Virus

Question

Bonjour,

Voila j'ai un soucis, depuis qu'elques temps j'ai des virus sur mon ordinateur.
Ils s'ouvre des pages internet tout seuls et ca met un petit message en bas un droite" delivred by foxicle" Pas sur de l'orthographe.

J'ai telecharger Spy bot Search & Destroy et Ad-aware  il en supprilme qu'elques un mais 1persite toujours (" delivred by foxicle")

Voila j'aimerais savoir comment le neutraliser.

Cordialement

Destrio5 · Answer

Salut,

- Télécharge HijackThis v2.0.2 sur ton Bureau.

- Double-clique sur HJTInstall afin de lancer l'installation.

- Clique sur Install ensuite sur I Accept.

- Clique sur Do a system scan and save a logfile.

- Le bloc-notes s'ouvrira, fais un copier/coller de tout son contenu ici dans ton prochain message.

Arknubis · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:38, on 27/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32undll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\VM305_STI.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?pc=mssh&form=msshhp&ocid=onepro&homepage=http%3a%2f%2fwww.iesearch.com%2f
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: mysidesearch search enhancer - {8CD660F3-435F-71CA-04CC-939D33A0869B} - C:\Windows\system32
ciwqaxgxbyzeeoe.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: cpmsky browser enhancer - {d097eede-50eb-1141-7fce-adb4d94459b1} - C:\Windows\system32\zwnfhsydckmr.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [iwmusqocgszs] C:\Windows\System32egsvr32.exe /s "C:\Windows\system32\zwnfhsydckmr.dll"
O4 - HKLM\..\Run: [BigDog305] C:\Windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O13 - Gopher Prefix: 
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\bin32
SvcAppFlt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\bin32
SvcIp.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

Destrio5 · Answer

---> Désactive l'UAC le temps de la désinfection :
http://www.commentcamarche.net/faq/sujet 8343 vista desactiver l uac

- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) sur ton Bureau.
http://siri.urz.free.fr/Fix/SmitfraudFix.exe

- Double-clique sur SmitfraudFix.exe et choisis l'option 1 puis Entrée.

- Un rapport sera généré, poste-le dans ta prochaine réponse.

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

** Ne fais l'étape 2 que si on te le demande, on doit d'abord examiner le premier rapport de SmitfraudFix.

Arknubis · Answer

j'ai télécharger ton Logiciel avast me la détecter comme virus :s

Destrio5 · Answer

Oui, je t'avais prévenu. Désactive Avast.

Arknubis · Answer

tu ma demander de désactiver l'UAC 
une fois que avast me la detecté comme virus j'ai cliquer sur supprimer
Mais il y a 30 secondes ils viens de me le redétectai comme virus et encore présent sur l'ordinateur

Destrio5 · Answer

Désactive Avast et retélécharge SmitFraudFix pour pouvoir faire la procédure.

Arknubis · Answer

Mais pourquoi avast me la bloquer?
Si il la bloquer s'est qu'il la detecter comme menace no?

Destrio5 · Answer

[*] process.exe est détecté par certains antivirus comme étant un risktool. Il ne s'agit pas d'un virus mais d'un utilitaire destiné à mettre fin à des processus.[*]

Arknubis · Answer

ok je fais ca :)

Arknubis · Answer

SmitFraudFix v2.368

Scan done at 18:39:31,29, 27/10/2008
Run from C:\Program Files\Mozilla Firefox\SmitfraudFix
OS: Microsoft Windows [version 6.0.6001] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32
vvsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32undll32.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32undll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
C:\Windows\VM305_STI.EXE
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\bin32
SvcAppFlt.exe
C:\Program Files\bin32
SvcIp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\cmd.exe
C:\Windows\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Windows\system32\LogFiles


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\R‚my


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\R‚my\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Start Menu


»»»»»»»»»»»»»»»»»»»»»»»» C:\Users\RMY~1\FAVORI~1


»»»»»»»»»»»»»»»»»»»»»»»» Desktop


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, following keys are not inevitably infected!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
"LoadAppInit_DLLs"=dword:00000000


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\Windows\system32\userinit.exe,"


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: NVIDIA nForce 10/100/1000 Mbps Networking Controller 
DNS Server Search Order: 192.168.1.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0D9E239F-8E1F-490E-8A2E-36C9885FFF89}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{0D9E239F-8E1F-490E-8A2E-36C9885FFF89}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0D9E239F-8E1F-490E-8A2E-36C9885FFF89}: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


»»»»»»»»»»»»»»»»»»»»»»»» End

Destrio5 · Answer

- Télécharge et installe Malwarebytes' Anti-Malware  :
http://www.commentcamarche.net/telecharger/telecharger 34055379 malwarebyte s anti malware

- Mets-le à jour.

- Redémarre en mode sans échec (Recommandé) :
https://blog.sosordi.net/

- Choisis ta session habituelle.

- Fais un scan complet avec Malwarebytes' Anti-Malware .

- Supprime tout ce que le logiciel trouve, enregistre le rapport.

- Redémarre en mode normal et poste le rapport ici.

Arknubis · Answer

Impossible de le mettre a jour :s

Destrio5 · Answer

Va dans l'onglet Mise à jour, choisis le deuxième serveur et mets à jour.

Arknubis · Answer

sois s'est mon internet ou sois s'est le site mais il a beaucoup de mal a télécharger il reste bloque un moment puis augmente de 10 KB :s

Destrio5 · Answer

Redémarre et réessaie.

Arknubis · Answer

il na pas pu tout supprimer il a du redemarrer pour tenter de le supprimer.

Je pense que s'est supprimer.

je refait un scan et vous dit la réponse :)

Destrio5 · Answer

N'oublie pas de poster le rapport.

Arknubis · Answer

Bon on dirais que ton logiciel na pas supprimmé mon probleme.
Lors du premier scan il m'avait trouvé beaucoup de warrez, trojan.... je les est supprimé..
Et pendant le 2eme scan le virus  (Ad delivred by foxicle) a réouvert une page de pub....

Voila le rapport du 2eme:
Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1337
Windows 6.0.6001 Service Pack 1

27/10/2008 20:36:13
mbam-log-2008-10-27 (20-36-13).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 128018
Temps écoulé: 28 minute(s), 44 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)

Par contre j'ai pas le 1er rapport car il a redémarrer l'ordinateur....

Destrio5 · Answer

Va dans l'onglet Rapports/Logs de MBAM et trouve le rapport où il y a eu beaucoup d'infections.

Arknubis · Answer

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1337
Windows 6.0.6001 Service Pack 1

27/10/2008 19:55:21
mbam-log-2008-10-27 (19-55-21).txt

Type de recherche: Examen complet (C:\|D:\|E:\|F:\|)
Eléments examinés: 128401
Temps écoulé: 31 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 9
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 7
Fichier(s) infecté(s): 19

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\adzgaloregames (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\playmp3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8cd660f3-435f-71ca-04cc-939d33a0869b} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8cd660f3-435f-71ca-04cc-939d33a0869b} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d097eede-50eb-1141-7fce-adb4d94459b1} (Adware.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{d097eede-50eb-1141-7fce-adb4d94459b1} (Adware.BHO) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iwmusqocgszs (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search\Local Page (Hijack.Search) -> Bad: (http://www.iesearch.com/) Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (https://www.msn.com/fr-fr/?pc=mssh&form=msshhp&ocid=onepro&homepage=http%3a%2f%2fwww.iesearch.com%2f Good: (https://www.google.com/?gws_rd=ssl -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\Adzgalore Games Collection (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\PlayMP3z (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection (Adware.Agent) -> Quarantined and deleted successfully.
C:\Users\Rémy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\Users\Rémy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\PlayMP3z (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload (Trojan.Lop) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\Adzgalore Games Collection\BattlesOfHelicopters.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Adzgalore Games Collection\BobAndBill.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Adzgalore Games Collection\CrazyBlocks.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Adzgalore Games Collection\Lines.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Adzgalore Games Collection\uninstall.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\Adzgalore Games Collection\VideoPool.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Program Files\PlayMP3z\PlayMP3.exe (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\Program Files\PlayMP3z\uninstall.exe (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection\Bob and Bill adventures - Wild Hunting.lnk (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection\Crazy Blocks.lnk (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection\Lines.lnk (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection\The Battles Of Helicopters.lnk (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adzgalore Games Collection\Video Pool.lnk (Adware.Agent) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Downloads.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload Uninstall.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BitDownload\BitDownload.lnk (Trojan.Lop) -> Quarantined and deleted successfully.
C:\Windows\System32\zwnfhsydckmr.dll (Trojan.Agent) -> Delete on reboot.
C:\Windows\System32
ciwqaxgxbyzeeoe.dll (Adware.BHO) -> Delete on reboot.

Destrio5 · Answer

---> Relance MBAM, va dans Quarantaine et supprime tout.

