pub intemprestives et antivirus windows 2009 Fermé

Question

Bonjour,

je viens ici car j'ai besoin d'aide: 
J'ai un pb de fe^tre intempsetives qui dure depuis des mois et je n'en peux plus...j'ai essayer d'installer anvilog mais c'est impossible car il semble qu'un fichier ne peut être copier. De plus en ce moment je n'arr^te pas de recevoir la fen^tre me proposant l'antivirus windows 2009 et ça me gave (je sais que c'est un virus...)
si quelqu'un peu me venir en aide, 
merci d'avance, 
>Philjofr

zazouu14 · Answer

bloque les fenetre intempestive

Utilisateur anonyme · Answer

Salut, ==============================POUR VISTA================================== =>< Désactive le « contrôle des comptes utilisateurs = UAC » (tu le réactiveras après ta désinfection): Ne pas oublier !! Désactiver l'UAC est nécessaire pour pouvoir faire fonctionner certains programmes sous Vista. - Vas dans Démarrer puis panneau de configuration - Double Clique sur l'icône "Comptes d'utilisateurs" - Clique ensuite sur désactiver et valide. =><>NOTE: =>mode avancé=> outils => résident Décocher la case résident "tea timer" Refermer Spybot. télécharge hijackthis -> enregistre la cible sous .... "le bureau" ->renommer hijackthis en faisant comme suit:Fais un clic droit sur hijackthis, choisis "renommer" marque : ABCD.exe -> Fais un double-clic sur "HJTInstall.exe" afin de lancer l'installation -> Clique sur Install ensuite sur "I Accept" -> Clique sur" Do a scan system and save log file" -> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

philjofr · Answer

voici le rapport histjack

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jo\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = NC NUMERICABLE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S93.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Policies\Explorer\Run: [{8873867D-0B75-1036-0617-050623050021}] "C:\Program Files\Fichiers communs\{8873867D-0B75-1036-0617-050623050021}\Update.exe" mc-110-12-0000140
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGhpbA\command.exe (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

philjofr · Answer

voici le rapport histjack

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jo\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = NC NUMERICABLE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S93.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Policies\Explorer\Run: [{8873867D-0B75-1036-0617-050623050021}] "C:\Program Files\Fichiers communs\{8873867D-0B75-1036-0617-050623050021}\Update.exe" mc-110-12-0000140
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGhpbA\command.exe (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Re,

installe NAVILOG1


Remarque concernant la détection de Navilog1 par certains programmes de sécurités :

Certains fichiers de Navilog1.exe peuvent être considérés comme dangereux et donc supprimés ou neutralisés par certains programmes de sécurités. Ce sont des faux positifs et dans certains cas, vous serez amener à désactiver votre protection le temps du téléchargement/utilisation de Navilog1.
/ !\ Déconnecte toi du net et désactive ton antivirus et antispyware résident pour que Navilog1 puisse s'exécuter normalement. / !\

Utilisateurs de Windows Vista :

* Afin que Navilog1 puisse fonctionner correctement, il est recommandé de désactiver l'UAC pendant l'utilisation de Navilog1 (Installation, Utilisation). N'oubliez pas dès l'utilisation de Navilog1 terminé à réactiver l'UAC sur votre Ordinateur.
comment faire pour désactiver l'UAC

* A chaque fois que vous êtes amené à exécuter Navilog1.bat ou Navilog1.exe pour l'installation, ne double-cliquez pas sur le fichier ou raccourci mais faites un clic droit dessus et dans le menu contextuel choisssez "Exécuter en tant qu'administrateur".

Le lancement de l'installation de Navilog1 se fait en exécutant Navilog1.exe

(Si vous avez téléchargé navilog1.zip, Veuillez auparavant décompresser ce fichier)

Une fois l'installation terminé, pour lancer le fix :

- en utilisant le raccourci crée sur le bureau : Navilog1
- Via le poste de travail, en exécutant le fichier Navilog1.bat se trouvant dans %program files%Navilog1

Après le choix de la langue et les messages d'avertissement, le menu s'affiche.

Faite le choix 1

Effectue la vérification du système à la recherche de l'adware. Un scan avec catchme de GMER est également éffectué pour Windows XP. Cette analyse peut durer une dizaine de minutes. Patientez alors jusqu'au message «Analyse terminée le ....». Appuyez sur une touche comme demandé et le bloc note va souvrir , Enregistrez-le sur votre disque. Puis Ouvrez-le et Copiez-Collez l'intégralité de ce rapport sur le forum qui vous l'auras demandé.

(si le bloc-note ne s'ouvre pas : Rendez-vous dans votre poste de travail, à la racine du disque C vous trouverez le rapport sous le nom de fixnavi.txt)

Attention : Ne lancez-pas la partie désinfection (choix 2, 3 ou 4) sans l'avis/accord express de l'Helper qui vous as pris en charge sur le forum d'aide ou vous aurez exposer votre problème.

philjofr · Answer

voici le rapport de navilog...et je crois que je suis aussi infecté vundo car mon antivirus n'arrête pas de me le dire!!!
Search Navipromo version 3.6.7 commencé le 03/11/2008 à 13:16:58,98

!!! Attention,ce rapport peut indiquer des fichiers/programmes légitimes!!!
!!! Postez ce rapport sur le forum pour le faire analyser !!!
!!! Ne lancez pas la partie désinfection sans l'avis d'un spécialiste !!!

Outil exécuté depuis C:\Program Files
avilog1
Session actuelle : "Jo" 

Mise à jour le 22.10.2008 à 20h00 par IL-MAFIOSO


Microsoft Windows XP [version 5.1.2600]
Internet Explorer : 6.0.2900.2180 
Système de fichiers : NTFS

Recherche executé en mode normal

*** Recherche Programmes installés ***


*** Recherche dossiers dans "C:\WINDOWS" ***


*** Recherche dossiers dans "C:\Program Files" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1\progra~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\All Users\menudm~1" ***


*** Recherche dossiers dans "c:\docume~1\alluse~1\applic~1" ***


*** Recherche dossiers dans "C:\Documents and Settings\Jo\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Jo\locals~1\applic~1" *** 


*** Recherche dossiers dans "C:\Documents and Settings\Jo\menudm~1\progra~1" *** 


*** Recherche avec Catchme-rootkit/stealth malware detector par gmer ***
pour + d'infos : http://www.gmer.net



*** Recherche avec GenericNaviSearch ***
!!! Tous ces résultats peuvent révéler des fichiers légitimes !!!
!!! A vérifier impérativement avant toute suppression manuelle !!!

* Recherche dans "C:\WINDOWS\system32" *

* Recherche dans "C:\Documents and Settings\Jo\locals~1\applic~1" * 



*** Recherche fichiers *** 



*** Recherche clés spécifiques dans le Registre ***


*** Module de Recherche complémentaire ***
(Recherche fichiers spécifiques)

1)Recherche nouveaux fichiers Instant Access :


2)Recherche Heuristique :

* Dans "C:\WINDOWS\system32" :


* Dans "C:\Documents and Settings\Jo\locals~1\applic~1" : 


3)Recherche Certificats :

Certificat Egroup absent !
Certificat Electronic-Group absent !
Certificat Montorgueil absent !
Certificat OOO-Favorit absent !
Certificat Sunny-Day-Design-Ltd absent !

4)Recherche fichiers connus :

C:\WINDOWS\system32\TAbeKkkj.ini2 trouvé ! infection Vundo possible non traitée par cet outil !


*** Analyse terminée le 03/11/2008 à 13:22:24,60 ***

Utilisateur anonyme · Answer

Re,


installe [- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe smitfraudfix]



Option:1 => Recherche:

    * Double cliquer sur SmitfraudFix.exe
    
* Sélectionner 1 et pressez =>Entrée dans le menu pour créer 

un rapport des fichiers responsables de l'infection. Le rapport se trouve à la racine du disque 

système 

C:\rapport.txt

==>et colle le rapport génèrer sur le forum.

*=>Ne pas faire l'option 2 sans un avis d'une personne compétente*<=

philjofr · Answer

tu crois qu'on va s'en sortir?

Utilisateur anonyme · Answer

Re,

Fait sa .

@+

philjofr · Answer

voici le rapport:
SmitFraudFix v2.371

Rapport fait à 13:28:13,37, 03/11/2008
Executé à partir de C:\Documents and Settings\Jo\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jo\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\brastk.exe PRESENT !
C:\WINDOWS\system32\_scui.cpl PRESENT !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jo


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jo\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jo\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jo\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="dxclib303562752.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: SiS191 1000/100/10 Ethernet Device - Miniport d'ordonnancement de paquets
DNS Server Search Order: 195.5.219.1

Description: Motorola SURFboard SB5120 USB Cable Modem - Miniport d'ordonnancement de paquets
DNS Server Search Order: 80.236.0.73
DNS Server Search Order: 81.220.255.4
DNS Server Search Order: 80.236.0.68

Description: Motorola SURFboard SB5120 USB Cable Modem - Miniport d'ordonnancement de paquets
DNS Server Search Order: 89.2.0.1
DNS Server Search Order: 89.2.0.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0641817A-CEDA-4E76-BA41-149CBAE9B6C7}: DhcpNameServer=80.236.0.73 81.220.255.4 80.236.0.68
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6A11801C-FB3D-45B0-A6DC-0514245451B5}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0641817A-CEDA-4E76-BA41-149CBAE9B6C7}: DhcpNameServer=80.236.0.73 81.220.255.4 80.236.0.68
HKLM\SYSTEM\CS2\Services\Tcpip\..\{6A11801C-FB3D-45B0-A6DC-0514245451B5}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

Re, Maintenant fait ceci: 2) Nettoyage: * Redemarrer l'ordinateur en mode sans échec: * Double cliquer sur smitfraudix: * Sélectionner 2 et pressez Entrée dans le menu pour supprimer les fichiers responsables de l'infection. * A la question: Voulez-vous nettoyer le registre ? répondre O (oui) et pressez Entrée afin de débloquer le fond d'écran et supprimer les clés de registre de l'infection:. * Le fix déterminera si le fichier wininet.dll est infecté. A la question: Corriger le fichier infecté ? répondre O (oui) et pressez Entrée pour remplacer le fichier corrompu:. * Un redemarrage sera peut être necessaire pour terminer la procedure de nettoyage. Le rapport se trouve à la racine du disque système C:\rapport.txt: Option:: * Pour effacer la liste des sites de confiance et sensibles, sélectionner 3 et pressez Entrée dans le menu. * A la question: Réinitialiser la liste des sites de confiance et sensibles ? répondre O (oui) et pressez Entrée afin de restaurer les zones de confiances et sensibles:. :FAUX POSITIF:: process.exe est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus. Ensuite tu me refait un rapport hijackthis.STP. merci

philjofr · Answer

voici le rapport smitfraud:
SmitFraudFix v2.371

Rapport fait à 13:51:15,78, 03/11/2008
Executé à partir de C:\Documents and Settings\Jo\Bureau\programme\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode sans echec

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Avant SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Arret des processus


»»»»»»»»»»»»»»»»»»»»»»»» hosts


127.0.0.1       localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

C:\WINDOWS\system32\brastk.exe supprimé
C:\WINDOWS\system32\_scui.cpl supprimé

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0641817A-CEDA-4E76-BA41-149CBAE9B6C7}: DhcpNameServer=80.236.0.73 81.220.255.4 80.236.0.68
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0641817A-CEDA-4E76-BA41-149CBAE9B6C7}: DhcpNameServer=80.236.0.73 81.220.255.4 80.236.0.68
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1


»»»»»»»»»»»»»»»»»»»»»»»» Suppression Fichiers Temporaires


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre
 
Nettoyage terminé. 
 
