureau. 

  
&#x25B6; désactive tes protections et ferme toutes tes applications(antivirus, parefeu, garde en temps réel de l'antispyware) 


Voici le tutoriel officiel de Bleeping Computer pour savoir l utiliser :

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
 

ensuite envois le rapport et refais un nouveau rapport hijackthis stp

st ya qc · Answer

salut!

il me dise que (pendant le scan combofix) il a detecter que la console de recuperation de windows n existe pas sur mon pc!!!

vous auriez vraiment tout l internet a l installer.Voulez vous le faire maintenant!!

note:une connexion d internet ative est indispensable

que dois-je faire??                               merci!

geoffrey5 · Answer

tu peux le faire sans te soucier de la console  ;-)

désactive ton antivirus avant de lancer combofix

st ya qc · Answer

ok merci!!

st ya qc · Answer

ComboFix 08-11-07.01 - Client 2008-11-09 9:12:02.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.3.1252.1.1036.18.164 [GMT -5:00] Lancé depuis: c:\documents and settings\Client\Bureau\ComboFix.exe [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR] . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-09 au 2008-11-09 )))))))))))))))))))))))))))))))))))) . 2008-11-08 22:03 . 2008-11-08 22:03 d-------- c:\program files\Codemasters 2008-11-08 17:53 . 2008-11-08 17:53 173 --a--c--- C:\curr_ver.tmp 2008-11-06 19:16 . 2008-11-08 17:58 d-------- c:\program files\UsbFix 2008-11-06 15:16 . 2008-11-06 15:21 d-------- c:\program files\Trojan Remover 2008-11-06 15:16 . 2008-11-06 15:16 d----c--- c:\documents and settings\Client\Application Data\Simply Super Software 2008-11-06 15:16 . 2008-11-06 15:16 d----c--- c:\documents and settings\All Users\Application Data\Simply Super Software 2008-11-06 15:16 . 2006-05-25 15:52 162,304 --a------ c:\windows\system32\ztvunrar36.dll 2008-11-06 15:16 . 2003-02-02 20:06 153,088 --a------ c:\windows\system32\UNRAR3.dll 2008-11-06 15:16 . 2005-08-26 01:50 77,312 --a------ c:\windows\system32\ztvunace26.dll 2008-11-06 15:16 . 2002-03-06 01:00 75,264 --a------ c:\windows\system32\unacev2.dll 2008-11-06 15:16 . 2006-06-19 13:01 69,632 --a------ c:\windows\system32\ztvcabinet.dll 2008-10-28 08:21 . 2008-10-28 08:21 d--hsc--- c:\documents and settings\Client\PrivacIE 2008-10-27 22:17 . 2008-10-27 22:18 d--h-c--- c:\windows\ie8 2008-10-27 20:11 . 2008-10-27 20:11 d-------- c:\program files\Avira 2008-10-24 19:48 . 2008-10-24 19:48 579,584 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-10-24 19:46 . 2008-10-24 19:46 d-------- c:\windows\ERUNT 2008-10-23 14:08 . 2008-10-27 22:00 1,393 --a------ c:\windows\imsins.BAK 2008-10-23 13:56 . 2008-10-15 11:35 337,408 -----c--- c:\windows\system32\dllcache etapi32.dll 2008-10-22 13:20 . 2008-10-29 09:45 69 --a------ c:\windows\F 2008-10-22 13:08 . 2008-11-05 11:08 126,064 --a------ c:\windows\system32\AdobeFnt.lst 2008-10-22 11:59 . 2008-10-22 11:59 d-------- c:\program files\Adobe Type Manager 2008-10-22 11:59 . 1997-06-17 03:00 212,352 --a------ c:\windows\system32\ATMDRVR.DLL 2008-10-22 11:59 . 1997-06-17 03:00 4,064 --a------ c:\windows\system32\drivers\ATMHELPR.SYS 2008-10-22 11:58 . 2008-10-22 11:58 d----c--- C:\Acrobat3 2008-10-22 11:58 . 2008-10-22 11:59 2,348 --a------ c:\windows\ACROREAD.INI 2008-10-22 11:57 . 2008-10-22 11:58 d-------- c:\program files\PhotoDeluxe HE 3.1 2008-10-22 11:57 . 2008-10-22 11:57 d-------- c:\program files\ImageServer 2008-10-22 11:57 . 2008-10-22 11:57 d-------- c:\program files\Fichiers communs\Kodak 2008-10-22 11:56 . 2008-10-22 11:56 d----c--- c:\documents and settings\Client\WINDOWS 2008-10-22 11:56 . 1997-04-18 10:49 298,496 --a------ c:\windows\unin040c.exe 2008-10-21 11:54 . 2008-10-21 11:54 410,909 --a--c--- C:\janie payette.png 2008-10-21 11:52 . 2008-10-21 11:52 d----c--- c:\documents and settings\Client\Application Data\FastStone 2008-10-18 13:52 . 2008-10-30 19:01 d-------- c:\program files rend micro 2008-10-15 12:06 . 2008-09-15 10:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys 2008-10-15 12:06 . 2008-09-08 05:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys 2008-10-15 12:05 . 2008-08-14 08:23 2,191,232 -----c--- c:\windows\system32\dllcache toskrnl.exe 2008-10-15 12:05 . 2008-08-14 08:23 2,147,328 -----c--- c:\windows\system32\dllcache tkrnlmp.exe 2008-10-15 12:05 . 2008-08-14 08:23 2,068,096 -----c--- c:\windows\system32\dllcache tkrnlpa.exe 2008-10-15 12:05 . 2008-08-14 08:23 2,025,984 -----c--- c:\windows\system32\dllcache tkrpamp.exe 2008-10-15 10:55 . 2008-04-17 12:12 107,368 --a------ c:\windows\system32\GEARAspi.dll 2008-10-15 10:55 . 2008-04-17 12:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys 2008-10-15 10:16 . 2008-10-15 10:56 d----c--- c:\documents and settings\Client\Application Data\Apple Computer 2008-10-15 10:13 . 2008-10-16 09:25 d----c--- c:\documents and settings\All Users\Application Data\Apple Computer 2008-10-13 21:44 . 2008-10-13 21:45 43,520 --a------ c:\windows\system32\CmdLineExt03.dll 2008-10-13 21:34 . 2008-10-13 21:34 d----c--- c:\documents and settings\Client\Application Data\Leadertech 2008-10-13 21:33 . 2008-10-13 21:33 d-------- c:\program files\Fichiers communs\PocketSoft 2008-10-13 21:33 . 2002-02-27 17:50 197,120 --a------ c:\windows\patchw32.dll 2008-10-13 21:27 . 2008-10-13 21:27 d-------- c:\program files\Atari 2008-10-13 20:55 . 2008-10-13 20:55 d-------- c:\program files\DAEMON Tools Lite 2008-10-10 16:30 . 2008-10-23 17:55 d-------- c:\program files\Malwarebytes' Anti-Malware 2008-10-10 16:30 . 