---> Télécharge Lop S&D sur ton Bureau.
---> Double-clique dessus pour lancer l'installation.
---> Puis double-clique sur le raccourci Lop S&D présent sur ton Bureau.
---> Séléctionne la langue souhaitée, puis choisis l'option 1 (Recherche).
---> Patiente jusqu'à la fin du scan.
---> Poste le rapport généré (C:\lopR.txt).

Arknubis · Answer

-------------------\  Lop S&D 4.2.4-8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Athlon(tm) Dual Core Processor 4050e )
   BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
   USER : Rémy ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081030-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:143 Go (Free:58 Go)
   D:\ (USB)
   E:\ (Local Disk) - NTFS - Total:144 Go (Free:144 Go)
   F:\ (CD or DVD) - UDF - Total:3 Go (Free:0 Go)

   "C:\Lop SD" ( MAJ : 27-10-2008|09:15 )
   Option : [1] ( 28/10/2008|18:46 )

   [ UAC => 1 ]
 
   --------------------\  Listing des dossiers dans Local  

   [22/10/2008|13:06] C:\Users\RMY~1\AppData\Local\Adobe
   [22/10/2008|16:54] C:\Users\RMY~1\AppData\Local\Apple
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\Application Data 
   [26/10/2008|08:39] C:\Users\RMY~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\GDIPFONTCACHEV1.DAT
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\Historique 
   [28/10/2008|11:07] C:\Users\RMY~1\AppData\Local\IconCache.db
   [22/10/2008|20:17] C:\Users\RMY~1\AppData\Local\Microsoft
   [11/10/2008|20:21] C:\Users\RMY~1\AppData\Local\MigWiz
   [09/10/2008|10:04] C:\Users\RMY~1\AppData\Local\Mozilla
   [09/10/2008|08:43] C:\Users\RMY~1\AppData\Local\PowerCinema
   [09/10/2008|19:19] C:\Users\RMY~1\AppData\Local\PunkBuster
   [28/10/2008|18:45] C:\Users\RMY~1\AppData\Local\Temp
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\Temporary Internet Files 
   [09/10/2008|17:49] C:\Users\RMY~1\AppData\Local\VirtualStore
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [28/10/2008 11:11][--ah-----] C:\Windows	asks\SA.DAT
   [28/10/2008 11:10][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [09/05/2008|03:20] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [09/05/2008|03:04] C:\ProgramData\Acer GameZone Console
   [09/05/2008|03:03] C:\ProgramData\Adobe
   [22/10/2008|16:52] C:\ProgramData\Apple
   [22/10/2008|16:58] C:\ProgramData\Apple Computer
   [02/11/2006|14:02] C:\ProgramData\Application Data 
   [09/10/2008|11:44] C:\ProgramData\Arcade Lab
   [09/10/2008|08:38] C:\ProgramData\Bureau 
   [09/05/2008|03:03] C:\ProgramData\CyberLink
   [02/11/2006|14:02] C:\ProgramData\Desktop 
   [02/11/2006|14:02] C:\ProgramData\Documents 
   [18/10/2008|06:25] C:\ProgramData\eMule
   [09/05/2008|03:33] C:\ProgramData\eSobi
   [09/10/2008|08:38] C:\ProgramData\Favoris 
   [02/11/2006|14:02] C:\ProgramData\Favorites 
   [09/05/2008|03:05] C:\ProgramData\FloodLightGames
   [27/10/2008|17:59] C:\ProgramData\Grisoft
   [23/10/2008|08:32] C:\ProgramData\Lavasoft
   [27/10/2008|18:49] C:\ProgramData\Malwarebytes
   [17/10/2008|07:59] C:\ProgramData\McAfee
   [09/10/2008|08:38] C:\ProgramData\Menu D‚marrer 
   [10/10/2008|18:06] C:\ProgramData\Microsoft
   [15/10/2008|21:52] C:\ProgramData\Microsoft Help
   [09/10/2008|08:38] C:\ProgramData\ModŠles 
   [09/10/2008|08:43] C:\ProgramData\NVIDIA
   [11/10/2008|19:22] C:\ProgramData\SiteAdvisor
   [27/10/2008|20:10] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|14:02] C:\ProgramData\Start Menu 
   [09/10/2008|11:50] C:\ProgramData\TEMP
   [02/11/2006|14:02] C:\ProgramData\Templates 
   [09/10/2008|10:37] C:\ProgramData\WLInstaller
   [10/10/2008|09:28] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [09/10/2008|08:41] C:\Program Files\Acer
   [09/05/2008|03:04] C:\Program Files\Acer Arcade Live
   [09/05/2008|03:15] C:\Program Files\Acer GameZone
   [09/10/2008|08:46] C:\Program Files\Acer Incorporated
   [09/05/2008|03:20] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [09/10/2008|17:52] C:\Program Files\Activision
   [09/05/2008|03:03] C:\Program Files\Adobe
   [09/10/2008|10:36] C:\Program Files\Alwil Software
   [22/10/2008|16:54] C:\Program Files\Apple Software Update
   [09/05/2008|02:33] C:\Program Files\bin32
   [22/10/2008|16:57] C:\Program Files\Bonjour
   [23/10/2008|08:29] C:\Program Files\Common Files
   [09/05/2008|02:59] C:\Program Files\CyberLink
   [23/10/2008|09:30] C:\Program Files\EA GAMES
   [23/10/2008|14:33] C:\Program Files\Electronic Arts
   [09/05/2008|03:33] C:\Program Files\eSobi
   [09/10/2008|08:38] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [27/10/2008|17:59] C:\Program Files\Grisoft
   [09/10/2008|18:24] C:\Program Files\InstallShield Installation Information
   [20/10/2008|06:02] C:\Program Files\Internet Explorer
   [10/10/2008|10:49] C:\Program Files\Java
   [23/10/2008|08:30] C:\Program Files\Lavasoft
   [09/05/2008|02:33] C:\Program Files\log
   [27/10/2008|19:19] C:\Program Files\Malwarebytes' Anti-Malware
   [02/11/2006|13:37] C:\Program Files\Microsoft Games
   [09/05/2008|03:19] C:\Program Files\Microsoft Office
   [09/10/2008|11:04] C:\Program Files\Microsoft Works
   [09/05/2008|03:17] C:\Program Files\Microsoft.NET
   [21/01/2008|03:35] C:\Program Files\Movie Maker
   [27/10/2008|18:38] C:\Program Files\Mozilla Firefox
   [02/11/2006|13:37] C:\Program Files\MSBuild
   [09/10/2008|11:03] C:\Program Files\MSXML 4.0
   [09/05/2008|03:32] C:\Program Files\NewTech Infosystems
   [09/05/2008|02:33] C:\Program Files\profile
   [22/10/2008|16:57] C:\Program Files\QuickTime
   [20/10/2008|06:03] C:\Program Files\Real
   [09/05/2008|02:43] C:\Program Files\Realtek
   [02/11/2006|13:37] C:\Program Files\Reference Assemblies
   [17/10/2008|14:50] C:\Program Files\Spring
   [28/10/2008|11:05] C:\Program Files\Spybot - Search & Destroy
   [27/10/2008|21:23] C:\Program Files\SpywareBlaster
   [10/10/2008|10:50] C:\Program Files\Sun
   [27/10/2008|17:55] C:\Program Files\Trend Micro
   [02/11/2006|14:01] C:\Program Files\Uninstall Information
   [20/10/2008|17:07] C:\Program Files\VideoLAN
   [21/01/2008|03:35] C:\Program Files\Windows Calendar
   [21/01/2008|03:35] C:\Program Files\Windows Collaboration
   [21/01/2008|03:35] C:\Program Files\Windows Defender
   [21/01/2008|03:35] C:\Program Files\Windows Journal
   [09/10/2008|10:43] C:\Program Files\Windows Live
   [16/10/2008|08:49] C:\Program Files\Windows Mail
   [21/01/2008|03:35] C:\Program Files\Windows Media Player
   [09/10/2008|08:38] C:\Program Files\Windows NT
   [21/01/2008|03:35] C:\Program Files\Windows Photo Gallery
   [21/01/2008|03:35] C:\Program Files\Windows Sidebar
   [09/05/2008|03:25] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [09/05/2008|03:03] C:\Program Files\Common Files\Adobe
   [22/10/2008|16:55] C:\Program Files\Common Files\Apple
   [09/05/2008|03:17] C:\Program Files\Common Files\DESIGNER
   [09/05/2008|02:52] C:\Program Files\Common Files\InstallShield
   [10/10/2008|10:48] C:\Program Files\Common Files\Java
   [09/05/2008|03:32] C:\Program Files\Common Files\LightScribe
   [09/10/2008|13:04] C:\Program Files\Common Files\microsoft shared
   [09/05/2008|03:30] C:\Program Files\Common Files\muvee Technologies
   [09/05/2008|03:05] C:\Program Files\Common Files\Oberon Media
   [20/10/2008|06:03] C:\Program Files\Common Files\Real
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [21/01/2008|03:35] C:\Program Files\Common Files\System
   [09/10/2008|10:41] C:\Program Files\Common Files\WindowsLiveInstaller
   [23/10/2008|08:29] C:\Program Files\Common Files\Wise Installation Wizard
   [20/10/2008|06:03] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 78 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   C:\Users\RMY~1\AppData\Local\Temp
slACB1.tmp
   C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookiesémy@bigpoint[1].txt
   C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookiesémy@fr.thepimps.bigpoint[2].txt
   C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookiesémy@fr1.darkorbit.bigpoint[1].txt
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-10-28 18:46:47
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\RMY~1\AppData\Roaming\uTorrent\Hitman 4 Blood Money (FULL) + Crack.rar.torrent
   C:\Users\RMY~1\Documents\LimeWire\Incomplete\T-322459-Le Seigneur Des Anneaux La Bataille Pour La Terre Du Milieu FRENCH iSO CD2 iso crack keygen.zip
   C:\Users\RMY~1\Downloads\Hitman 4 Blood Money (FULL) + Crack.rar