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Après SmitFraudFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

Re, -Télécharge et installe MalwareByte's Anti-Malware Malwarebyte - Mets le à jour --- - Redémarre en mode sans échec : Au redémarrage de ton PC tapote sur la touche F8 ou F5 sur l'écran suivant déplace toi avec les flèches de direction et choisis Mode sans échec. Choisis ta session habituelle et non la session Administrateur --- - Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau. - Sélectionne Exécuter un examen complet si ce n'est pas déjà fait - clique sur Rechercher - Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok - Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le. - Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection - Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport. Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok Tutoriel pour MalwareByte's

philjofr · Answer

et enfin le rapport histjack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:57:23, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Jo\Bureau\programme\SmitfraudFix\Policies.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jo\Bureau\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = NC NUMERICABLE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S93.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Policies\Explorer\Run: [{8873867D-0B75-1036-0617-050623050021}] "C:\Program Files\Fichiers communs\{8873867D-0B75-1036-0617-050623050021}\Update.exe" mc-110-12-0000140
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGhpbA\command.exe (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

philjofr · Answer

et enfin le rapport histjack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:57:23, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Jo\Bureau\programme\SmitfraudFix\Policies.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Jo\Bureau\HiJackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = NC NUMERICABLE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {A8BD6820-6ED7-423E-9558-2D1486B0FEEA} - C:\Program Files\DeluxeCommunications\DxcBho.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [winlog] winlog.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S93.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKLM\..\RunServices: [winlog] winlog.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [DeluxeCommunications] C:\Program Files\DeluxeCommunications\Dxc.exe
O4 - HKCU\..\Policies\Explorer\Run: [{8873867D-0B75-1036-0617-050623050021}] "C:\Program Files\Fichiers communs\{8873867D-0B75-1036-0617-050623050021}\Update.exe" mc-110-12-0000140
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [IETI] C:\Program Files\Skype\Phone\IEPlugin\unins000.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - AppInit_DLLs: dxclib303562752.dll
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UGhpbA\command.exe (file missing)
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--

Utilisateur anonyme · Answer

Re,

Passe malwarebyte et ensuite on voit.

@+

philjofr · Answer

re Goldorak

J'ai passé l'après midi avec malware bite. Le scan poussé avait trouvé 60 fichiers infectés mais au moment de les supprimés j'ai eu le message suivant:
Erreur d'éxécution'7' memoire insuffisante.
J'ai fait un examen rapide, 57 fichiers infectés et le même message.
J'ai refait et là en en sélectionnant 24, j'ai reussi a les effacer. Mais pour les 33 autres impossible j'ai le même message m"émoire insuffisante.
De plus, quand j'allume windoxs, j'ai le message suivant:
Erreur de chargement de C:/windows/system32/bebwqpoc.dll introuvable

Voilà, qu'est-ce que je fait?
Merci pour ton aide

Utilisateur anonyme · Answer

Re,

Poste le rapport STP.

merci

philjofr · Answer

j'ai que le rapport des 24 que j'ai pu effacer sinon Malware plante aussitôt que le message moire insuffusante apparaît et que j'appuie sur ok
Voilà le rapport:
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1030
Windows 5.1.2600 Service Pack 2

18:21:30 03/11/2008
mbam-log-11-3-2008 (18-21-30).txt

Type de recherche: Examen rapide
Eléments examinés: 39053
Temps écoulé: 10 minute(s), 26 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 18
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 30

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\jkkKebAT.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\iifGxVPH.dll (Trojan.Vundo) -> Not selected for removal.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89bd2d8d-f805-4d5e-bd5e-7812198ec8e2} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{89bd2d8d-f805-4d5e-bd5e-7812198ec8e2} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4816822f-6bb2-4314-a4da-d5909e06d766} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{4816822f-6bb2-4314-a4da-d5909e06d766} (Trojan.BHO) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mxlivemedia (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\antiviruspro2009 (Rogue.Antivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iifgxvph (Trojan.Vundo) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Carlson (Dialer) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\SoftLand Ltd (Trojan.FakeAlert) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService (Adware.CommAd) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Not selected for removal.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4816822f-6bb2-4314-a4da-d5909e06d766} (Trojan.Vundo) -> Not selected for removal.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkebat -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkebat  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\Fichiers communs\Carlson (Dialer) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009 (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\data (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT (Rogue.Antivirus) -> Not selected for removal.

Fichier(s) infecté(s):
C:\WINDOWS\system32\jkkKebAT.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\TAbeKkkj.ini (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\TAbeKkkj.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rofesmik.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kimsefor.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifGxVPH.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\pmyebo.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\avzbxolyaa.exe (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jo\Application Data\winantiviruspro2006freeinstall_fr[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\AVEngn.dll (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\htmlayout.dll (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\pthreadVC2.dll (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\Uninstall.exe (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\wscui.cpl (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\data\daily.cvd (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll (Rogue.Antivirus) -> Not selected for removal.
C:\A1.tmp (Trojan.Agent) -> Not selected for removal.
C:\Program Files\outlook\p.zip (Worm.Alcra) -> Not selected for removal.
C:\WINDOWS\system32\ssqQkHAS.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\qoMdBSkH.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\rqRIaYqN.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\awtqrsRH.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\mlJDutsR.dll (Trojan.Vundo) -> Not selected for removal.
C:\Documents and Settings\All Users\Menu Démarrer\carlton (Dialer) -> Not selected for removal.
C:\Documents and Settings\Jo\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk (Rogue.Antivirus2008) -> Not selected for removal.
C:\Documents and Settings\Jo\Application Data\Dxcknwrd.dll (Trojan.Agent) -> Not selected for removal.

philjofr · Answer

j'ai que le rapport des 24 que j'ai pu effacer sinon Malware plante aussitôt que le message moire insuffusante apparaît et que j'appuie sur ok
Voilà le rapport:
Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1030
Windows 5.1.2600 Service Pack 2

18:21:30 03/11/2008
mbam-log-11-3-2008 (18-21-30).txt

Type de recherche: Examen rapide
Eléments examinés: 39053
Temps écoulé: 10 minute(s), 26 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 18
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 2
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 30

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\jkkKebAT.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\iifGxVPH.dll (Trojan.Vundo) -> Not selected for removal.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89bd2d8d-f805-4d5e-bd5e-7812198ec8e2} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{89bd2d8d-f805-4d5e-bd5e-7812198ec8e2} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4816822f-6bb2-4314-a4da-d5909e06d766} (Trojan.BHO) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{4816822f-6bb2-4314-a4da-d5909e06d766} (Trojan.BHO) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\mxlivemedia (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\antiviruspro2009 (Rogue.Antivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iifgxvph (Trojan.Vundo) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\Carlson (Dialer) -> Not selected for removal.
HKEY_CURRENT_USER\SOFTWARE\SoftLand Ltd (Trojan.FakeAlert) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\cmdService (Adware.CommAd) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NETWORK_MONITOR (Trojan.DNSChanger) -> Not selected for removal.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_CMDSERVICE (Trojan.Downloader) -> Not selected for removal.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4816822f-6bb2-4314-a4da-d5909e06d766} (Trojan.Vundo) -> Not selected for removal.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkebat -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\jkkkebat  -> Delete on reboot.

Dossier(s) infecté(s):
C:\Program Files\Fichiers communs\Carlson (Dialer) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009 (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\data (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT (Rogue.Antivirus) -> Not selected for removal.

Fichier(s) infecté(s):
C:\WINDOWS\system32\jkkKebAT.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\TAbeKkkj.ini (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\TAbeKkkj.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rofesmik.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kimsefor.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iifGxVPH.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\pmyebo.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\avzbxolyaa.exe (Malware.Trace) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jo\Application Data\winantiviruspro2006freeinstall_fr[1].exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\AVEngn.dll (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\htmlayout.dll (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\pthreadVC2.dll (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\Uninstall.exe (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\wscui.cpl (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Program Files\AntivirusPro2009\data\daily.cvd (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcm80.dll (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcp80.dll (Rogue.Antivirus) -> Not selected for removal.
C:\Program Files\AntivirusPro2009\Microsoft.VC80.CRT\msvcr80.dll (Rogue.Antivirus) -> Not selected for removal.
C:\A1.tmp (Trojan.Agent) -> Not selected for removal.
C:\Program Files\outlook\p.zip (Worm.Alcra) -> Not selected for removal.
C:\WINDOWS\system32\ssqQkHAS.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\qoMdBSkH.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\rqRIaYqN.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\awtqrsRH.dll (Trojan.Vundo) -> Not selected for removal.
C:\WINDOWS\system32\mlJDutsR.dll (Trojan.Vundo) -> Not selected for removal.
C:\Documents and Settings\All Users\Menu Démarrer\carlton (Dialer) -> Not selected for removal.
C:\Documents and Settings\Jo\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk (Rogue.Antivirus2008) -> Not selected for removal.
C:\Documents and Settings\Jo\Application Data\Dxcknwrd.dll (Trojan.Agent) -> Not selected for removal.

Utilisateur anonyme · Answer

Re,

AS tu redemarrer ton pc?

Sinon fait ceci:

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :



Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : 

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp 

Ensuite tu poste le rapport generer et refait un scan avec malwarebyte et supprime ce qu'il aura trouver et poste le rapport.

@+

philjofr · Answer

puis-je faire combofix en demmarage sans echec?
merci...

Utilisateur anonyme · Answer

Re,

Oui tu peut faire combofix en mode sans échec.

pas de problème.