2008-10-22 15:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-10 16:30 . 2008-10-22 15:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-09 02:56 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-09 02:28 --------- dc----w c:\documents and settings\All Users\Application Data\Google Updater 2008-11-08 23:00 --------- d-----w c:\program files\BeClean 2008-11-08 22:46 --------- dc----w c:\documents and settings\Client\Application Data\LimeWire 2008-11-07 16:20 --------- d-----w c:\program files\Windows Live Safety Center 2008-10-28 01:11 --------- dc----w c:\documents and settings\All Users\Application Data\Avira 2008-10-28 00:38 --------- dc----w c:\documents and settings\All Users\Application Data\Kaspersky Lab 2008-10-22 00:05 --------- dc----w c:\documents and settings\Client\Application Data\OpenOffice.org2 2008-10-19 22:12 --------- dc----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-10-15 22:48 --------- dc----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-10-15 19:36 --------- d-----w c:\program files\DVD Shrink 2008-10-14 02:46 --------- dc----w c:\documents and settings\Client\Application Data\Atari 2008-10-14 02:11 --------- dc----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-10-07 22:27 717,296 ----a-w c:\windows\system32\drivers\sptd.sys 2008-10-07 22:27 --------- dc----w c:\documents and settings\Client\Application Data\DAEMON Tools 2008-10-01 16:23 --------- d-----w c:\program files\Windows Live 2008-10-01 14:17 --------- dc----w c:\documents and settings\Client\Application Data\MSNInstaller 2008-09-30 22:39 --------- dc----w c:\documents and settings\Client\Application Data\BitDefender 2008-09-28 22:54 --------- dc----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys 2008-08-22 07:08 878,592 ----a-w c:\windows\system32\wininet.dll 2008-08-22 07:08 43,008 ----a-w c:\windows\system32\licmgr10.dll 2008-08-22 07:07 18,944 ----a-w c:\windows\system32\corpol.dll 2008-08-22 07:06 72,704 ----a-w c:\windows\system32\admparse.dll 2008-08-22 07:06 71,680 ----a-w c:\windows\system32\iesetup.dll 2008-08-22 07:06 434,176 ----a-w c:\windows\system32\vbscript.dll 2008-08-22 07:05 48,640 ------w c:\windows\system32\PrivacIE.dll 2008-08-22 07:05 48,128 ----a-w c:\windows\system32\mshtmler.dll 2008-08-22 07:05 35,840 ----a-w c:\windows\system32\imgutil.dll 2008-08-22 07:04 45,568 ----a-w c:\windows\system32\mshta.exe 2008-08-22 06:57 156,160 ----a-w c:\windows\system32\msls31.dll 2008-08-14 13:23 2,191,232 ----a-w c:\windows\system32 toskrnl.exe 2008-08-14 13:23 2,068,096 ----a-w c:\windows\system32 tkrnlpa.exe 2008-04-19 13:58 81,920 -c--a-w c:\documents and settings\Client\Application Data\ezpinst.exe 2008-04-19 13:58 47,360 -c--a-w c:\documents and settings\Client\Application Data\pcouffin.sys . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-07-14 1961984] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "DVDTray"="c:\program files\Ahead\ODD Toolkit\DVDTray.exe" [2004-09-03 65536] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497] "TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2008-10-25 968072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360] c:\documents and settings\Client\Menu D‚marrer\Programmes\D‚marrage\ OneNote 2007 - Capture d'‚cran et lancement.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage rapide de HP Photosmart Premier.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 nwprovau HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoftwareStation HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StopSignSsSsMon HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\StopSignSsTsMon HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webscan [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\LimeWire\LimeWire.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.321\English\setup.exe"= "c:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 7.0.1.325\French\setup.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Windows Live\Messenger\livecall.exe"= R1 ATMhelpr;ATMhelpr;c:\windows\system32\drivers\ATMhelpr.sys [1997-06-17 4064] S3 ADM8511;Belkin USB Ethernet Adapter;c:\windows\system32\DRIVERS\NET8511.SYS [2000-12-12 24424] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc bdx REG_MULTI_SZ scan . Contenu du dossier 'Tâches planifiées' 2008-11-09 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20] . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-MSMSGS - c:\program files\Messenger\msmsgs.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\Client\Application Data\Mozilla\Firefox\Profiles\lm3gbax6.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1640187&SearchSource=3&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - igoogle FF -: plugin - c:\program files\Google\Google Updater\2.4.1399.3742 pCIDetect13.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-09 09:16:48 Windows 5.1.2600 Service Pack 3 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . ------------------------ Autres processus actifs ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\windows\system32\drivers\CDAC11BA.EXE c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\program files\Fichiers communs\LightScribe\LSSrvc.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\HP\Digital Imaging\bin\hpqimzone.exe . ************************************************************************** . Heure de fin: 2008-11-09 9:23:03 - La machine a redémarré [Client] ComboFix-quarantined-files.txt 2008-11-09 14:22:59 Avant-CF: 6,723,874,816 octets libres Après-CF: 6,651,035,648 octets libres 186 --- E O F --- 2008-11-09 03:54:14