   [F:139][D:31]-> C:\Users\RMY~1\AppData\Local\Temp
   [F:145][D:1]-> C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:3065][D:15]-> C:\Users\RMY~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:18][D:3]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 28/10/2008|18:48 - Option : [1]

   --------------------\  Fin du rapport a 18:48:23
   [ UAC => 1 ]

Destrio5 · Answer

---> Relance Lop S&D.
---> Choisis cette fois-ci l'option 2 (Suppression).
---> Ne ferme pas la fenêtre lors de la suppression !
---> Poste le rapport généré (C:\lopR.txt).

Arknubis · Answer

--------------------\  Lop S&D 4.2.4-8   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : Athlon(tm) Dual Core Processor 4050e )
   BIOS : )Phoenix - Award WorkstationBIOS v6.00PG
   USER : Rémy ( Administrator )
   BOOT : Normal boot
   Antivirus : avast! antivirus 4.8.1229 [VPS 081030-0] 4.8.1229 (Activated)
   C:\ (Local Disk) - NTFS - Total:143 Go (Free:58 Go)
   D:\ (USB)
   E:\ (Local Disk) - NTFS - Total:144 Go (Free:144 Go)
   F:\ (CD or DVD) - UDF - Total:3 Go (Free:0 Go)

   "C:\Lop SD" ( MAJ : 27-10-2008|09:15 )
   Option : [2] ( 28/10/2008|18:57 )

   [ UAC => 1 ]


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\Users\RMY~1\AppData\Local\Temp
slACB1.tmp
   Supprime! - C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookiesémy@bigpoint[1].txt
   Supprime! - C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookiesémy@fr.thepimps.bigpoint[2].txt
   Supprime! - C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookiesémy@fr1.darkorbit.bigpoint[1].txt
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans Local  

   [22/10/2008|13:06] C:\Users\RMY~1\AppData\Local\Adobe
   [22/10/2008|16:54] C:\Users\RMY~1\AppData\Local\Apple
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\Application Data 
   [26/10/2008|08:39] C:\Users\RMY~1\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\GDIPFONTCACHEV1.DAT
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\Historique 
   [28/10/2008|11:07] C:\Users\RMY~1\AppData\Local\IconCache.db
   [22/10/2008|20:17] C:\Users\RMY~1\AppData\Local\Microsoft
   [11/10/2008|20:21] C:\Users\RMY~1\AppData\Local\MigWiz
   [09/10/2008|10:04] C:\Users\RMY~1\AppData\Local\Mozilla
   [09/10/2008|08:43] C:\Users\RMY~1\AppData\Local\PowerCinema
   [09/10/2008|19:19] C:\Users\RMY~1\AppData\Local\PunkBuster
   [28/10/2008|18:57] C:\Users\RMY~1\AppData\Local\Temp
   [09/10/2008|08:41] C:\Users\RMY~1\AppData\Local\Temporary Internet Files 
   [09/10/2008|17:49] C:\Users\RMY~1\AppData\Local\VirtualStore
 
   --------------------\  Tâches planifiées dans C:\Windows	asks

   [28/10/2008 11:11][--ah-----] C:\Windows	asks\SA.DAT
   [28/10/2008 11:10][--a------] C:\Windows	asks\SCHEDLGU.TXT

   --------------------\  Listing des dossiers dans C:\ProgramData
   
   [09/05/2008|03:20] C:\ProgramData\{174892B1-CBE7-44F5-86FF-AB555EFD73A3}
   [09/05/2008|03:04] C:\ProgramData\Acer GameZone Console
   [09/05/2008|03:03] C:\ProgramData\Adobe
   [22/10/2008|16:52] C:\ProgramData\Apple
   [22/10/2008|16:58] C:\ProgramData\Apple Computer
   [02/11/2006|14:02] C:\ProgramData\Application Data 
   [09/10/2008|11:44] C:\ProgramData\Arcade Lab
   [09/10/2008|08:38] C:\ProgramData\Bureau 
   [09/05/2008|03:03] C:\ProgramData\CyberLink
   [02/11/2006|14:02] C:\ProgramData\Desktop 
   [02/11/2006|14:02] C:\ProgramData\Documents 
   [18/10/2008|06:25] C:\ProgramData\eMule
   [09/05/2008|03:33] C:\ProgramData\eSobi
   [09/10/2008|08:38] C:\ProgramData\Favoris 
   [02/11/2006|14:02] C:\ProgramData\Favorites 
   [09/05/2008|03:05] C:\ProgramData\FloodLightGames
   [27/10/2008|17:59] C:\ProgramData\Grisoft
   [23/10/2008|08:32] C:\ProgramData\Lavasoft
   [27/10/2008|18:49] C:\ProgramData\Malwarebytes
   [17/10/2008|07:59] C:\ProgramData\McAfee
   [09/10/2008|08:38] C:\ProgramData\Menu D‚marrer 
   [10/10/2008|18:06] C:\ProgramData\Microsoft
   [15/10/2008|21:52] C:\ProgramData\Microsoft Help
   [09/10/2008|08:38] C:\ProgramData\ModŠles 
   [09/10/2008|08:43] C:\ProgramData\NVIDIA
   [11/10/2008|19:22] C:\ProgramData\SiteAdvisor
   [27/10/2008|20:10] C:\ProgramData\Spybot - Search & Destroy
   [02/11/2006|14:02] C:\ProgramData\Start Menu 
   [09/10/2008|11:50] C:\ProgramData\TEMP
   [02/11/2006|14:02] C:\ProgramData\Templates 
   [09/10/2008|10:37] C:\ProgramData\WLInstaller
   [10/10/2008|09:28] C:\ProgramData\Yahoo! Companion