@+

philjofr · Answer

voilà le rapport combo. Par contre malware ne trouve plus que 6 fichiers infectés qu'il m'est impossible de supprimer car çà fait planter malware... j'ai toujours le message suivant qui s'affiche au démarrage de windows: c:\windows\sytem32\bebwqpoc.dll sais-tu ce que c'est? voilà le rapport de combifix: ComboFix 08-11-02.05 - Jo 2008-11-03 20:08:22.2 - NTFSx86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.821 [GMT 1:00] Lancé depuis: c:\documents and settings\Jo\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\documents and settings\Jo\Application Data\Dxccwrd.dll c:\documents and settings\Jo\Application Data\Dxcdmns.dll c:\documents and settings\Jo\Application Data\Dxcknwrd.dll c:\documents and settings\Jo\Application Data\Dxcuknwrd.dll c:\documents and settings\Jo\Cookies\ahozijib._sy c:\documents and settings\Jo\Cookies\evit.exe c:\documents and settings\Jo\Cookies otereqe.ban c:\documents and settings\Jo\Cookies\ymevybuk.lib c:\documents and settings\Jo\err.log c:\documents and settings\Jo\Local Settings\Temporary Internet Files\Dxc.log c:\program files\deluxecommunications c:\program files\deluxecommunications\Dxc.exe c:\program files\deluxecommunications\DxcBho.dll c:\program files\deluxecommunications\DxcCore.dll c:\program files\deskbar c:\program files\deskbar\Thumbs.db c:\program files\Fichiers communs\{38738~1 c:\program files\Fichiers communs\{38738~1\888Bar.dll c:\program files\Fichiers communs\{88738~1 c:\program files\Fichiers communs\{88738~1\services.dll c:\program files\outlook c:\program files\outlook\p.zip c:\windows\system32\aiclbqpc.dll c:\windows\system32\avnhtprn.dll c:\windows\system32\awtqrsRH.dll c:\windows\system32\bbvyangt.ini c:\windows\system32\bvljwkcx.dll c:\windows\system32\CID c:\windows\system32\ckhmpdpk.ini c:\windows\system32\copqwbeb.ini c:\windows\system32\cuhkqgiw.ini c:\windows\system32\dhhoaume.ini c:\windows\system32\djxclg.dll c:\windows\system32\dwsxkgxc.dll c:\windows\system32\gfmwnxfe.dll c:\windows\system32\iifGxVPH.dll c:\windows\system32\jkkKebAT.dll c:\windows\system32\mcrh.tmp c:\windows\system32\Microsoft\backup.ftp c:\windows\system32\Microsoft\backup.tftp c:\windows\system32\mlJDutsR.dll c:\windows\system32\qoMdBSkH.dll c:\windows\system32\qxbixjom.ini c:\windows\system32 qklagsd.dll c:\windows\system32 qRIaYqN.dll c:\windows\system32\ssqQkHAS.dll c:\windows\system32\stera.log c:\windows\system32\SvcNm c:\windows\system32\TAbeKkkj.ini c:\windows\system32\TAbeKkkj.ini2 c:\windows\system32 dlwhrkb.dll c:\windows\system32\url1 c:\windows\system32\url2 c:\windows\system32\url3 c:\windows\system32\vffkoasj.ini c:\windows\system32\wini10791.exe c:\windows\UGhpbA\ c:\windows\UGhpbA\o31DvE.vbs . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CMDSERVICE -------\Legacy_FOPN -------\Legacy_NETWORK_MONITOR -------\Legacy_VSPF -------\Legacy_VSPF_HK -------\Service_cmdService ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-03 au 2008-11-03 )))))))))))))))))))))))))))))))))))) . 2008-11-03 20:02 . 2008-11-03 20:02 d-------- c:\windows\LastGood 2008-11-03 13:27 . 2008-09-08 22:38 88,576 --a------ c:\windows\system32\AntiXPVSTFix.exe 2008-11-03 13:27 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-03 13:27 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-03 12:42 . 2008-11-03 13:22 d-------- c:\program files\Navilog1 2008-11-03 11:05 . 2008-11-03 11:05 19,975 --a------ c:\program files\Fichiers communs\ejevyjuk.reg 2008-11-03 11:05 . 2008-11-03 11:05 19,890 --a------ c:\windows\fufaf.dat 2008-11-03 11:05 . 2008-11-03 11:05 19,858 --a------ c:\documents and settings\Jo\Application Data\ecefesulu.bat 2008-11-03 11:05 . 2008-11-03 11:05 19,591 --a------ c:\windows\vuliheg.scr 2008-11-03 11:05 . 2008-11-03 11:05 18,199 --a------ c:\windows\fora.vbs 2008-11-03 11:05 . 2008-11-03 11:05 14,957 --a------ c:\windows\system32\yfaj.dl 2008-11-03 11:05 . 2008-11-03 11:05 14,386 --a------ c:\windows\system32\ebeximysa.bin 2008-11-03 11:05 . 2008-11-03 11:05 12,601 --a------ c:\windows\system32\juhebalaz.scr 2008-11-03 11:05 . 2008-11-03 11:05 12,207 --a------ c:\windows\sivodahen.com 2008-11-03 11:05 . 2008-11-03 11:05 11,835 --a------ c:\documents and settings\Jo\Application Data\kusoran.sys 2008-11-03 11:05 . 2008-11-03 11:05 11,219 --a------ c:\windows\system32\enyluva.pif 2008-11-03 11:05 . 2008-11-03 11:05 10,341 --a------ c:\documents and settings\All Users\Application Data\caxagi.com 2008-10-31 18:03 . 2008-11-02 23:00 d-------- c:\program files\Fichiers communs\Symantec Shared 2008-10-17 22:04 . 2008-10-17 22:04 268 --ah----- C:\sqmdata17.sqm 2008-10-17 22:04 . 2008-10-17 22:04 244 --ah----- C:\sqmnoopt17.sqm 2008-10-17 11:36 . 2008-10-17 11:36 268 --ah----- C:\sqmdata16.sqm 2008-10-17 11:36 . 2008-10-17 11:36 244 --ah----- C:\sqmnoopt16.sqm 2008-10-16 21:29 . 2008-10-16 21:29 268 --ah----- C:\sqmdata15.sqm 2008-10-16 21:29 . 2008-10-16 21:29 244 --ah----- C:\sqmnoopt15.sqm 2008-10-15 21:36 . 2008-10-15 21:36 268 --ah----- C:\sqmdata14.sqm 2008-10-15 21:36 . 2008-10-15 21:36 244 --ah----- C:\sqmnoopt14.sqm 2008-10-14 21:21 . 2008-10-14 21:21 268 --ah----- C:\sqmdata13.sqm 2008-10-14 21:21 . 2008-10-14 21:21 244 --ah----- C:\sqmnoopt13.sqm 2008-10-12 21:30 . 2008-10-12 21:30 268 --ah----- C:\sqmdata12.sqm 2008-10-12 21:30 . 2008-10-12 21:30 244 --ah----- C:\sqmnoopt12.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-03 19:03 21,163,552 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-11-03 18:51 284,084 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-11-03 18:51 0 ----a-w c:\windows\system32\drivers\lvuvc.hs 2008-11-03 12:51 4,662 ----a-w c:\windows\system32 mp.reg 2008-11-03 11:13 --------- d-----w c:\program files\PokerStars.NET 2008-11-03 11:13 --------- d-----w c:\program files\PokerStars 2008-11-01 13:26 21,840 -c--atw c:\windows\system32\SIntfNT.dll 2008-11-01 13:26 17,212 -c--atw c:\windows\system32\SIntf32.dll 2008-11-01 13:26 12,067 -c--atw c:\windows\system32\SIntf16.dll 2008-10-26 13:10 --------- d-----w c:\program files\iVisit 2008-10-26 10:42 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-19 18:13 --------- d-----w c:\program files\Némopolis 2008-08-07 09:57 86,528 -c--a-w c:\windows\system32\VACFix.exe 2008-08-07 09:57 82,944 -c--a-w c:\windows\system32\IEDFix.exe 2008-08-07 09:57 82,432 -c--a-w c:\windows\system32\IEDFix.C.exe 2008-08-07 09:57 81,920 ----a-w c:\windows\system32\404Fix.exe 2008-08-07 09:57 51,200 -c--a-w c:\windows\system32\dumphive.exe 2008-08-07 09:57 289,144 -c--a-w c:\windows\system32\VCCLSID.exe 2008-08-07 09:57 288,417 -c--a-w c:\windows\system32\SrchSTS.exe 2008-08-07 09:57 25,600 -c--a-w c:\windows\system32\WS2Fix.exe 2008-08-06 15:20 91,744 -c--a-w c:\windows\BPMNT.dll 2008-08-06 15:20 71,749 -c--a-w c:\windows\hcextoutput.dll 2008-08-06 15:20 333,576 -c--a-w c:\windows\TSC.exe 2008-08-06 15:20 1,213,784 -c--a-w c:\windows\vsapi32.dll 2008-08-06 15:19 69,689 -c--a-w c:\windows\UNZIP.DLL 2008-08-06 15:19 507,904 -c--a-w c:\windows\TMUPDATE.DLL 2008-08-06 15:19 286,720 -c--a-w c:\windows\PATCH.EXE 2006-10-22 08:45 54 -c--a-w c:\program files\delir.gio . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 4670968] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-12 67128] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 68856] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360] "ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2006-07-06 573440] "AdobeUpdater"="c:\program files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RestoreIT!"="c:\program files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" [2004-09-21 114688] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-07-11 5562368] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-07-11 86016] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-10-22 20480] "LVCOMS"="c:\program files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 36975] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-09-01 221184] "SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-24 81920] "ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2003-09-29 81990] "McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 135251] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-01-29 98304] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 135168] "mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 53248] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048] "nwiz"="nwiz.exe" [2005-07-11 c:\windows\system32 wiz.exe] "SoundMan"="SOUNDMAN.EXE" [2005-05-17 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360] c:\documents and settings\Jo\Menu D‚marrer\Programmes\D‚marrage\ Outil de d‚tection de support Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-12-15 344064] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-12 67128] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fenaffiche] --a--c--- 2004-07-23 08:51 36864 c:\program files\FenAffiche\FenUnika.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Yahoo!\Messenger\YServer.exe"= "c:\Program Files\Real\RealPlayer\realplay.exe"= "c:\Program Files\iVisit\iVisit.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Windows Live\Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6346:TCP"= 6346:TCP:Shareaza "6346:UDP"= 6346:UDP:Shareaza R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.sys [2004-09-21 43512] R0 VVBackd5;VVBackd5;c:\windows\system32\drivers\VVBackd5.sys [2004-09-21 179482] R3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S0 Cdr4vsd;Cdr4vsd;c:\windows\system32\drivers\Cdr4vsd.sys [1999-09-23 60688] S1 lusbaudio;Microphone USB Logitech;c:\windows\system32\drivers\OVSound2.sys [2001-08-17 25216] S2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [2004-09-21 5088] S3 LVPrcMon;Logitech LVPrcMon Driver;c:\windows\system32\drivers\LVPrcMon.sys [2005-09-01 16768] S3 PsShutdownSvc;PsShutdown;c:\windows\System32\PSSDNSVC.EXE [2005-07-11 65536] S3 QCEmerald;QuickCam Web Logitech;c:\windows\system32\DRIVERS\OVCE.sys [2001-08-17 31872] S3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 15104] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2ea233f-f2d9-11d9-8563-806d6172696f}] \shell\PlayWithPowerDVD\Command - "c:\program files\CyberLink\PowerDVD\PowerDVD.exe" "%l" . Contenu du dossier 'Tâches planifiées' 2008-11-03 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file) BHO-{38434192-B415-43F8-B55A-94CE516B9784} - (no file) BHO-{4816822F-6BB2-4314-A4DA-D5909E06D766} - c:\windows\system32\iifGxVPH.dll BHO-{7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file) BHO-{8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file) BHO-{A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file) BHO-{DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file) BHO-{E6DE5385-105C-4209-ADC4-BB350A388402} - (no file) BHO-{EA493A70-7653-41F0-BFF6-564780474B4D} - (no file) BHO-{ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file) BHO-{FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - c:\windows\system32\jkkKebAT.dll HKLM-Run-887386d2 - c:\windows\system32\bebwqpoc.dll HKU-Default-RunOnce-IETI - c:\program files\Skype\Phone\IEPlugin\unins000.exe HKCU-Explorer_Run-{8873867D-0B75-1036-0617-050623050021} - c:\program files\Fichiers communs\{8873867D-0B75-1036-0617-050623050021}\Update.exe ShellExecuteHooks-{4816822F-6BB2-4314-A4DA-D5909E06D766} - c:\windows\system32\iifGxVPH.dll Notify-iifGxVPH - (no file) MSConfigStartUp-defender - c:\dfndrff_e46a.exe MSConfigStartUp-keyboard - c:\kybrdff_e46.exe MSConfigStartUp-New - c:\progra~1\NEWDOT~1\NEWDOT~2.DLL MSConfigStartUp-newname - c:\nwnmff_e46.exe MSConfigStartUp-udc6cw - c:\program files\DriveCleaner 2006 Free\udc6cw.exe MSConfigStartUp-uwa6pcw - c:\program files\WinAntiVirus Pro 2006\uwa6pcw.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\Jo\Application Data\Mozilla\Firefox\Profiles wlspog9.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.msn.com/ FF -: plugin - c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer pzylomgamesplayer.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava11.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava12.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava13.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava14.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava32.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJPI150_05.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPOJI610.dll FF -: plugin - c:\program files\Yahoo!\Shared pYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-03 20:11:13 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-03 20:13:15 ComboFix-quarantined-files.txt 2008-11-03 19:13:03 Avant-CF: 90,458,939,392 octets libres Après-CF: 90,482,733,056 octets libres 271 --- E O F --- 2008-08-06 10:19:02