st ya qc · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:29:36, on 2008-11-09
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\drivers\CDAC11BA.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DVDTray] C:\Program Files\Ahead\ODD Toolkit\DVDTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: OneNote 2007 - Capture d'écran et lancement.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Démarrage rapide de HP Photosmart Premier.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/229?8af95d6c2c8349d39dc76a3db8228774
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-ca\msntabres.dll.mui/230?8af95d6c2c8349d39dc76a3db8228774
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing)
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing)
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\windows\system32
wprovau.dll
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

geoffrey5 · Answer

relance hijackthis en cliquant sur scan only et coches ces lignes stp :

O3 - Toolbar: (no name) - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - (no file) 
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) 
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (file missing) 
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) 
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing) 

puis tu cliques sur fix checked.

est ce que tu as encore des problèmes ??

st ya qc · Answer

on dirais que non  

 je viens de faire tes directives demander et avant sa,quand j allais sur firefox il me desais qu il n etais pas mon navigateur par defaut
mais la pu rien alors oui je croit bien que c ok




DOIS-JE COCHER RESOLU

geoffrey5 · Answer

Salut !!

Ok alors tu peux faire ceci pour terminer stp :

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques :  

&#x25B6; Télécharge Toolscleaner sur ton Bureau  


&#x25B6; Double-clique sur ToolsCleaner2.exe et laisse le travailler 
&#x25B6; Clique sur Recherche et laisse le scan se terminer. 
&#x25B6; Clique sur Suppression pour finaliser. 
&#x25B6; Tu peux, si tu le souhaites, te servir des Options facultatives. 
&#x25B6; Clique sur Quitter, pour que le rapport puisse se créer. 
&#x25B6; Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse




Désactive et réactive la Restauration du système :


Le fait de faire cette manipulation va supprimer tous les virus qui auraient pu se loger dans les
points de restauration que tu avais créé auparavant.. Il est donc recommandé de la faire : 

 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration en cliquant sur démarrer => tous les programmes => accessoires =>

outils systeme => restauration du systeme => créer un point de restauration => tu mets un nom

(exemple : après désinfection sur CCM) puis tu valides.

pour XP : Voici un tutoriel en cas de problèmes.


Tu peux mettre ton problème résolu !! Comment mettre résolu ??

st ya qc · Answer

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression: 

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !


merci beaucoup pour ton aide geoffrey5!!!
t le meilleur!!!

Cheval de troie et autres!!!

60 réponses

Discussions similaires

Newsletters