   --------------------\  Listing des dossiers dans C:\Program Files

   [09/10/2008|08:41] C:\Program Files\Acer
   [09/05/2008|03:04] C:\Program Files\Acer Arcade Live
   [09/05/2008|03:15] C:\Program Files\Acer GameZone
   [09/10/2008|08:46] C:\Program Files\Acer Incorporated
   [09/05/2008|03:20] C:\Program Files\Activation Assistant for the 2007 Microsoft Office suites
   [09/10/2008|17:52] C:\Program Files\Activision
   [09/05/2008|03:03] C:\Program Files\Adobe
   [09/10/2008|10:36] C:\Program Files\Alwil Software
   [22/10/2008|16:54] C:\Program Files\Apple Software Update
   [09/05/2008|02:33] C:\Program Files\bin32
   [22/10/2008|16:57] C:\Program Files\Bonjour
   [23/10/2008|08:29] C:\Program Files\Common Files
   [09/05/2008|02:59] C:\Program Files\CyberLink
   [23/10/2008|09:30] C:\Program Files\EA GAMES
   [23/10/2008|14:33] C:\Program Files\Electronic Arts
   [09/05/2008|03:33] C:\Program Files\eSobi
   [09/10/2008|08:38] C:\Program Files\Fichiers communs [C:\Program Files\Common Files]
   [27/10/2008|17:59] C:\Program Files\Grisoft
   [09/10/2008|18:24] C:\Program Files\InstallShield Installation Information
   [20/10/2008|06:02] C:\Program Files\Internet Explorer
   [10/10/2008|10:49] C:\Program Files\Java
   [23/10/2008|08:30] C:\Program Files\Lavasoft
   [09/05/2008|02:33] C:\Program Files\log
   [27/10/2008|19:19] C:\Program Files\Malwarebytes' Anti-Malware
   [02/11/2006|13:37] C:\Program Files\Microsoft Games
   [09/05/2008|03:19] C:\Program Files\Microsoft Office
   [09/10/2008|11:04] C:\Program Files\Microsoft Works
   [09/05/2008|03:17] C:\Program Files\Microsoft.NET
   [21/01/2008|03:35] C:\Program Files\Movie Maker
   [27/10/2008|18:38] C:\Program Files\Mozilla Firefox
   [02/11/2006|13:37] C:\Program Files\MSBuild
   [09/10/2008|11:03] C:\Program Files\MSXML 4.0
   [09/05/2008|03:32] C:\Program Files\NewTech Infosystems
   [09/05/2008|02:33] C:\Program Files\profile
   [22/10/2008|16:57] C:\Program Files\QuickTime
   [20/10/2008|06:03] C:\Program Files\Real
   [09/05/2008|02:43] C:\Program Files\Realtek
   [02/11/2006|13:37] C:\Program Files\Reference Assemblies
   [17/10/2008|14:50] C:\Program Files\Spring
   [28/10/2008|11:05] C:\Program Files\Spybot - Search & Destroy
   [27/10/2008|21:23] C:\Program Files\SpywareBlaster
   [10/10/2008|10:50] C:\Program Files\Sun
   [27/10/2008|17:55] C:\Program Files\Trend Micro
   [02/11/2006|14:01] C:\Program Files\Uninstall Information
   [20/10/2008|17:07] C:\Program Files\VideoLAN
   [21/01/2008|03:35] C:\Program Files\Windows Calendar
   [21/01/2008|03:35] C:\Program Files\Windows Collaboration
   [21/01/2008|03:35] C:\Program Files\Windows Defender
   [21/01/2008|03:35] C:\Program Files\Windows Journal
   [09/10/2008|10:43] C:\Program Files\Windows Live
   [16/10/2008|08:49] C:\Program Files\Windows Mail
   [21/01/2008|03:35] C:\Program Files\Windows Media Player
   [09/10/2008|08:38] C:\Program Files\Windows NT
   [21/01/2008|03:35] C:\Program Files\Windows Photo Gallery
   [21/01/2008|03:35] C:\Program Files\Windows Sidebar
   [09/05/2008|03:25] C:\Program Files\Yahoo!

   --------------------\  Listing des dossiers dans C:\Program Files\Common Files

   [09/05/2008|03:03] C:\Program Files\Common Files\Adobe
   [22/10/2008|16:55] C:\Program Files\Common Files\Apple
   [09/05/2008|03:17] C:\Program Files\Common Files\DESIGNER
   [09/05/2008|02:52] C:\Program Files\Common Files\InstallShield
   [10/10/2008|10:48] C:\Program Files\Common Files\Java
   [09/05/2008|03:32] C:\Program Files\Common Files\LightScribe
   [09/10/2008|13:04] C:\Program Files\Common Files\microsoft shared
   [09/05/2008|03:30] C:\Program Files\Common Files\muvee Technologies
   [09/05/2008|03:05] C:\Program Files\Common Files\Oberon Media
   [20/10/2008|06:03] C:\Program Files\Common Files\Real
   [02/11/2006|12:18] C:\Program Files\Common Files\Services
   [02/11/2006|12:18] C:\Program Files\Common Files\SpeechEngines
   [21/01/2008|03:35] C:\Program Files\Common Files\System
   [09/10/2008|10:41] C:\Program Files\Common Files\WindowsLiveInstaller
   [23/10/2008|08:29] C:\Program Files\Common Files\Wise Installation Wizard
   [20/10/2008|06:03] C:\Program Files\Common Files\xing shared

   --------------------\  Process

   ( 79 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-10-28 18:57:35
   Windows 6.0.6001 Service Pack 1 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 0
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\RMY~1\AppData\Roaming\uTorrent\Hitman 4 Blood Money (FULL) + Crack.rar.torrent
   C:\Users\RMY~1\Documents\LimeWire\Incomplete\T-322459-Le Seigneur Des Anneaux La Bataille Pour La Terre Du Milieu FRENCH iSO CD2 iso crack keygen.zip
   C:\Users\RMY~1\Downloads\Hitman 4 Blood Money (FULL) + Crack.rar


   [F:140][D:30]-> C:\Users\RMY~1\AppData\Local\Temp
   [F:142][D:1]-> C:\Users\RMY~1\AppData\Roaming\MICROS~1\Windows\Cookies
   [F:3067][D:15]-> C:\Users\RMY~1\AppData\Local\MICROS~1\Windows\TEMPOR~1\content.IE5
   [F:18][D:3]-> C:\$Recycle.Bin

   1 - "C:\Lop SD\LopR_1.txt" - 28/10/2008|18:48 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 28/10/2008|18:59 - Option : [2]

   --------------------\  Fin du rapport a 18:59:52
   [ UAC => 1 ]

Destrio5 · Answer

---> Poste un nouveau rapport HijackThis.

Arknubis · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07:08, on 28/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32undll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\VM305_STI.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\RMY~1\AppData\Local\Temp\AutoRun.exe
C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\lotrbfme.exe
C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat
C:\Users\RMY~1\AppData\Local\Temp\~e5.0001
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [BigDog305] C:\Windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O13 - Gopher Prefix: 
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\bin32
SvcAppFlt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\bin32
SvcIp.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

Arknubis · Answer

Le truc est toujours présent juste apres le rapport de Hijacks il a réouvert une page...

Destrio5 · Answer

--> Télécharge UsbFix (de Chiquitine29) sur ton Bureau :
http://sd-1.archive-host.com/membres/up/116615172019703188/UsbFix.exe

--> Lance l'installation avec les paramètres par défaut.

--> Branche tes sources de données externes à ton PC (clé USB, disque dur externe, etc...) sans les ouvrir.

--> Clique droit sur le raccourci UsbFix qui est sur ton Bureau et choisis Exécuter en tant qu'administrateur.

--> Le PC va redémarrer.

--> Après redémarrage, poste le rapport UsbFix.txt

Note : le rapport UsbFix.txt est sauvegardé à la racine du disque.

(Si le Bureau ne réapparait pas, presse Ctrl+Alt+Suppr, Onglet "Fichier", "Nouvelle tâche", tape explorer.exe et valide)

Arknubis · Answer

Voila s'est fait mais apres le redémarrage il n'y a pas eu de rapport d'afficher :s

Destrio5 · Answer

As-tu regardé dans C:\ ?

Arknubis · Answer

il se met sous quelle nom?

https://imageshack.com/

Destrio5 · Answer

Il n'y est pas.

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Arknubis · Answer

ca doit être celui ci

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== COMMANDS ==========
File delete failed. C:\Users\RMY~1\AppData\Local\Temp\etilqs_ROdIt2q4ONllg9ndogxR scheduled to be deleted on reboot.
File delete failed. C:\Users\RMY~1\AppData\Local\Temp\~DFC62.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\RMY~1\AppData\Local\Temp\~DFC73C.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\RMY~1\AppData\Local\Temp\~DFC74B.tmp scheduled to be deleted on reboot.
File delete failed. C:\Users\RMY~1\AppData\Local\Temp\~DFC84.tmp scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
Windows Temp folder emptied.
File delete failed. C:\Users\Rémy\AppData\Local\Mozilla\Firefox\Profiles\q0kdspq9.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Rémy\AppData\Local\Mozilla\Firefox\Profiles\q0kdspq9.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Rémy\AppData\Local\Mozilla\Firefox\Profiles\q0kdspq9.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Rémy\AppData\Local\Mozilla\Firefox\Profiles\q0kdspq9.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Users\Rémy\AppData\Local\Mozilla\Firefox\Profiles\q0kdspq9.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Users\Rémy\AppData\Local\Mozilla\Firefox\Profiles\q0kdspq9.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.5.0 log created on 10282008_192913

Destrio5 · Answer

Oui.

Je te réponds tout à l'heure.

Destrio5 · Answer

---> Poste un nouveau rapport HijackThis.

Arknubis · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:07:08, on 28/10/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\System32undll32.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe
C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSLoader.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Windows\VM305_STI.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\RMY~1\AppData\Local\Temp\AutoRun.exe
C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\lotrbfme.exe
C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat
C:\Users\RMY~1\AppData\Local\Temp\~e5.0001
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDStoolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Program Files\Acer\Empowering Technology\SysMonitor.exe
O4 - HKLM\..\Run: [EmpoweringTechnology] C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe boot
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe
O4 - HKLM\..\Run: [PCMMediaSharing] C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"
O4 - HKLM\..\Run: [WarReg_PopUp] C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [BigDog305] C:\Windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32
vlsp.dll
O13 - Gopher Prefix: 
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Acer HomeMedia Connect Service - CyberLink - C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe
O23 - Service: eDataSecurity Service - Egis Incorporated - C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSService.exe
O23 - Service: Empowering Technology Service (ETService) - Unknown owner - C:\Program Files\Acer\Empowering Technology\Service\ETService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\bin32
SvcAppFlt.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\bin32
SvcIp.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32
vvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

Destrio5 · Answer

---> Télécharge ComboFix.exe de sUBs sur ton Bureau :
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

/!\ Déconnecte-toi du net et ferme toutes les applications, antivirus et antispyware y compris /!\

---> Double-clique sur Combofix.exe
Un "pop-up" va apparaître qui dit que "ComboFix est utilisé à vos risques et avec aucune garantie...".
Accepte en cliquant sur "Oui"

---> Mets-le en langue française F
Tape sur la touche 1 (Yes) pour démarrer le scan.