philjofr · Answer

voilà le rapport combo. Par contre malware ne trouve plus que 6 fichiers infectés qu'il m'est impossible de supprimer car çà fait planter malware... j'ai toujours le message suivant qui s'affiche au démarrage de windows: c:\windows\sytem32\bebwqpoc.dll sais-tu ce que c'est? voilà le rapport de combifix: ComboFix 08-11-02.05 - Jo 2008-11-03 20:08:22.2 - NTFSx86 MINIMAL Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.821 [GMT 1:00] Lancé depuis: c:\documents and settings\Jo\Bureau\ComboFix.exe . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Previous Run ------- . c:\documents and settings\Jo\Application Data\Dxccwrd.dll c:\documents and settings\Jo\Application Data\Dxcdmns.dll c:\documents and settings\Jo\Application Data\Dxcknwrd.dll c:\documents and settings\Jo\Application Data\Dxcuknwrd.dll c:\documents and settings\Jo\Cookies\ahozijib._sy c:\documents and settings\Jo\Cookies\evit.exe c:\documents and settings\Jo\Cookies otereqe.ban c:\documents and settings\Jo\Cookies\ymevybuk.lib c:\documents and settings\Jo\err.log c:\documents and settings\Jo\Local Settings\Temporary Internet Files\Dxc.log c:\program files\deluxecommunications c:\program files\deluxecommunications\Dxc.exe c:\program files\deluxecommunications\DxcBho.dll c:\program files\deluxecommunications\DxcCore.dll c:\program files\deskbar c:\program files\deskbar\Thumbs.db c:\program files\Fichiers communs\{38738~1 c:\program files\Fichiers communs\{38738~1\888Bar.dll c:\program files\Fichiers communs\{88738~1 c:\program files\Fichiers communs\{88738~1\services.dll c:\program files\outlook c:\program files\outlook\p.zip c:\windows\system32\aiclbqpc.dll c:\windows\system32\avnhtprn.dll c:\windows\system32\awtqrsRH.dll c:\windows\system32\bbvyangt.ini c:\windows\system32\bvljwkcx.dll c:\windows\system32\CID c:\windows\system32\ckhmpdpk.ini c:\windows\system32\copqwbeb.ini c:\windows\system32\cuhkqgiw.ini c:\windows\system32\dhhoaume.ini c:\windows\system32\djxclg.dll c:\windows\system32\dwsxkgxc.dll c:\windows\system32\gfmwnxfe.dll c:\windows\system32\iifGxVPH.dll c:\windows\system32\jkkKebAT.dll c:\windows\system32\mcrh.tmp c:\windows\system32\Microsoft\backup.ftp c:\windows\system32\Microsoft\backup.tftp c:\windows\system32\mlJDutsR.dll c:\windows\system32\qoMdBSkH.dll c:\windows\system32\qxbixjom.ini c:\windows\system32 qklagsd.dll c:\windows\system32 qRIaYqN.dll c:\windows\system32\ssqQkHAS.dll c:\windows\system32\stera.log c:\windows\system32\SvcNm c:\windows\system32\TAbeKkkj.ini c:\windows\system32\TAbeKkkj.ini2 c:\windows\system32 dlwhrkb.dll c:\windows\system32\url1 c:\windows\system32\url2 c:\windows\system32\url3 c:\windows\system32\vffkoasj.ini c:\windows\system32\wini10791.exe c:\windows\UGhpbA\ c:\windows\UGhpbA\o31DvE.vbs . ((((((((((((((((((((((((((((((((((((((( Pilotes/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CMDSERVICE -------\Legacy_FOPN -------\Legacy_NETWORK_MONITOR -------\Legacy_VSPF -------\Legacy_VSPF_HK -------\Service_cmdService ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-03 au 2008-11-03 )))))))))))))))))))))))))))))))))))) . 2008-11-03 20:02 . 2008-11-03 20:02 d-------- c:\windows\LastGood 2008-11-03 13:27 . 2008-09-08 22:38 88,576 --a------ c:\windows\system32\AntiXPVSTFix.exe 2008-11-03 13:27 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe 2008-11-03 13:27 . 2003-06-05 20:13 53,248 --a------ c:\windows\system32\Process.exe 2008-11-03 12:42 . 2008-11-03 13:22 d-------- c:\program files\Navilog1 2008-11-03 11:05 . 2008-11-03 11:05 19,975 --a------ c:\program files\Fichiers communs\ejevyjuk.reg 2008-11-03 11:05 . 2008-11-03 11:05 19,890 --a------ c:\windows\fufaf.dat 2008-11-03 11:05 . 2008-11-03 11:05 19,858 --a------ c:\documents and settings\Jo\Application Data\ecefesulu.bat 2008-11-03 11:05 . 2008-11-03 11:05 19,591 --a------ c:\windows\vuliheg.scr 2008-11-03 11:05 . 2008-11-03 11:05 18,199 --a------ c:\windows\fora.vbs 2008-11-03 11:05 . 2008-11-03 11:05 14,957 --a------ c:\windows\system32\yfaj.dl 2008-11-03 11:05 . 2008-11-03 11:05 14,386 --a------ c:\windows\system32\ebeximysa.bin 2008-11-03 11:05 . 2008-11-03 11:05 12,601 --a------ c:\windows\system32\juhebalaz.scr 2008-11-03 11:05 . 2008-11-03 11:05 12,207 --a------ c:\windows\sivodahen.com 2008-11-03 11:05 . 2008-11-03 11:05 11,835 --a------ c:\documents and settings\Jo\Application Data\kusoran.sys 2008-11-03 11:05 . 2008-11-03 11:05 11,219 --a------ c:\windows\system32\enyluva.pif 2008-11-03 11:05 . 2008-11-03 11:05 10,341 --a------ c:\documents and settings\All Users\Application Data\caxagi.com 2008-10-31 18:03 . 2008-11-02 23:00 d-------- c:\program files\Fichiers communs\Symantec Shared 2008-10-17 22:04 . 2008-10-17 22:04 268 --ah----- C:\sqmdata17.sqm 2008-10-17 22:04 . 2008-10-17 22:04 244 --ah----- C:\sqmnoopt17.sqm 2008-10-17 11:36 . 2008-10-17 11:36 268 --ah----- C:\sqmdata16.sqm 2008-10-17 11:36 . 2008-10-17 11:36 244 --ah----- C:\sqmnoopt16.sqm 2008-10-16 21:29 . 2008-10-16 21:29 268 --ah----- C:\sqmdata15.sqm 2008-10-16 21:29 . 2008-10-16 21:29 244 --ah----- C:\sqmnoopt15.sqm 2008-10-15 21:36 . 2008-10-15 21:36 268 --ah----- C:\sqmdata14.sqm 2008-10-15 21:36 . 2008-10-15 21:36 244 --ah----- C:\sqmnoopt14.sqm 2008-10-14 21:21 . 2008-10-14 21:21 268 --ah----- C:\sqmdata13.sqm 2008-10-14 21:21 . 2008-10-14 21:21 244 --ah----- C:\sqmnoopt13.sqm 2008-10-12 21:30 . 2008-10-12 21:30 268 --ah----- C:\sqmdata12.sqm 2008-10-12 21:30 . 2008-10-12 21:30 244 --ah----- C:\sqmnoopt12.sqm . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-03 19:03 21,163,552 --sha-w c:\windows\system32\drivers\fidbox.dat 2008-11-03 18:51 284,084 --sha-w c:\windows\system32\drivers\fidbox.idx 2008-11-03 18:51 0 ----a-w c:\windows\system32\drivers\lvuvc.hs 2008-11-03 12:51 4,662 ----a-w c:\windows\system32 mp.reg 2008-11-03 11:13 --------- d-----w c:\program files\PokerStars.NET 2008-11-03 11:13 --------- d-----w c:\program files\PokerStars 2008-11-01 13:26 21,840 -c--atw c:\windows\system32\SIntfNT.dll 2008-11-01 13:26 17,212 -c--atw c:\windows\system32\SIntf32.dll 2008-11-01 13:26 12,067 -c--atw c:\windows\system32\SIntf16.dll 2008-10-26 13:10 --------- d-----w c:\program files\iVisit 2008-10-26 10:42 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-09-19 18:13 --------- d-----w c:\program files\Némopolis 2008-08-07 09:57 86,528 -c--a-w c:\windows\system32\VACFix.exe 2008-08-07 09:57 82,944 -c--a-w c:\windows\system32\IEDFix.exe 2008-08-07 09:57 82,432 -c--a-w c:\windows\system32\IEDFix.C.exe 2008-08-07 09:57 81,920 ----a-w c:\windows\system32\404Fix.exe 2008-08-07 09:57 51,200 -c--a-w c:\windows\system32\dumphive.exe 2008-08-07 09:57 289,144 -c--a-w c:\windows\system32\VCCLSID.exe 2008-08-07 09:57 288,417 -c--a-w c:\windows\system32\SrchSTS.exe 2008-08-07 09:57 25,600 -c--a-w c:\windows\system32\WS2Fix.exe 2008-08-06 15:20 91,744 -c--a-w c:\windows\BPMNT.dll 2008-08-06 15:20 71,749 -c--a-w c:\windows\hcextoutput.dll 2008-08-06 15:20 333,576 -c--a-w c:\windows\TSC.exe 2008-08-06 15:20 1,213,784 -c--a-w c:\windows\vsapi32.dll 2008-08-06 15:19 69,689 -c--a-w c:\windows\UNZIP.DLL 2008-08-06 15:19 507,904 -c--a-w c:\windows\TMUPDATE.DLL 2008-08-06 15:19 286,720 -c--a-w c:\windows\PATCH.EXE 2006-10-22 08:45 54 -c--a-w c:\program files\delir.gio . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 4670968] "NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2005-10-11 1961984] "LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-12 67128] "MsnMsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-23 68856] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-05 15360] "ccleaner"="c:\program files\CCleaner\ccleaner.exe" [2006-07-06 573440] "AdobeUpdater"="c:\program files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "RestoreIT!"="c:\program files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" [2004-09-21 114688] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-07-11 5562368] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-07-11 86016] "RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-10-22 20480] "LVCOMS"="c:\program files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022] "SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 36975] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-09-01 221184] "SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2005-01-24 81920] "ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2003-09-29 81990] "McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 135251] "Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 57344] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-01-29 98304] "MMTray"="c:\program files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [2006-01-17 135168] "mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 53248] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048] "nwiz"="nwiz.exe" [2005-07-11 c:\windows\system32 wiz.exe] "SoundMan"="SOUNDMAN.EXE" [2005-05-17 c:\windows\SOUNDMAN.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360] c:\documents and settings\Jo\Menu D‚marrer\Programmes\D‚marrage\ Outil de d‚tection de support Picture Motion Browser.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-12-15 344064] c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-12 67128] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fenaffiche] --a--c--- 2004-07-23 08:51 36864 c:\program files\FenAffiche\FenUnika.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "c:\Program Files\Yahoo!\Messenger\YServer.exe"= "c:\Program Files\Real\RealPlayer\realplay.exe"= "c:\Program Files\iVisit\iVisit.exe"= "%windir%\Network Diagnostic\xpnetdiag.exe"= "c:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"= "c:\Program Files\Windows Live\Messenger\msnmsgr.exe"= "c:\Program Files\Windows Live\Messenger\livecall.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6346:TCP"= 6346:TCP:Shareaza "6346:UDP"= 6346:UDP:Shareaza R0 RITCPT;RITCPT;c:\windows\system32\drivers\RITCPT.sys [2004-09-21 43512] R0 VVBackd5;VVBackd5;c:\windows\system32\drivers\VVBackd5.sys [2004-09-21 179482] R3 USBSTOR;Pilote de stockage de masse USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S0 Cdr4vsd;Cdr4vsd;c:\windows\system32\drivers\Cdr4vsd.sys [1999-09-23 60688] S1 lusbaudio;Microphone USB Logitech;c:\windows\system32\drivers\OVSound2.sys [2001-08-17 25216] S2 FBAPI;FBAPI;c:\windows\system32\drivers\FBAPI.sys [2004-09-21 5088] S3 LVPrcMon;Logitech LVPrcMon Driver;c:\windows\system32\drivers\LVPrcMon.sys [2005-09-01 16768] S3 PsShutdownSvc;PsShutdown;c:\windows\System32\PSSDNSVC.EXE [2005-07-11 65536] S3 QCEmerald;QuickCam Web Logitech;c:\windows\system32\DRIVERS\OVCE.sys [2001-08-17 31872] S3 usbscan;Pilote de scanneur USB;c:\windows\system32\DRIVERS\usbscan.sys [2004-08-03 15104] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a2ea233f-f2d9-11d9-8563-806d6172696f}] \shell\PlayWithPowerDVD\Command - "c:\program files\CyberLink\PowerDVD\PowerDVD.exe" "%l" . Contenu du dossier 'Tâches planifiées' 2008-11-03 c:\windows\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:20] . - - - - ORPHELINS SUPPRIMES - - - - BHO-{33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file) BHO-{38434192-B415-43F8-B55A-94CE516B9784} - (no file) BHO-{4816822F-6BB2-4314-A4DA-D5909E06D766} - c:\windows\system32\iifGxVPH.dll BHO-{7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file) BHO-{8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file) BHO-{A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file) BHO-{DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file) BHO-{E6DE5385-105C-4209-ADC4-BB350A388402} - (no file) BHO-{EA493A70-7653-41F0-BFF6-564780474B4D} - (no file) BHO-{ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file) BHO-{FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - c:\windows\system32\jkkKebAT.dll HKLM-Run-887386d2 - c:\windows\system32\bebwqpoc.dll HKU-Default-RunOnce-IETI - c:\program files\Skype\Phone\IEPlugin\unins000.exe HKCU-Explorer_Run-{8873867D-0B75-1036-0617-050623050021} - c:\program files\Fichiers communs\{8873867D-0B75-1036-0617-050623050021}\Update.exe ShellExecuteHooks-{4816822F-6BB2-4314-A4DA-D5909E06D766} - c:\windows\system32\iifGxVPH.dll Notify-iifGxVPH - (no file) MSConfigStartUp-defender - c:\dfndrff_e46a.exe MSConfigStartUp-keyboard - c:\kybrdff_e46.exe MSConfigStartUp-New - c:\progra~1\NEWDOT~1\NEWDOT~2.DLL MSConfigStartUp-newname - c:\nwnmff_e46.exe MSConfigStartUp-udc6cw - c:\program files\DriveCleaner 2006 Free\udc6cw.exe MSConfigStartUp-uwa6pcw - c:\program files\WinAntiVirus Pro 2006\uwa6pcw.exe . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\documents and settings\Jo\Application Data\Mozilla\Firefox\Profiles wlspog9.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://fr.msn.com/ FF -: plugin - c:\documents and settings\All Users\Application Data\Zylom\ZylomGamesPlayer pzylomgamesplayer.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava11.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava12.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava13.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava14.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJava32.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPJPI150_05.dll FF -: plugin - c:\program files\Java\jre1.5.0_05\bin\NPOJI610.dll FF -: plugin - c:\program files\Yahoo!\Shared pYState.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-03 20:11:13 Windows 5.1.2600 Service Pack 2 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... Scan terminé avec succès Fichiers cachés: 0 ************************************************************************** . Heure de fin: 2008-11-03 20:13:15 ComboFix-quarantined-files.txt 2008-11-03 19:13:03 Avant-CF: 90,458,939,392 octets libres Après-CF: 90,482,733,056 octets libres 271 --- E O F --- 2008-08-06 10:19:02

Utilisateur anonyme · Answer

Re,

Fait moi un nouveau hijackthis et en suite relance malwarebyte.

merci

philjofr · Answer

voilà le histjack:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:51:33, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\SoftwareDistribution\Download\405ae8e48aa46e265982686e1678047b\update\update.exe
C:\Documents and Settings\Jo\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mwww.yahoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file)
O2 - BHO: (no name) - {38434192-B415-43F8-B55A-94CE516B9784} - (no file)
O2 - BHO: (no name) - {4816822F-6BB2-4314-A4DA-D5909E06D766} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file)
O2 - BHO: (no name) - {8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\Windows Live Toolbar\stmain.dll
O2 - BHO: (no name) - {A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file)
O2 - BHO: (no name) - {E6DE5385-105C-4209-ADC4-BB350A388402} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EA493A70-7653-41F0-BFF6-564780474B4D} - (no file)
O2 - BHO: (no name) - {ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file)
O2 - BHO: (no name) - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - (no file)
O2 - BHO: (no name) - {FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: iifGxVPH - C:\WINDOWS\
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

philjofr · Answer

re, 
même combat concrnant malware: 6 fichiers infectes et imossible de les nettoyer, ça fait planter malware.
Par contre j'ai recoper les fichier infecté je ne sais pas si ça peut-être utile?
les voilà: 

Rogue.antivirus2008 registry key HKEY_local_machine\SOFTWARE@antiviruspro2009

Trojan.Agent File C:\A1.tmp

Dialer Regitry Key HKEY_CURRENT_USER\SOFTWARE\Carlson

Dialer File C:\Documents and settings\allusers\menu démarrer\carlton

Trojan.FakeAlert registry Key HKEY_CURRENT_User\SOFTWARE\Softland Ltd

Rogue.antivirus 2008 File C:\documents and Settings\Jo\Apllication data\Microsoft\internet explorer
 
Voilà c'est tout ce que je peux faire...

philjofr · Answer

Euréka, j'ai resusi a les suprimer...
Voilà le rapport malware:

Malwarebytes' Anti-Malware 1.24
Version de la base de données: 1030
Windows 5.1.2600 Service Pack 2

21:09:31 03/11/2008
mbam-log-11-3-2008 (21-09-31).txt

Type de recherche: Examen rapide
Eléments examinés: 40457
Temps écoulé: 8 minute(s), 50 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 3
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 3

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Carlson (Dialer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SoftLand Ltd (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\A1.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Menu Démarrer\carlton (Dialer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Jo\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro2009.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.

philjofr · Answer

Après toutes ces manoeuvres j'espère être a peu près clean....connais-tu un antivirus gratuit et un peu plus efficace que le mien qui n'a pas l'air d'être d'une efficacité a toute epreuve!!!!qu'en penses-tu?

Utilisateur anonyme · Answer

Re,

installe [- Télécharge SmitfraudFix (de de S!Ri, balltrap34 et moe31) :
http://siri.urz.free.fr/Fix/SmitfraudFix.exe smitfraudfix]



Option:1 => Recherche:

    * Double cliquer sur SmitfraudFix.exe
    
* Sélectionner 1 et pressez =>Entrée dans le menu pour créer 

un rapport des fichiers responsables de l'infection. Le rapport se trouve à la racine du disque 

système 

C:\rapport.txt

==>et colle le rapport génèrer sur le forum.

*=>Ne pas faire l'option 2 sans un avis d'une personne compétente*<=

Utilisateur anonyme · Answer

Re,

celui la

ne fait pas smithfraudix et fait moi un nouveau rapport hijackthis.

merci

philjofr · Answer

voici le rapport de smittfraudix:
SmitFraudFix v2.371

Rapport fait à 21:22:03,79, 03/11/2008
Executé à partir de C:\Documents and Settings\Jo\Bureau\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Jo\Bureau\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jo


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jo\LOCALS~1\Temp


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Jo\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Jo\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files 


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau
 
 

»»»»»»»»»»»»»»»»»»»»»»»» o4Patch
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"=""


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,"
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» RK



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: SiS191 1000/100/10 Ethernet Device - Miniport d'ordonnancement de paquets
DNS Server Search Order: 195.5.219.1

Description: Motorola SURFboard SB5120 USB Cable Modem - Miniport d'ordonnancement de paquets
DNS Server Search Order: 80.236.0.73
DNS Server Search Order: 81.220.255.4
DNS Server Search Order: 80.236.0.68

Description: Motorola SURFboard SB5120 USB Cable Modem - Miniport d'ordonnancement de paquets
DNS Server Search Order: 89.2.0.1
DNS Server Search Order: 89.2.0.2

HKLM\SYSTEM\CCS\Services\Tcpip\..\{0641817A-CEDA-4E76-BA41-149CBAE9B6C7}: DhcpNameServer=80.236.0.73 81.220.255.4 80.236.0.68
HKLM\SYSTEM\CCS\Services\Tcpip\..\{6A11801C-FB3D-45B0-A6DC-0514245451B5}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CCS\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{0641817A-CEDA-4E76-BA41-149CBAE9B6C7}: DhcpNameServer=80.236.0.73 81.220.255.4 80.236.0.68
HKLM\SYSTEM\CS2\Services\Tcpip\..\{6A11801C-FB3D-45B0-A6DC-0514245451B5}: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{9E7099F1-7AA9-42F9-A4AA-14BFD42B4FB9}: DhcpNameServer=195.5.219.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=89.2.0.1 89.2.0.2


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

Utilisateur anonyme · Answer

Re,

peut tu me refaire un huijackthis de controle.

merci

philjofr · Answer

je ne peux plus demarrer mon histjack...as-tu le lien?

Utilisateur anonyme · Answer

Re,

télécharge hijackthis

philjofr · Answer

rien a faire je ne peux plus executer histjack!!!!!????

philjofr · Answer

que dois-je faire redemarrer l'ordi?

Utilisateur anonyme · Answer

Re,

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 
* Clique sur Recherche et laisse le scan se terminer. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse

OUi redemarre ton pc et ensuite relance hijackthis.

merci

philjofr · Answer

voici le histjack de control....je lance a l'instant Tcleaner
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:43:52, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32
tvdm.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mwww.yahoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file)
O2 - BHO: (no name) - {38434192-B415-43F8-B55A-94CE516B9784} - (no file)
O2 - BHO: (no name) - {4816822F-6BB2-4314-A4DA-D5909E06D766} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file)
O2 - BHO: (no name) - {8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\Windows Live Toolbar\stmain.dll
O2 - BHO: (no name) - {A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file)
O2 - BHO: (no name) - {E6DE5385-105C-4209-ADC4-BB350A388402} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EA493A70-7653-41F0-BFF6-564780474B4D} - (no file)
O2 - BHO: (no name) - {ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file)
O2 - BHO: (no name) - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - (no file)
O2 - BHO: (no name) - {FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: iifGxVPH - C:\WINDOWS\
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

philjofr · Answer

voici le histjack de control....je lance a l'instant Tcleaner
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:43:52, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32
tvdm.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mwww.yahoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file)
O2 - BHO: (no name) - {38434192-B415-43F8-B55A-94CE516B9784} - (no file)
O2 - BHO: (no name) - {4816822F-6BB2-4314-A4DA-D5909E06D766} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file)
O2 - BHO: (no name) - {8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\Windows Live Toolbar\stmain.dll
O2 - BHO: (no name) - {A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file)
O2 - BHO: (no name) - {E6DE5385-105C-4209-ADC4-BB350A388402} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EA493A70-7653-41F0-BFF6-564780474B4D} - (no file)
O2 - BHO: (no name) - {ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file)
O2 - BHO: (no name) - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - (no file)
O2 - BHO: (no name) - {FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: iifGxVPH - C:\WINDOWS\
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

philjofr · Answer

Tools clener ne reponds pas...est-ce qu'un nettoyage avec CCleaner peut faire l'affaire?

Utilisateur anonyme · Answer

Re,

Attend pas encore fini.

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
SDFix (créé par AndyManchesta)
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau.

 Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :

• Redémarre ton ordinateur

• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde).

• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.

• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".

• Choisis ton compte.

• Puis, ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script.

• Appuie sur une touche pour commencer le processus de nettoyage.

• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.

• Appuie sur une touche pour redémarrer le PC.

• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.

• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.

• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.

• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.