/!\ Ne touche à rien tant que le scan n'est pas terminé. /!\

En fin de scan, il est possible que ComboFix ait besoin de redémarrer le PC pour finaliser la désinfection, laisse-le faire.

Une fois le scan achevé, un rapport va s'afficher : Poste son contenu

/!\ Réactive la protection en temps réel de ton antivirus et de ton antispyware avant de te reconnecter à Internet. /!\

Note : Le rapport se trouve également là : C:\ComboFix\Combofix.txt

Arknubis · Answer

okay je ferais ca demain dans la journée car la je suis occupé....

Merci je te tien au courant dans le courant de l'apres-midi..

Arknubis · Answer

beug

https://imageshack.com/

Destrio5 · Answer

Vérifie que l'UAC soit désactivé.

Pour lancer ComboFix, clique droit sur l'icône et choisis Exécuter en tant qu'administrateur.

Arknubis · Answer

okay je fais ca sois tard ce soir ou demain car comme d'habitude j'peux pas me deco de internet longtemps :p

Je suis administrateur de mon oridi comme je suis le seul utilisateur et que une seul session, donc ca doit venir de L'UAC

Arknubis · Answer

new beug

https://imageshack.com/

Destrio5 · Answer

Ta date est fausse, modifie-la.

Arknubis · Answer

ComboFix 08-10-30.12 - Rémy 2008-11-01 16:00:59.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.1856 [GMT 1:00] Lancé depuis: C:\Users\Rémy\Downloads\ComboFix.exe * Un nouveau point de restauration a été créé . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files\c32d197a-c3ca-9547-f9f6-a5c7ff6946cf C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp1666.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp1AC0.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp1F9.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp24CE.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp25F6.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp2635.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp2F37.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp2F3A.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp2F47.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp2FB6.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp33BA.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp3754.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp3C44.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp42A9.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp42FF.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp4317.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp4B45.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp5A8.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp5ACF.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp5DCF.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp7168.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp7619.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp798F.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp81A.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mp83E5.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpABC8.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpACD8.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpCB3A.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpD4A.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpD7AF.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpDA54.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpE36B.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpE382.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpE4E2.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpE58F.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpF611.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpF99.tmp C:\Users\Rémy\AppData\Local\Microsoft\Windows\Temporary Internet Files mpFBBC.tmp . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-01 au 2008-11-01 )))))))))))))))))))))))))))))))))))) . 2008-10-29 10:43 . 2008-08-05 10:49 428,544 --a------ C:\Windows\System32\EncDec.dll 2008-10-29 10:43 . 2008-08-05 10:49 293,376 --a------ C:\Windows\System32\psisdecd.dll 2008-10-29 10:43 . 2008-08-05 10:48 217,088 --a------ C:\Windows\System32\psisrndr.ax 2008-10-29 10:43 . 2008-08-05 10:48 177,664 --a------ C:\Windows\System32\mpg2splt.ax 2008-10-29 10:43 . 2008-08-05 10:48 80,896 --a------ C:\Windows\System32\MSNP.ax 2008-10-28 19:29 . 2008-10-28 19:29 d-------- C:\_OTMoveIt 2008-10-28 19:12 . 2008-10-28 19:12 d-------- C:\Program Files\UsbFix 2008-10-28 18:45 . 2008-10-28 19:11 d-------- C:\Lop SD 2008-10-27 21:22 . 2008-10-27 21:23 d-------- C:\Program Files\SpywareBlaster 2008-10-27 18:49 . 2008-10-27 18:49 d-------- C:\Users\Rémy\AppData\Roaming\Malwarebytes 2008-10-27 18:49 . 2008-10-27 18:49 d-------- C:\Users\All Users\Malwarebytes 2008-10-27 18:49 . 2008-10-27 18:49 d-------- C:\ProgramData\Malwarebytes 2008-10-27 18:49 . 2008-10-27 19:19 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-10-27 18:49 . 2008-10-22 16:10 38,496 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys 2008-10-27 18:49 . 2008-10-22 16:10 15,504 --a------ C:\Windows\System32\drivers\mbam.sys 2008-10-27 18:39 . 2008-10-27 18:39 4,588 --a------ C:\Windows\System32 mp.reg 2008-10-27 18:38 . 2007-09-05 23:22 289,144 --a------ C:\Windows\System32\VCCLSID.exe 2008-10-27 18:38 . 2006-04-27 16:49 288,417 --a------ C:\Windows\System32\SrchSTS.exe 2008-10-27 18:38 . 2008-09-08 22:38 88,576 --a------ C:\Windows\System32\AntiXPVSTFix.exe 2008-10-27 18:38 . 2008-10-01 14:51 87,552 --a------ C:\Windows\System32\VACFix.exe 2008-10-27 18:38 . 2008-05-18 20:40 82,944 --a------ C:\Windows\System32\IEDFix.exe 2008-10-27 18:38 . 2008-08-18 11:19 82,432 --a------ C:\Windows\System32\404Fix.exe 2008-10-27 18:38 . 2003-06-05 20:13 53,248 --a------ C:\Windows\System32\Process.exe 2008-10-27 18:38 . 2004-07-31 17:50 51,200 --a------ C:\Windows\System32\dumphive.exe 2008-10-27 18:38 . 2007-10-03 23:36 25,600 --a------ C:\Windows\System32\WS2Fix.exe 2008-10-27 18:00 . 2008-10-27 18:00 d-------- C:\Users\Rémy\AppData\Roaming\Grisoft 2008-10-27 17:59 . 2008-10-27 17:59 d-------- C:\Users\All Users\Grisoft 2008-10-27 17:59 . 2008-10-27 17:59 d-------- C:\ProgramData\Grisoft 2008-10-27 17:59 . 2007-05-30 13:10 10,872 --a------ C:\Windows\System32\drivers\AvgAsCln.sys 2008-10-27 17:55 . 2008-10-27 17:55 d-------- C:\Program Files\Trend Micro 2008-10-27 12:24 . 2008-08-12 04:39 443,392 --a------ C:\Windows\System32\win32spl.dll 2008-10-27 12:24 . 2008-09-18 05:56 147,456 --a------ C:\Windows\System32\Faultrep.dll 2008-10-27 12:24 . 2008-09-18 05:56 125,952 --a------ C:\Windows\System32\wersvc.dll 2008-10-25 13:48 . 2008-10-25 13:48 dr------- C:\Windows\System32\config\systemprofile\Music 2008-10-23 14:40 . 2008-10-24 17:23 d-------- C:\Users\Rémy\AppData\Roaming\Mes fichiers de LSDA, L'Avènement du Roi-sorcier™ 2008-10-23 10:04 . 2008-10-23 12:53 d-------- C:\Users\Rémy\AppData\Roaming\La Bataille pour la Terre du Milieu ™ II 2008-10-23 09:48 . 2008-10-23 14:33 d-------- C:\Program Files\Electronic Arts 2008-10-23 09:39 . 2008-10-29 11:48 d-------- C:\Users\Rémy\AppData\Roaming\La Bataille pour la Terre du Milieu 2008-10-23 09:30 . 2008-10-23 09:30 d-------- C:\Program Files\EA GAMES 2008-10-23 08:30 . 2008-10-23 08:32 d-------- C:\Users\All Users\Lavasoft 2008-10-23 08:30 . 2008-10-23 08:32 d-------- C:\ProgramData\Lavasoft 2008-10-23 08:30 . 2008-10-23 08:30 d-------- C:\Program Files\Lavasoft 2008-10-23 08:29 . 2008-10-23 08:29 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-22 19:29 . 2008-10-27 20:10 d-------- C:\Users\All Users\Spybot - Search & Destroy 2008-10-22 19:29 . 2008-10-27 20:10 d-------- C:\ProgramData\Spybot - Search & Destroy 2008-10-22 19:29 . 2008-10-28 11:05 d-------- C:\Program Files\Spybot - Search & Destroy 2008-10-22 16:57 . 2008-10-22 16:57 d-------- C:\Program Files\Bonjour 2008-10-22 16:55 . 2008-10-22 16:57 d-------- C:\Program Files\QuickTime 2008-10-22 16:54 . 2008-10-22 16:58 d-------- C:\Users\All Users\Apple Computer 2008-10-22 16:54 . 2008-10-22 16:58 d-------- C:\ProgramData\Apple Computer 2008-10-22 16:54 . 2008-10-22 16:54 d-------- C:\Program Files\Apple Software Update 2008-10-22 16:52 . 2008-10-22 16:52 d-------- C:\Users\All Users\Apple 2008-10-22 16:52 . 2008-10-22 16:52 d-------- C:\ProgramData\Apple 2008-10-22 16:52 . 2008-10-22 16:55 d-------- C:\Program Files\Common Files\Apple 2008-10-20 17:08 . 2008-10-22 11:53 d-------- C:\Users\Rémy\AppData\Roaming\dvdcss 2008-10-20 17:07 . 2008-10-20 17:07 d-------- C:\Users\Rémy\AppData\Roaming\vlc 2008-10-20 17:07 . 