 TUTORIAL

• Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau rapport Hijackthis !

philjofr · Answer

cijoint le rapport SDfix:

[b]SDFix: Version 1.239 [/b]
Run by Jo on 03/11/2008 at 22:07

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\upds.log - Deleted



Folder C:\WINDOWS\system32\svcd - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-03 22:25:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\Program Files\Real\RealPlayer\realplay.exe"="C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer"
"C:\Program Files\iVisit\iVisit.exe"="C:\Program Files\iVisit\iVisit.exe:*:Enabled: iVisit "
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe:*:Enabled:Logitech Desktop Messenger"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Thu  8 May 2008            24 ..SH. --- "C:\WINDOWS\S0282DDBB.tmp"
Wed 13 Oct 2004     1,694,208 ..SH. --- "C:\Program Files\Messenger\msmsgs.exe"
Mon  7 Jul 2008     1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon  7 Jul 2008     4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon  7 Jul 2008     2,156,368 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Fri 16 Jun 2006         4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 16 Mar 2008       203,776 A..H. --- "C:\Documents and Settings\Jo\Bureau\Documents de tous\Document Philippe\~WRL2142.tmp"
Sun 16 Mar 2008       898,560 A..H. --- "C:\Documents and Settings\Jo\Bureau\Documents de tous\Document Philippe\~WRL2790.tmp"
Sun 16 Mar 2008       105,472 A..H. --- "C:\Documents and Settings\Jo\Bureau\Documents de tous\Document Philippe\~WRL3112.tmp"

[b]Finished![/b]

et le rapport histjack qui va bien:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:36:53, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mwww.yahoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file)
O2 - BHO: (no name) - {38434192-B415-43F8-B55A-94CE516B9784} - (no file)
O2 - BHO: (no name) - {4816822F-6BB2-4314-A4DA-D5909E06D766} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file)
O2 - BHO: (no name) - {8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\Windows Live Toolbar\stmain.dll
O2 - BHO: (no name) - {A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file)
O2 - BHO: (no name) - {E6DE5385-105C-4209-ADC4-BB350A388402} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EA493A70-7653-41F0-BFF6-564780474B4D} - (no file)
O2 - BHO: (no name) - {ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file)
O2 - BHO: (no name) - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - (no file)
O2 - BHO: (no name) - {FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [887386d2] rundll32.exe "C:\WINDOWS\system32\bebwqpoc.dll",b
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: iifGxVPH - C:\WINDOWS\
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Utilisateur anonyme · Answer

Re,

Télécharge Lop S&D ici :

https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2

Double-clique dessus pour lancer l'installation

Puis double-clique [b]sur le raccourci Lop S&D/b présent sur ton bureau

Séléctionne la langue souhaitée , puis choisis [b]l'Option 1/b ( Recherche )

Patiente jusqu'à la fin du scan

Poste le rapport généré ( C:lopR.txt )

philjofr · Answer

et voici le rapport lop....je vais pas tarder a aller au lit...crois-tu qu'il y en a encore pour longtemps?

   --------------------\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.93GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : Jo ( Administrator )
   BOOT : Normal boot
   Antivirus : ZoneAlarm Security Suite Antivirus 7.0.462.000 (Activated)
   Firewall  : ZoneAlarm Security Suite Firewall 7.0.462.000 (Activated)
   C:\ (Local Disk) - NTFS - Total:161 Go (Free:83 Go)
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [1] ( 03/11/2008|22:50 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [02/09/2007|10:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [11/07/2005|16:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [02/11/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
   [18/12/2007|21:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [11/07/2005|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [08/05/2007|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [08/05/2007|10:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes
   [21/04/2007|21:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [28/08/2008|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
   [11/07/2008|08:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
   [07/08/2008|09:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [22/10/2006|20:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [03/11/2006|13:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Network Associates
   [28/08/2008|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
   [29/01/2007|17:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [11/07/2005|14:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [22/10/2005|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [06/08/2008|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\services
   [27/07/2008|12:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [15/12/2007|16:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [26/10/2008|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [03/09/2007|11:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [01/01/2006|18:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [14/05/2006|10:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [18/04/2008|04:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [01/05/2007|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [22/10/2005|15:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
   [26/02/2008|18:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [11/07/2005|16:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
   [12/07/2005|09:16] C:\DOCUME~1\DEFAUL~1\APPLIC~1\CyberLink
   [11/07/2005|14:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [11/07/2005|16:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [17/01/2008|17:26] C:\DOCUME~1\Jo\APPLIC~1\Adobe
   [23/10/2005|19:04] C:\DOCUME~1\Jo\APPLIC~1\AdobeUM
   [03/05/2006|09:39] C:\DOCUME~1\Jo\APPLIC~1\Ahead
   [01/01/2006|18:23] C:\DOCUME~1\Jo\APPLIC~1\Aim
   [23/10/2005|13:22] C:\DOCUME~1\Jo\APPLIC~1\ArcSoft
   [23/10/2005|15:45] C:\DOCUME~1\Jo\APPLIC~1\AVG7
   [18/12/2007|21:03] C:\DOCUME~1\Jo\APPLIC~1\AVS4YOU
   [12/07/2005|09:16] C:\DOCUME~1\Jo\APPLIC~1\CyberLink
   [03/05/2006|15:17] C:\DOCUME~1\Jo\APPLIC~1\DeepBurner
   [04/04/2007|20:45] C:\DOCUME~1\Jo\APPLIC~1\DivX
   [01/01/2007|23:10] C:\DOCUME~1\Jo\APPLIC~1\EoRezo
   [04/01/2008|09:59] C:\DOCUME~1\Jo\APPLIC~1\EPSON
   [04/04/2006|17:55] C:\DOCUME~1\Jo\APPLIC~1\funkitron
   [21/04/2007|21:25] C:\DOCUME~1\Jo\APPLIC~1\Google
   [11/11/2005|10:28] C:\DOCUME~1\Jo\APPLIC~1\Help
   [11/07/2005|14:25] C:\DOCUME~1\Jo\APPLIC~1\Identities
   [22/10/2005|13:44] C:\DOCUME~1\Jo\APPLIC~1\InterTrust
   [03/11/2006|14:12] C:\DOCUME~1\Jo\APPLIC~1\Lavasoft
   [19/02/2007|10:45] C:\DOCUME~1\Jo\APPLIC~1\Leadertech
   [22/10/2005|14:25] C:\DOCUME~1\Jo\APPLIC~1\Macromedia
   [11/07/2008|08:47] C:\DOCUME~1\Jo\APPLIC~1\MailFrontier
   [07/08/2008|09:42] C:\DOCUME~1\Jo\APPLIC~1\Malwarebytes
   [08/07/2007|13:26] C:\DOCUME~1\Jo\APPLIC~1\Microsoft
   [22/10/2005|13:47] C:\DOCUME~1\Jo\APPLIC~1\Microsoft Web Folders
   [12/09/2008|20:00] C:\DOCUME~1\Jo\APPLIC~1\Mozilla
   [02/04/2007|17:40] C:\DOCUME~1\Jo\APPLIC~1\Musicmatch
   [28/08/2008|10:46] C:\DOCUME~1\Jo\APPLIC~1\Nokia
   [28/08/2008|10:46] C:\DOCUME~1\Jo\APPLIC~1\PC Suite
   [23/11/2006|21:45] C:\DOCUME~1\Jo\APPLIC~1\Shareaza
   [15/12/2007|16:57] C:\DOCUME~1\Jo\APPLIC~1\Sony Corporation
   [24/10/2005|19:15] C:\DOCUME~1\Jo\APPLIC~1\Sun
   [28/04/2007|09:52] C:\DOCUME~1\Jo\APPLIC~1\TaoUSign
   [18/06/2008|14:23] C:\DOCUME~1\Jo\APPLIC~1\Viewpoint
   [03/05/2006|07:53] C:\DOCUME~1\Jo\APPLIC~1\vlc
   [03/05/2006|20:20] C:\DOCUME~1\Jo\APPLIC~1\Vso
   [10/06/2007|18:40] C:\DOCUME~1\Jo\APPLIC~1\Yahoo!

   [22/10/2005|15:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
   [02/11/2006|21:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [02/11/2006|21:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS\tasks

   [03/11/2008 22:34][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
   [05/08/2004 13:00][-r-h-c---] C:\WINDOWS\tasks\desktop.ini
   [03/11/2008 22:32][--ah-----] C:\WINDOWS\tasks\SA.DAT

   --------------------\  Listing des dossiers dans C:\Program Files

   [06/04/2008|14:20] C:\Program Files\ABBYY FineReader 6.0 Sprint
   [02/09/2007|10:27] C:\Program Files\Adobe
   [03/05/2006|19:27] C:\Program Files\Ahead
   [27/07/2008|12:12] C:\Program Files\AIM
   [22/10/2005|13:43] C:\Program Files\ArcSoft
   [03/05/2006|15:16] C:\Program Files\Astonsoft
   [18/12/2007|21:42] C:\Program Files\AVI MPEG RM WMV Joiner
   [03/05/2006|20:26] C:\Program Files\Avi2Dvd
   [04/04/2007|20:40] C:\Program Files\AviSynth 2.5
   [18/12/2007|21:42] C:\Program Files\AVS4YOU
   [06/08/2008|18:46] C:\Program Files\AxBx
   [24/02/2006|11:20] C:\Program Files\Camfrog
   [17/07/2006|16:54] C:\Program Files\CCleaner
   [28/07/2008|21:42] C:\Program Files\CDBurnerXP Pro 3
   [03/11/2006|01:14] C:\Program Files\Common Files
   [03/11/2006|13:45] C:\Program Files\ComPlus Applications
   [11/07/2005|16:32] C:\Program Files\CyberLink
   [28/08/2008|10:42] C:\Program Files\DIFX
   [03/05/2006|23:01] C:\Program Files\DIKO
   [04/04/2007|21:08] C:\Program Files\DivX
   [30/03/2008|17:51] C:\Program Files\e-Carte Bleue La Banque Postale
   [08/05/2007|12:57] C:\Program Files\Elaborate Bytes
   [23/05/2007|08:42] C:\Program Files\eMule
   [01/01/2007|23:10] C:\Program Files\eoRezo
   [03/09/2007|11:32] C:\Program Files\EPSON
   [11/07/2005|16:12] C:\Program Files\FenAffiche
   [03/11/2008|20:10] C:\Program Files\Fichiers communs
   [03/05/2006|10:54] C:\Program Files\Gabest
   [22/04/2007|08:32] C:\Program Files\Google
   [11/07/2005|14:32] C:\Program Files\HighMAT CD Writing Wizard
   [17/02/2007|10:44] C:\Program Files\IncrediMail
   [30/07/2008|21:58] C:\Program Files\InstallShield Installation Information
   [23/06/2008|21:48] C:\Program Files\Internet Explorer
   [26/10/2008|14:10] C:\Program Files\iVisit
   [24/10/2005|19:14] C:\Program Files\Java
   [08/05/2008|16:36] C:\Program Files\Kodak
   [03/11/2006|14:11] C:\Program Files\Lavasoft
   [17/01/2006|18:25] C:\Program Files\Logitech
   [07/08/2008|09:42] C:\Program Files\Malwarebytes' Anti-Malware
   [03/11/2008|21:39] C:\Program Files\Messenger
   [02/08/2007|21:56] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [22/10/2005|13:51] C:\Program Files\microsoft frontpage
   [22/10/2005|18:37] C:\Program Files\Microsoft Office
   [18/04/2008|03:55] C:\Program Files\Microsoft SQL Server Compact Edition
   [09/03/2008|17:23] C:\Program Files\Mindscape
   [08/02/2007|14:02] C:\Program Files\Montparnasse Multimedia - France T‚l‚com
   [11/07/2005|14:23] C:\Program Files\Movie Maker
   [14/09/2008|20:56] C:\Program Files\Mozilla Firefox
   [09/12/2006|12:59] C:\Program Files\MP3 Player Utilities 3.75
   [22/09/2007|11:32] C:\Program Files\MSN
   [11/07/2005|14:22] C:\Program Files\MSN Gaming Zone
   [19/11/2006|23:04] C:\Program Files\MSXML 4.0
   [02/04/2007|17:41] C:\Program Files\Musicmatch
   [04/07/2007|09:39] C:\Program Files\Nathan
   [03/11/2008|21:31] C:\Program Files\Navilog1
   [08/08/2006|17:33] C:\Program Files\NC NUMERICABLE
   [19/09/2008|19:13] C:\Program Files\N‚mopolis
   [11/07/2005|14:23] C:\Program Files\NetMeeting
   [03/11/2006|13:41] C:\Program Files\Network Associates
   [30/12/2005|21:14] C:\Program Files\New Star Soccer 3
   [28/08/2008|12:14] C:\Program Files\Nokia
   [09/04/2006|10:57] C:\Program Files\Oberon Media
   [03/11/2006|13:45] C:\Program Files\Online Services
   [02/08/2007|21:55] C:\Program Files\Outlook Express
   [03/04/2006|20:47] C:\Program Files\PacificPoker
   [23/06/2008|17:50] C:\Program Files\PartyGaming
   [28/08/2008|10:42] C:\Program Files\PC Connectivity Solution
   [15/11/2007|22:01] C:\Program Files\PDFCreator
   [15/11/2007|22:00] C:\Program Files\PDFCreator Toolbar
   [11/07/2005|14:32] C:\Program Files\Phoenix Technologies Ltd
   [03/11/2008|12:13] C:\Program Files\PokerStars
   [03/11/2008|12:13] C:\Program Files\PokerStars.NET
   [29/01/2007|17:42] C:\Program Files\QuickTime
   [22/10/2005|18:42] C:\Program Files\Real
   [08/05/2007|10:45] C:\Program Files\Real Clone DVD
   [11/07/2005|15:57] C:\Program Files\Realtek AC97
   [04/04/2007|21:09] C:\Program Files\Ripp-it_AM
   [13/04/2008|10:15] C:\Program Files\Services en ligne
   [23/11/2006|21:45] C:\Program Files\Shareaza
   [27/07/2008|12:04] C:\Program Files\Skype
   [27/07/2008|12:00] C:\Program Files\SlySoft
   [22/10/2005|13:52] C:\Program Files\Snapshot Viewer
   [15/12/2007|16:45] C:\Program Files\Sony
   [03/08/2006|18:58] C:\Program Files\Sony Corporation
   [07/08/2008|08:55] C:\Program Files\Spybot - Search & Destroy
   [27/07/2008|12:08] C:\Program Files\The Game Factory
   [02/04/2007|17:44] C:\Program Files\Thomson
   [18/10/2007|20:41] C:\Program Files\TooX
   [03/11/2008|21:33] C:\Program Files\Trend Micro
   [11/07/2005|14:28] C:\Program Files\Uninstall Information
   [03/05/2006|07:44] C:\Program Files\VideoLAN
   [01/01/2006|18:22] C:\Program Files\Viewpoint
   [22/09/2007|16:47] C:\Program Files\Virtools Web Player 3.5
   [03/05/2006|20:21] C:\Program Files\VSO
   [16/03/2008|11:39] C:\Program Files\Vsoft
   [11/07/2005|14:28] C:\Program Files\Windows Journal Viewer
   [23/06/2008|21:51] C:\Program Files\Windows Live
   [18/04/2008|03:55] C:\Program Files\Windows Live Favorites
   [09/05/2007|20:42] C:\Program Files\Windows Live Safety Center
   [18/04/2008|04:09] C:\Program Files\Windows Live Toolbar
   [22/10/2005|19:06] C:\Program Files\Windows Media Components
   [11/07/2005|14:32] C:\Program Files\Windows Media Connect
   [17/02/2006|23:20] C:\Program Files\Windows Media Player
   [03/11/2006|13:54] C:\Program Files\Windows NT
   [11/07/2005|14:23] C:\Program Files\WindowsUpdate
   [11/07/2005|14:25] C:\Program Files\xerox
   [20/07/2006|13:06] C:\Program Files\Yahoo!
   [03/11/2006|15:25] C:\Program Files\Zone Labs
   [26/02/2008|18:37] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [02/09/2007|10:29] C:\Program Files\Fichiers communs\Adobe
   [11/07/2005|16:29] C:\Program Files\Fichiers communs\Ahead
   [22/10/2005|18:33] C:\Program Files\Fichiers communs\AOL
   [18/12/2007|21:42] C:\Program Files\Fichiers communs\AVSMedia
   [11/07/2005|16:15] C:\Program Files\Fichiers communs\DESIGNER
   [22/10/2005|13:39] C:\Program Files\Fichiers communs\EPSON
   [03/09/2007|11:38] C:\Program Files\Fichiers communs\InstallShield
   [24/10/2005|19:11] C:\Program Files\Fichiers communs\Java
   [08/05/2008|16:36] C:\Program Files\Fichiers communs\Kodak
   [03/08/2006|16:05] C:\Program Files\Fichiers communs\Logitech
   [18/04/2008|03:49] C:\Program Files\Fichiers communs\Microsoft Shared
   [11/07/2005|14:23] C:\Program Files\Fichiers communs\MSSoap
   [03/11/2006|13:41] C:\Program Files\Fichiers communs\Network Associates
   [11/07/2005|16:17] C:\Program Files\Fichiers communs\ODBC
   [22/10/2005|13:42] C:\Program Files\Fichiers communs\Python
   [22/10/2005|18:42] C:\Program Files\Fichiers communs\Real
   [11/07/2005|14:23] C:\Program Files\Fichiers communs\Services
   [03/08/2006|18:59] C:\Program Files\Fichiers communs\Sony Shared
   [11/07/2005|16:17] C:\Program Files\Fichiers communs\SpeechEngines
   [02/11/2008|23:00] C:\Program Files\Fichiers communs\Symantec Shared
   [02/08/2007|21:55] C:\Program Files\Fichiers communs\System
   [18/04/2008|03:52] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 51 Processes )

   iexplore.exe ~ [PID:684]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-11-03 22:53:07
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 10
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Jo\Mes documents\Downloads\(DONE) dj kamel8 1 _crack_ [Tool].wma
   C:\DOCUME~1\Jo\Mes documents\Downloads\(ECHOS) decidant  (Crack) Special.Edition.wma
   C:\DOCUME~1\Jo\Mes documents\Downloads\(ECHOS) funck disco  (Crack) (Radio.Edit).wma
   C:\DOCUME~1\Jo\Mes documents\Downloads\Metadata\(DONE) dj kamel8 1 _crack_ [Tool].wma.xml
   C:\DOCUME~1\Jo\Mes documents\Downloads\Metadata\(ECHOS) decidant  (Crack) Special.Edition.wma.xml
   C:\DOCUME~1\Jo\Mes documents\Downloads\Metadata\(ECHOS) funck disco  (Crack) (Radio.Edit).wma.xml


   [F:58][D:0]-> C:\DOCUME~1\Jo\Cookies
   [F:511][D:4]-> C:\DOCUME~1\Jo\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 03/11/2008|22:54 - Option : [1]

   --------------------\  Fin du rapport a 22:54:34

philjofr · Answer

et voici le rapport lop....je vais pas tarder a aller au lit...crois-tu qu'il y en a encore pour longtemps?

   --------------------\  Lop S&D 4.2.4-9c   XP/Vista

   Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Uniprocessor Free :               Intel(R) Pentium(R) 4 CPU 2.93GHz )
   BIOS : Phoenix - AwardBIOS v6.00PG
   USER : Jo ( Administrator )
   BOOT : Normal boot
   Antivirus : ZoneAlarm Security Suite Antivirus 7.0.462.000 (Activated)
   Firewall  : ZoneAlarm Security Suite Firewall 7.0.462.000 (Activated)
   C:\ (Local Disk) - NTFS - Total:161 Go (Free:83 Go)
   D:\ (CD or DVD)
   E:\ (USB)
   F:\ (USB)
   G:\ (USB)
   H:\ (USB)
   I:\ (USB)

   "C:\Lop SD" ( MAJ : 01-11-2008|16:30 )
   Option : [1] ( 03/11/2008|22:50 )
 
   --------------------\  Listing des dossiers dans APPLIC~1

   [02/09/2007|10:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [11/07/2005|16:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ahead
   [02/11/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg7
   [18/12/2007|21:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [11/07/2005|16:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
   [08/05/2007|11:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [08/05/2007|10:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Elaborate Bytes
   [21/04/2007|21:15] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [28/08/2008|10:40] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Installations
   [11/07/2008|08:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
   [07/08/2008|09:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [22/10/2006|20:34] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [03/11/2006|13:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Network Associates
   [28/08/2008|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Suite
   [29/01/2007|17:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
   [11/07/2005|14:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
   [22/10/2005|13:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBT
   [06/08/2008|12:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\services
   [27/07/2008|12:04] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [15/12/2007|16:44] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Corporation
   [26/10/2008|11:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [03/09/2007|11:35] C:\DOCUME~1\ALLUSE~1\APPLIC~1\UDL
   [01/01/2006|18:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
   [14/05/2006|10:18] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
   [18/04/2008|04:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [01/05/2007|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
   [22/10/2005|15:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo! Companion
   [26/02/2008|18:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Zylom

   [11/07/2005|16:50] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Adobe
   [12/07/2005|09:16] C:\DOCUME~1\DEFAUL~1\APPLIC~1\CyberLink
   [11/07/2005|14:25] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
   [11/07/2005|16:41] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [17/01/2008|17:26] C:\DOCUME~1\Jo\APPLIC~1\Adobe
   [23/10/2005|19:04] C:\DOCUME~1\Jo\APPLIC~1\AdobeUM
   [03/05/2006|09:39] C:\DOCUME~1\Jo\APPLIC~1\Ahead
   [01/01/2006|18:23] C:\DOCUME~1\Jo\APPLIC~1\Aim
   [23/10/2005|13:22] C:\DOCUME~1\Jo\APPLIC~1\ArcSoft
   [23/10/2005|15:45] C:\DOCUME~1\Jo\APPLIC~1\AVG7
   [18/12/2007|21:03] C:\DOCUME~1\Jo\APPLIC~1\AVS4YOU
   [12/07/2005|09:16] C:\DOCUME~1\Jo\APPLIC~1\CyberLink
   [03/05/2006|15:17] C:\DOCUME~1\Jo\APPLIC~1\DeepBurner
   [04/04/2007|20:45] C:\DOCUME~1\Jo\APPLIC~1\DivX
   [01/01/2007|23:10] C:\DOCUME~1\Jo\APPLIC~1\EoRezo
   [04/01/2008|09:59] C:\DOCUME~1\Jo\APPLIC~1\EPSON
   [04/04/2006|17:55] C:\DOCUME~1\Jo\APPLIC~1\funkitron
   [21/04/2007|21:25] C:\DOCUME~1\Jo\APPLIC~1\Google
   [11/11/2005|10:28] C:\DOCUME~1\Jo\APPLIC~1\Help
   [11/07/2005|14:25] C:\DOCUME~1\Jo\APPLIC~1\Identities
   [22/10/2005|13:44] C:\DOCUME~1\Jo\APPLIC~1\InterTrust
   [03/11/2006|14:12] C:\DOCUME~1\Jo\APPLIC~1\Lavasoft
   [19/02/2007|10:45] C:\DOCUME~1\Jo\APPLIC~1\Leadertech
   [22/10/2005|14:25] C:\DOCUME~1\Jo\APPLIC~1\Macromedia
   [11/07/2008|08:47] C:\DOCUME~1\Jo\APPLIC~1\MailFrontier
   [07/08/2008|09:42] C:\DOCUME~1\Jo\APPLIC~1\Malwarebytes
   [08/07/2007|13:26] C:\DOCUME~1\Jo\APPLIC~1\Microsoft
   [22/10/2005|13:47] C:\DOCUME~1\Jo\APPLIC~1\Microsoft Web Folders
   [12/09/2008|20:00] C:\DOCUME~1\Jo\APPLIC~1\Mozilla
   [02/04/2007|17:40] C:\DOCUME~1\Jo\APPLIC~1\Musicmatch
   [28/08/2008|10:46] C:\DOCUME~1\Jo\APPLIC~1\Nokia
   [28/08/2008|10:46] C:\DOCUME~1\Jo\APPLIC~1\PC Suite
   [23/11/2006|21:45] C:\DOCUME~1\Jo\APPLIC~1\Shareaza
   [15/12/2007|16:57] C:\DOCUME~1\Jo\APPLIC~1\Sony Corporation
   [24/10/2005|19:15] C:\DOCUME~1\Jo\APPLIC~1\Sun
   [28/04/2007|09:52] C:\DOCUME~1\Jo\APPLIC~1\TaoUSign
   [18/06/2008|14:23] C:\DOCUME~1\Jo\APPLIC~1\Viewpoint
   [03/05/2006|07:53] C:\DOCUME~1\Jo\APPLIC~1\vlc
   [03/05/2006|20:20] C:\DOCUME~1\Jo\APPLIC~1\Vso
   [10/06/2007|18:40] C:\DOCUME~1\Jo\APPLIC~1\Yahoo!