2008-10-20 17:07 d-------- C:\Program Files\VideoLAN 2008-10-20 06:03 . 2008-10-20 06:05 d-------- C:\Users\Rémy\AppData\Roaming\Real 2008-10-20 06:03 . 2008-10-20 06:03 d-------- C:\Program Files\Real 2008-10-20 06:03 . 2008-10-20 06:03 d-------- C:\Program Files\Common Files\xing shared 2008-10-20 06:03 . 2008-10-20 06:03 d-------- C:\Program Files\Common Files\Real 2008-10-17 14:39 . 2008-10-17 14:50 d-------- C:\Program Files\Spring 2008-10-16 12:13 . 2008-10-17 15:07 d-------- C:\Users\Rémy\AppData\Roaming\uTorrent 2008-10-15 16:33 . 2008-09-18 06:09 3,601,464 --a------ C:\Windows\System32 tkrnlpa.exe 2008-10-15 16:33 . 2008-09-18 06:09 3,549,240 --a------ C:\Windows\System32 toskrnl.exe 2008-10-15 16:33 . 2008-09-18 03:16 2,032,640 --a------ C:\Windows\System32\win32k.sys 2008-10-15 16:33 . 2008-08-27 02:06 288,768 --a------ C:\Windows\System32\drivers\srv.sys 2008-10-15 16:32 . 2008-10-02 02:32 1,383,424 --a------ C:\Windows\System32\mshtml.tlb 2008-10-15 16:32 . 2008-10-02 04:49 827,392 --a------ C:\Windows\System32\wininet.dll 2008-10-10 19:01 . 2008-10-18 06:25 d-------- C:\Users\All Users\eMule 2008-10-10 19:01 . 2008-10-18 06:25 d-------- C:\ProgramData\eMule 2008-10-10 18:50 . 2008-10-10 18:50 102,190 --a------ C:\Windows\System32\cont_adzgalore-remove.exe 2008-10-10 18:50 . 2008-10-18 16:42 90,948 --a------ C:\Windows\System32 ciwqaxgxbyzeeoe.dll-uninst.exe 2008-10-10 18:50 . 2008-10-10 18:50 79,072 --a------ C:\Windows\System32\qxviovipmgxiolnxm.exe 2008-10-10 18:27 . 2008-10-25 11:07 d-------- C:\Users\Rémy\AppData\Roaming\LimeWire 2008-10-10 10:50 . 2008-10-10 10:50 d-------- C:\Program Files\Sun 2008-10-10 10:49 . 2008-10-10 10:49 d-------- C:\Program Files\Java 2008-10-10 10:48 . 2008-10-10 10:48 d-------- C:\Program Files\Common Files\Java 2008-10-10 10:07 . 2008-10-10 10:07 d-------- C:\Users\Rémy\AppData\Roaming\PeerNetworking 2008-10-10 09:28 . 2008-10-10 09:28 d-------- C:\Users\Rémy\AppData\Roaming\Yahoo! 2008-10-10 09:28 . 2008-10-10 09:28 d-------- C:\Users\All Users\Yahoo! Companion 2008-10-10 09:28 . 2008-10-10 09:28 d-------- C:\ProgramData\Yahoo! Companion 2008-10-09 19:13 . 2008-10-09 19:13 76 --a------ C:\Windows\System32\pbuser.htm 2008-10-09 19:12 . 2008-10-09 19:12 9,678 --a------ C:\Windows\System32\pbgame.htm 2008-10-09 18:27 . 2005-05-26 14:34 2,297,552 --a------ C:\Windows\System32\d3dx9_26.dll 2008-10-09 18:26 . 2008-10-21 11:26 137,480 --a------ C:\Windows\System32\drivers\PnkBstrK.sys 2008-10-09 18:26 . 2008-10-09 18:26 22,328 --a------ C:\Users\Rémy\AppData\Roaming\PnkBstrK.sys 2008-10-09 18:25 . 2008-10-21 11:26 183,120 --a------ C:\Windows\System32\PnkBstrB.exe 2008-10-09 18:24 . 2008-10-09 19:19 66,872 --a------ C:\Windows\System32\PnkBstrA.exe 2008-10-09 18:24 . 2008-10-09 18:24 319 --a------ C:\Windows\game.ini 2008-10-09 17:52 . 2008-10-09 17:52 d-------- C:\Program Files\Activision 2008-10-09 11:44 . 2008-10-09 11:50 d-a------ C:\Users\All Users\TEMP 2008-10-09 11:44 . 2008-10-09 11:44 d-------- C:\Users\All Users\Arcade Lab 2008-10-09 11:44 . 2008-10-09 11:50 d-a------ C:\ProgramData\TEMP 2008-10-09 11:44 . 2008-10-09 11:44 d-------- C:\ProgramData\Arcade Lab 2008-10-09 11:14 . 2008-07-16 02:32 2,048 --a------ C:\Windows\System32 zres.dll 2008-10-09 11:12 . 2008-05-27 05:59 106,605 --a------ C:\Windows\System32\StructuredQuerySchema.bin 2008-10-09 11:12 . 2008-05-27 06:17 34,816 --a------ C:\Windows\System32\msscb.dll 2008-10-09 11:12 . 2008-05-27 05:59 18,904 --a------ C:\Windows\System32\StructuredQuerySchemaTrivial.bin 2008-10-09 11:12 . 2008-05-27 06:17 11,776 --a------ C:\Windows\System32\msshooks.dll 2008-10-09 11:03 . 2008-10-09 11:03 d-------- C:\Program Files\MSXML 4.0 2008-10-09 11:00 . 2008-06-26 02:45 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-10-09 11:00 . 2008-06-26 02:45 2,644,480 --a------ C:\Windows\System32\NlsLexicons0009.dll 2008-10-09 11:00 . 2008-06-26 04:29 303,616 --a------ C:\Windows\System32\wmpeffects.dll 2008-10-09 10:59 . 2008-06-26 04:29 801,280 --a------ C:\Windows\System32\NaturalLanguage6.dll 2008-10-09 10:58 . 2008-07-31 02:13 4,240,384 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll 2008-10-09 10:58 . 2008-03-08 05:21 1,695,744 --a------ C:\Windows\System32\gameux.dll 2008-10-09 10:58 . 2008-02-29 08:11 988,216 --a------ C:\Windows\System32\winload.exe 2008-10-09 10:58 . 2008-02-29 08:11 927,288 --a------ C:\Windows\System32\winresume.exe 2008-10-09 10:58 . 2008-02-22 06:05 615,992 --a------ C:\Windows\System32\ci.dll 2008-10-09 10:58 . 2008-07-31 04:32 28,160 --a------ C:\Windows\System32\Apphlpdm.dll 2008-10-09 10:58 . 2008-02-29 08:14 19,000 --a------ C:\Windows\System32\kd1394.dll 2008-10-09 10:57 . 2008-04-26 09:26 891,448 --a------ C:\Windows\System32\drivers cpip.sys 2008-10-09 10:57 . 2008-04-12 04:32 784,896 --a------ C:\Windows\System32 pcrt4.dll 2008-10-09 10:57 . 2008-02-29 07:53 378,368 --a------ C:\Windows\System32\srcore.dll 2008-10-09 10:57 . 2008-06-19 04:31 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL 2008-10-09 10:57 . 2008-02-29 05:12 318,464 --a------ C:\Windows\System32 strui.exe 2008-10-09 10:57 . 2008-04-18 06:48 269,312 --a------ C:\Windows\System32\es.dll 2008-10-09 10:57 . 2008-04-05 02:21 72,192 --a------ C:\Windows\System32\drivers\pacer.sys 2008-10-09 10:57 . 2008-02-29 07:53 46,592 --a------ C:\Windows\System32\setbcdlocale.dll 2008-10-09 10:57 . 2008-02-29 07:53 40,960 --a------ C:\Windows\System32\srclient.dll 2008-10-09 10:57 . 2008-04-05 04:34 15,360 --a------ C:\Windows\System32\pacerprf.dll 2008-10-09 10:57 . 2008-02-29 05:12 14,848 --a------ C:\Windows\System32\srdelayed.exe 2008-10-09 10:57 . 2008-02-29 07:35 6,656 --a------ C:\Windows\System32\kbd106n.dll 2008-10-09 10:51 . 2008-05-10 02:33 113,664 --a------ C:\Windows\System32\drivers mcast.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-01 15:06 5,242,880 --sha-w C:\Users\Rémy\NTUSER.DAT 2008-11-01 15:06 5,242,880 --sha-w C:\Users\Rémy\NTUSER.DAT 2008-10-29 10:48 --------- d-----w C:\Users\Rémy\AppData\Roaming\La Bataille pour la Terre du Milieu 2008-10-27 17:49 --------- d-----w C:\Users\Rémy\AppData\Roaming\Malwarebytes 2008-10-27 17:00 --------- d-----w C:\Users\Rémy\AppData\Roaming\Grisoft 2008-10-25 10:07 --------- d-----w C:\Users\Rémy\AppData\Roaming\LimeWire 2008-10-24 16:23 --------- d-----w C:\Users\Rémy\AppData\Roaming\Mes fichiers de LSDA, L'Avènement du Roi-sorcier™ 2008-10-23 11:53 --------- d-----w C:\Users\Rémy\AppData\Roaming\La Bataille pour la Terre du Milieu ™ II 2008-10-23 07:30 --------- d-s---w C:\Users\Rémy\AppData\Roaming\Microsoft 2008-10-22 12:06 --------- d-----w C:\Users\Rémy\AppData\Roaming\Adobe 2008-10-22 10:53 --------- d-----w C:\Users\Rémy\AppData\Roaming\dvdcss 2008-10-20 16:07 --------- d-----w C:\Users\Rémy\AppData\Roaming\vlc 2008-10-20 05:05 --------- d-----w C:\Users\Rémy\AppData\Roaming\Real 2008-10-17 14:07 --------- d-----w C:\Users\Rémy\AppData\Roaming\uTorrent 2008-10-17 06:59 --------- d-----w C:\ProgramData\McAfee 2008-10-16 07:49 --------- d-----w C:\Program Files\Windows Mail 2008-10-15 20:52 --------- d-----w C:\ProgramData\Microsoft Help 2008-10-11 18:22 --------- d-----w C:\ProgramData\SiteAdvisor 2008-10-10 09:07 --------- d-----w C:\Users\Rémy\AppData\Roaming\PeerNetworking 2008-10-10 08:28 --------- d-----w C:\Users\Rémy\AppData\Roaming\Yahoo! 2008-10-09 17:26 22,328 ----a-w C:\Users\Rémy\AppData\Roaming\PnkBstrK.sys 2008-10-09 17:24 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-09 10:04 --------- d-----w C:\Program Files\Microsoft Works 2008-10-09 09:04 --------- d-----w C:\Users\Rémy\AppData\Roaming\Mozilla 2008-10-09 07:46 --------- d-----w C:\Users\Rémy\AppData\Roaming\Macromedia 2008-10-09 07:43 --------- d-----w C:\ProgramData\NVIDIA 2008-10-09 07:42 --------- d-----w C:\Users\Rémy\AppData\Roaming\Identities 2008-10-09 07:41 --------- d-----w C:\Program Files\Acer 2008-10-09 07:38 --------- d-sh--w C:\ProgramData\Modèles 2008-10-09 07:38 --------- d-sh--w C:\ProgramData\Menu Démarrer 2008-10-09 07:38 --------- d-sh--w C:\ProgramData\Favoris 2008-10-09 07:38 --------- d-sh--w C:\ProgramData\Bureau 2008-10-09 07:38 --------- d-sh--w C:\Program Files\Fichiers communs 2008-08-29 08:18 87,336 ----a-w C:\Windows\System32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w C:\Windows\System32\dnssd.dll 2008-08-02 03:26 36,864 ----a-w C:\Windows\System32\cdd.dll 2008-01-21 02:43 174 --sha-w C:\Program Files\desktop.ini . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP] @="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}" [HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}] 2008-03-04 22:38 121392 --a------ C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\PSDProtect.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240] "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-21 125952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2008-04-22 13535776] "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2008-04-22 92704] "Acer Empowering Technology Monitor"="C:\Program Files\Acer\Empowering Technology\SysMonitor.exe" [2008-04-25 319488] "EmpoweringTechnology"="C:\Program Files\Acer\Empowering Technology\Framework.Launcher.exe" [2008-04-25 319488] "eDataSecurity Loader"="C:\Program Files\Acer\Empowering Technology\eDataSecurity\x86\eDSloader.exe" [2008-03-04 526896] "PCMMediaSharing"="C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\PCMMediaSharing.exe" [2008-01-25 204908] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048] "BkupTray"="C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-06 34040] "WarReg_PopUp"="C:\Program Files\Acer\WR_PopUp\WarReg_PopUp.exe" [2008-01-29 303104] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "BigDog305"="C:\Windows\VM305_STI.EXE" [2005-08-05 61440] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 6731312] "RtHDVCpl"="RtHDVCpl.exe" [2008-03-26 C:\Windows\RtHDVCpl.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.mkdmp3enc"= C:\PROGRA~1\ACERAR~1\ACERVI~1\Kernel\Burner\MKDMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{D0C4BE1C-C5B4-4EDF-8FAE-55F438D2DD45}"= C:\Program Files\Acer Arcade Live\Acer Arcade Live Main Page\Acer Arcade Live.exe:Acer Arcade Live "{D90364C1-473F-4313-B223-9241901080C1}"= C:\Program Files\Acer Arcade Live\Acer DV Magician\Acer DV Magician.exe:Acer DV Magician "{AA766C76-F16E-4FE2-A422-7D2BC7C139D9}"= C:\Program Files\Acer Arcade Live\Acer SlideShow DVD\Acer SlideShow DVD.exe:Acer SlideShow DVD "{42C706D2-3910-46FE-98CE-7F03D2047D4F}"= C:\Program Files\Acer Arcade Live\Acer VideoMagician\Acer VideoMagician.exe:Acer VideoMagician "{8D76F545-C6D9-4C81-8BCF-489606A0424A}"= C:\Program Files\Acer Arcade Live\Acer DVDivine\Acer DVDivine.exe:Acer DVDivine "{5649A2D4-F7CA-4F7C-97E2-374C5D2FDF1C}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia\Acer HomeMedia.exe:Acer HomeMedia "{DEDBB5C9-7C94-4700-B32A-CE4BFF5B1973}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Acer HomeMedia Connect.exe:Acer HomeMedia Connect "{FB16079E-B65F-45E2-8AEC-A6FAD42159A2}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.EXE:Acer HomeMedia Connect Service "{88149B78-7766-4162-8F83-D8B6FC8BC0C6}"= C:\Program Files\Acer Arcade Live\Acer HomeMedia Trial Creator\Acer HomeMedia Trial Creator.exe:Acer HomeMedia Trial Creator "{7ACC89C8-89F3-4312-9C9F-199767E21D32}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{C579C023-D32A-41D7-8B1A-6026E5BF1B7B}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{EF4F573B-DB47-4635-B3BF-FEB2070B6865}"= UDP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{6AEEC8E4-82E8-4C7B-A265-0761020E8073}"= TCP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe "{DD76C2F8-89EE-4986-880C-2661D4ACB58C}"= UDP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{6A18787C-34F5-43E8-BD37-A88FF14BAB64}"= TCP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe "{140386EE-96E0-4FEF-A02F-6FAC37BDD3A7}"= UDP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{38BFF5AF-2C45-4A78-A138-33101997BA94}"= TCP:C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe:AgentSvc.exe "{7C4672F8-67DD-4C80-95DF-15CB0B77396A}"= UDP:\BUREAU1\SharedDocs\AXISAddPrinter.exe:AXISAddPrinter "{5C27678E-E3C8-4607-96BC-AC6E97B193CF}"= TCP:\BUREAU1\SharedDocs\AXISAddPrinter.exe:AXISAddPrinter "{0F386449-6E74-411F-8F03-888DA6767A18}"= UDP:\RENAUD1\SharedDocs\AXISAddPrinter(2).exe:AXISAddPrinter "{D9ABFC4A-7687-4D68-87F1-8CFDDB612FDD}"= TCP:\RENAUD1\SharedDocs\AXISAddPrinter(2).exe:AXISAddPrinter "{DF8C7197-9F44-4207-880C-03DC44F1CC68}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{B7C2C621-7208-428B-B874-6B6B87D1017E}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{CBD94F35-B159-4F20-920E-12DC6D2DB90A}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA "{642F7C93-C461-4954-A65C-4CE332AD5EC3}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{B0453FDB-2FDC-41E1-9BA6-96072C615D78}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB "{B7B6BFEC-1EE5-4DE9-A5E8-E8CDD6B661B3}"= UDP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "{B62CF02A-42CB-4145-A0FA-2ADD907BEA84}"= TCP:C:\Program Files\Activision\Call of Duty 4 - Modern Warfare\iw3mp.exe:Call of Duty(R) 4 - Modern Warfare(TM) "TCP Query User{9787BFFD-53F0-40AA-8B4F-7CC0ECF2C252}C:\program files\emule\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule "UDP Query User{99FB30E7-FD61-46DD-94F1-4BCCDE3648F2}C:\program files\emule\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule "{0B160DB8-E7A1-4F9C-810E-652186E0292C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{FA7F8EDA-D5D7-4082-99D2-7C700D884E73}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour "{4A66E17E-AA09-4BE4-8ABE-B9025870F302}"= UDP:C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat:La Bataille pour la Terre du Milieu(tm) "{82A51D5B-2CDE-4030-A8EB-13E1C6C7A6E3}"= TCP:C:\Program Files\EA GAMES\La Bataille pour la Terre du Milieu(tm)\game.dat:La Bataille pour la Terre du Milieu(tm) "{42A29A15-B6E5-457B-AC02-8484E399C850}"= UDP:C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II "{0A4B149E-F2DA-4803-B32C-572BE3C6F6E8}"= TCP:C:\Program Files\Electronic Arts\La Bataille pour la Terre du Milieu II\game.dat:La Bataille pour la Terre du Milieu ™ II "{074670F8-BFE9-41F0-8E9C-856838E02C18}"= UDP:C:\Program Files\Electronic Arts\L'Avènement du Roi-sorcier\game.dat:LSDA, L'Avènement du Roi-sorcier™ "{27A158DD-7417-4B93-8550-DD8C5345182B}"= TCP:C:\Program Files\Electronic Arts\L'Avènement du Roi-sorcier\game.dat:LSDA, L'Avènement du Roi-sorcier™ "TCP Query User{C8687D81-6A08-4C24-B96B-D9DD503283EC}C:\program files\electronic arts\l'avènement du roi-sorcier\patchget.dat"= UDP:C:\program files\electronic arts\l'avènement du roi-sorcier\patchget.dat:patchgrabber "UDP Query User{B2BAF2E3-E7CE-49D9-9230-C93C39316E86}C:\program files\electronic arts\l'avènement du roi-sorcier\patchget.dat"= TCP:C:\program files\electronic arts\l'avènement du roi-sorcier\patchget.dat:patchgrabber "TCP Query User{D2E8FB57-1ABA-4713-BF7C-263C87FCACFA}C:\program files\mozilla firefox\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{ED5453F5-3506-4798-BDDC-FC03D30F07A1}C:\program files\mozilla firefox\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "{6698B74F-AA41-44D1-A63C-AAED8B6C1019}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 78416] R2 Acer HomeMedia Connect Service;Acer HomeMedia Connect Service;C:\Program Files\Acer Arcade Live\Acer HomeMedia Connect\Kernel\DMS\CLMSServer.exe [2008-01-25 269448] R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 51280] R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 16384] R2 ETService;Empowering Technology Service;C:\Program Files\Acer\Empowering Technology\Service\ETService.exe [2008-04-25 24576] R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-06 50424] R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 131072] R3 NVHDA;Service for NVIDIA High Definition Audio Driver;C:\Windows\system32\drivers vhda32v.sys [2008-04-22 43552] S3 ZSMC0305;A4 TECH PC Camera V;C:\Windows\system32\Drivers\usbVM305.sys [2006-05-08 391688] S4 ErrDev;Microsoft Hardware Error Device Driver;C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656] S4 MegaSR;MegaSR;C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . - - - - ORPHELINS SUPPRIMES - - - - HKCU-Run-eMuleAutoStart - C:\Program Files\eMule\emule.exe HKLM-Run-eRecoveryService - (no file) . ------- Examen supplémentaire ------- . FireFox -: Profile - C:\Users\Rémy\AppData\Roaming\Mozilla\Firefox\Profiles\q0kdspq9.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://sg-univers.fr/ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-01 16:06:36 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run BigDog305 = C:\Windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????@?@?????????????????????????? Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-01 16:08:08 ComboFix-quarantined-files.txt 2008-11-01 15:08:03 Avant-CF: 72 660 893 696 octets libres Après-CF: 72,389,480,448 octets libres 337 --- E O F --- 2008-10-29 21:11:12

Destrio5 · Answer

/!\ Seul Arknubis peut suivre cette procédure /!\


1/

---> Clique sur Démarrer, Exécuter, tape notepad clique sur OK.

---> Copie le texte ci-dessous par sélection puis Ctrl+C :






KillAll::

File::
C:\Users\RMY~1\AppData\Local\Temp\AutoRun.exe
C:\Users\RMY~1\AppData\Local\Temp\~e5.0001
C:\Windows\System32\VCCLSID.exe     
C:\Windows\System32\SrchSTS.exe     
C:\Windows\System32\AntiXPVSTFix.exe 
C:\Windows\System32\VACFix.exe     
C:\Windows\System32\IEDFix.exe     
C:\Windows\System32\404Fix.exe     
C:\Windows\System32\Process.exe     
C:\Windows\System32\dumphive.exe     
C:\Windows\System32\WS2Fix.exe     
C:\Windows\System32\cont_adzgalore-remove.exe 
C:\Windows\System32
ciwqaxgxbyzeeoe.dll-uninst.exe 
C:\Windows\System32\qxviovipmgxiolnxm.exe 






---> Colle la sélection dans le bloc-notes

---> Enregistre ce fichier sur le bureau (Impératif)

---> Nom du fichier : CFScript
---> Type du fichier : tous les fichiers
---> Clique sur Enregistrer
---> Quitte le bloc-notes


2/

---> Fait un glisser/déposer de ce fichier CFScript sur le fichier ComboFix.exe comme sur la capture :
http://www.searchengines.pl/phpbb203/pliki/picasso/virus/programs/combofix/combofix_cfscript.gif

[*] Une fenêtre bleue va apparaître : au message qui apparaît, tu acceptes.

[*] Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises : c'est normal !
Ne touche à rien tant que le scan n'est pas terminé.

[*] Une fois le scan achevé, un rapport va s'afficher : poste-le

[*] Si le fichier ne s'ouvre pas, il se trouve ici C:\ComboFix.txt

Arknubis · Answer

s'est normal que je trouve pas Executer?

Destrio5 · Answer

Pour Vista, ça change un peu.

---> Clique sur le logo Vista (Rond bleu), tape Exécuter dans la barre Rechercher puis valide par Entrée.

Arknubis · Answer

Il a était jusque l'etape 50

et la il ma marquer que le system32 n'etait pas un fichier interne, externe écutable et un autre truc mais je sais plus quoi.

Pas pu faire de screen car mon bureau était plus la j'ai du redémarrer car il ma marqué le texte pendant casi 10minutes.

Donc voila est-ce normale?

Destrio5 · Answer

Non.

As-tu néanmoins un rapport ?

Arknubis · Answer

Non pas de rapport.

De plus l'ancien rapport de tout a l'heure n'est plus ou il était et je le trouve pas :s

Destrio5 · Answer

Ton problème est toujours là ?

Arknubis · Answer

Pas l'air.

Merci beaucoup ;)
En plus depuis que j'avais ce truc mon internet lagais pas mal la il est nettement plus rapide :)

Destrio5 · Answer

On peut vérifier :

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau :
http://oldtimer.geekstogo.com/OTMoveIt3.exe

---> Double-clique sur OTMoveIt3.exe afin de le lancer.

---> Copie (Ctrl+C) le texte suivant ci-dessous : 





:processes
explorer.exe 

:files 
C:\Users\RMY~1\AppData\Local\Temp\AutoRun.exe
C:\Users\RMY~1\AppData\Local\Temp\~e5.0001
C:\Windows\System32\VCCLSID.exe
C:\Windows\System32\SrchSTS.exe
C:\Windows\System32\AntiXPVSTFix.exe
C:\Windows\System32\VACFix.exe
C:\Windows\System32\IEDFix.exe
C:\Windows\System32\404Fix.exe
C:\Windows\System32\Process.exe
C:\Windows\System32\dumphive.exe
C:\Windows\System32\WS2Fix.exe
C:\Windows\System32\cont_adzgalore-remove.exe
C:\Windows\System32
ciwqaxgxbyzeeoe.dll-uninst.exe
C:\Windows\System32\qxviovipmgxiolnxm.exe 

:commands
[purity]
[emptytemp]
[start explorer]
[reboot]





---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved.

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3.

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.
Accepte en cliquant sur YES.

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Virus

54 réponses

Discussions similaires

Newsletters