   [22/10/2005|15:51] C:\DOCUME~1\LOCALS~1\APPLIC~1\AVG7
   [02/11/2006|21:38] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

   [02/11/2006|21:38] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
 
   --------------------\  Tâches planifiées dans C:\WINDOWS\tasks

   [03/11/2008 22:34][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
   [05/08/2004 13:00][-r-h-c---] C:\WINDOWS\tasks\desktop.ini
   [03/11/2008 22:32][--ah-----] C:\WINDOWS\tasks\SA.DAT

   --------------------\  Listing des dossiers dans C:\Program Files

   [06/04/2008|14:20] C:\Program Files\ABBYY FineReader 6.0 Sprint
   [02/09/2007|10:27] C:\Program Files\Adobe
   [03/05/2006|19:27] C:\Program Files\Ahead
   [27/07/2008|12:12] C:\Program Files\AIM
   [22/10/2005|13:43] C:\Program Files\ArcSoft
   [03/05/2006|15:16] C:\Program Files\Astonsoft
   [18/12/2007|21:42] C:\Program Files\AVI MPEG RM WMV Joiner
   [03/05/2006|20:26] C:\Program Files\Avi2Dvd
   [04/04/2007|20:40] C:\Program Files\AviSynth 2.5
   [18/12/2007|21:42] C:\Program Files\AVS4YOU
   [06/08/2008|18:46] C:\Program Files\AxBx
   [24/02/2006|11:20] C:\Program Files\Camfrog
   [17/07/2006|16:54] C:\Program Files\CCleaner
   [28/07/2008|21:42] C:\Program Files\CDBurnerXP Pro 3
   [03/11/2006|01:14] C:\Program Files\Common Files
   [03/11/2006|13:45] C:\Program Files\ComPlus Applications
   [11/07/2005|16:32] C:\Program Files\CyberLink
   [28/08/2008|10:42] C:\Program Files\DIFX
   [03/05/2006|23:01] C:\Program Files\DIKO
   [04/04/2007|21:08] C:\Program Files\DivX
   [30/03/2008|17:51] C:\Program Files\e-Carte Bleue La Banque Postale
   [08/05/2007|12:57] C:\Program Files\Elaborate Bytes
   [23/05/2007|08:42] C:\Program Files\eMule
   [01/01/2007|23:10] C:\Program Files\eoRezo
   [03/09/2007|11:32] C:\Program Files\EPSON
   [11/07/2005|16:12] C:\Program Files\FenAffiche
   [03/11/2008|20:10] C:\Program Files\Fichiers communs
   [03/05/2006|10:54] C:\Program Files\Gabest
   [22/04/2007|08:32] C:\Program Files\Google
   [11/07/2005|14:32] C:\Program Files\HighMAT CD Writing Wizard
   [17/02/2007|10:44] C:\Program Files\IncrediMail
   [30/07/2008|21:58] C:\Program Files\InstallShield Installation Information
   [23/06/2008|21:48] C:\Program Files\Internet Explorer
   [26/10/2008|14:10] C:\Program Files\iVisit
   [24/10/2005|19:14] C:\Program Files\Java
   [08/05/2008|16:36] C:\Program Files\Kodak
   [03/11/2006|14:11] C:\Program Files\Lavasoft
   [17/01/2006|18:25] C:\Program Files\Logitech
   [07/08/2008|09:42] C:\Program Files\Malwarebytes' Anti-Malware
   [03/11/2008|21:39] C:\Program Files\Messenger
   [02/08/2007|21:56] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [22/10/2005|13:51] C:\Program Files\microsoft frontpage
   [22/10/2005|18:37] C:\Program Files\Microsoft Office
   [18/04/2008|03:55] C:\Program Files\Microsoft SQL Server Compact Edition
   [09/03/2008|17:23] C:\Program Files\Mindscape
   [08/02/2007|14:02] C:\Program Files\Montparnasse Multimedia - France T‚l‚com
   [11/07/2005|14:23] C:\Program Files\Movie Maker
   [14/09/2008|20:56] C:\Program Files\Mozilla Firefox
   [09/12/2006|12:59] C:\Program Files\MP3 Player Utilities 3.75
   [22/09/2007|11:32] C:\Program Files\MSN
   [11/07/2005|14:22] C:\Program Files\MSN Gaming Zone
   [19/11/2006|23:04] C:\Program Files\MSXML 4.0
   [02/04/2007|17:41] C:\Program Files\Musicmatch
   [04/07/2007|09:39] C:\Program Files\Nathan
   [03/11/2008|21:31] C:\Program Files\Navilog1
   [08/08/2006|17:33] C:\Program Files\NC NUMERICABLE
   [19/09/2008|19:13] C:\Program Files\N‚mopolis
   [11/07/2005|14:23] C:\Program Files\NetMeeting
   [03/11/2006|13:41] C:\Program Files\Network Associates
   [30/12/2005|21:14] C:\Program Files\New Star Soccer 3
   [28/08/2008|12:14] C:\Program Files\Nokia
   [09/04/2006|10:57] C:\Program Files\Oberon Media
   [03/11/2006|13:45] C:\Program Files\Online Services
   [02/08/2007|21:55] C:\Program Files\Outlook Express
   [03/04/2006|20:47] C:\Program Files\PacificPoker
   [23/06/2008|17:50] C:\Program Files\PartyGaming
   [28/08/2008|10:42] C:\Program Files\PC Connectivity Solution
   [15/11/2007|22:01] C:\Program Files\PDFCreator
   [15/11/2007|22:00] C:\Program Files\PDFCreator Toolbar
   [11/07/2005|14:32] C:\Program Files\Phoenix Technologies Ltd
   [03/11/2008|12:13] C:\Program Files\PokerStars
   [03/11/2008|12:13] C:\Program Files\PokerStars.NET
   [29/01/2007|17:42] C:\Program Files\QuickTime
   [22/10/2005|18:42] C:\Program Files\Real
   [08/05/2007|10:45] C:\Program Files\Real Clone DVD
   [11/07/2005|15:57] C:\Program Files\Realtek AC97
   [04/04/2007|21:09] C:\Program Files\Ripp-it_AM
   [13/04/2008|10:15] C:\Program Files\Services en ligne
   [23/11/2006|21:45] C:\Program Files\Shareaza
   [27/07/2008|12:04] C:\Program Files\Skype
   [27/07/2008|12:00] C:\Program Files\SlySoft
   [22/10/2005|13:52] C:\Program Files\Snapshot Viewer
   [15/12/2007|16:45] C:\Program Files\Sony
   [03/08/2006|18:58] C:\Program Files\Sony Corporation
   [07/08/2008|08:55] C:\Program Files\Spybot - Search & Destroy
   [27/07/2008|12:08] C:\Program Files\The Game Factory
   [02/04/2007|17:44] C:\Program Files\Thomson
   [18/10/2007|20:41] C:\Program Files\TooX
   [03/11/2008|21:33] C:\Program Files\Trend Micro
   [11/07/2005|14:28] C:\Program Files\Uninstall Information
   [03/05/2006|07:44] C:\Program Files\VideoLAN
   [01/01/2006|18:22] C:\Program Files\Viewpoint
   [22/09/2007|16:47] C:\Program Files\Virtools Web Player 3.5
   [03/05/2006|20:21] C:\Program Files\VSO
   [16/03/2008|11:39] C:\Program Files\Vsoft
   [11/07/2005|14:28] C:\Program Files\Windows Journal Viewer
   [23/06/2008|21:51] C:\Program Files\Windows Live
   [18/04/2008|03:55] C:\Program Files\Windows Live Favorites
   [09/05/2007|20:42] C:\Program Files\Windows Live Safety Center
   [18/04/2008|04:09] C:\Program Files\Windows Live Toolbar
   [22/10/2005|19:06] C:\Program Files\Windows Media Components
   [11/07/2005|14:32] C:\Program Files\Windows Media Connect
   [17/02/2006|23:20] C:\Program Files\Windows Media Player
   [03/11/2006|13:54] C:\Program Files\Windows NT
   [11/07/2005|14:23] C:\Program Files\WindowsUpdate
   [11/07/2005|14:25] C:\Program Files\xerox
   [20/07/2006|13:06] C:\Program Files\Yahoo!
   [03/11/2006|15:25] C:\Program Files\Zone Labs
   [26/02/2008|18:37] C:\Program Files\Zylom Games

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [02/09/2007|10:29] C:\Program Files\Fichiers communs\Adobe
   [11/07/2005|16:29] C:\Program Files\Fichiers communs\Ahead
   [22/10/2005|18:33] C:\Program Files\Fichiers communs\AOL
   [18/12/2007|21:42] C:\Program Files\Fichiers communs\AVSMedia
   [11/07/2005|16:15] C:\Program Files\Fichiers communs\DESIGNER
   [22/10/2005|13:39] C:\Program Files\Fichiers communs\EPSON
   [03/09/2007|11:38] C:\Program Files\Fichiers communs\InstallShield
   [24/10/2005|19:11] C:\Program Files\Fichiers communs\Java
   [08/05/2008|16:36] C:\Program Files\Fichiers communs\Kodak
   [03/08/2006|16:05] C:\Program Files\Fichiers communs\Logitech
   [18/04/2008|03:49] C:\Program Files\Fichiers communs\Microsoft Shared
   [11/07/2005|14:23] C:\Program Files\Fichiers communs\MSSoap
   [03/11/2006|13:41] C:\Program Files\Fichiers communs\Network Associates
   [11/07/2005|16:17] C:\Program Files\Fichiers communs\ODBC
   [22/10/2005|13:42] C:\Program Files\Fichiers communs\Python
   [22/10/2005|18:42] C:\Program Files\Fichiers communs\Real
   [11/07/2005|14:23] C:\Program Files\Fichiers communs\Services
   [03/08/2006|18:59] C:\Program Files\Fichiers communs\Sony Shared
   [11/07/2005|16:17] C:\Program Files\Fichiers communs\SpeechEngines
   [02/11/2008|23:00] C:\Program Files\Fichiers communs\Symantec Shared
   [02/08/2007|21:55] C:\Program Files\Fichiers communs\System
   [18/04/2008|03:52] C:\Program Files\Fichiers communs\WindowsLiveInstaller

   --------------------\  Process

   ( 51 Processes )

   iexplore.exe ~ [PID:684]

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-11-03 22:53:07
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 10
 
   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\DOCUME~1\Jo\Mes documents\Downloads\(DONE) dj kamel8 1 _crack_ [Tool].wma
   C:\DOCUME~1\Jo\Mes documents\Downloads\(ECHOS) decidant  (Crack) Special.Edition.wma
   C:\DOCUME~1\Jo\Mes documents\Downloads\(ECHOS) funck disco  (Crack) (Radio.Edit).wma
   C:\DOCUME~1\Jo\Mes documents\Downloads\Metadata\(DONE) dj kamel8 1 _crack_ [Tool].wma.xml
   C:\DOCUME~1\Jo\Mes documents\Downloads\Metadata\(ECHOS) decidant  (Crack) Special.Edition.wma.xml
   C:\DOCUME~1\Jo\Mes documents\Downloads\Metadata\(ECHOS) funck disco  (Crack) (Radio.Edit).wma.xml


   [F:58][D:0]-> C:\DOCUME~1\Jo\Cookies
   [F:511][D:4]-> C:\DOCUME~1\Jo\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 03/11/2008|22:54 - Option : [1]

   --------------------\  Fin du rapport a 22:54:34

Utilisateur anonyme · Answer

Re,

Fais ceci maintenant :


Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse


----------------------------------------------------------------------------------------------------------------------------------------------------------
---> Télécharge CCleaner (N'installe pas la Yahoo Toolbar) :
https://www.ccleaner.com/ccleaner/download

---> Lance-le. Va dans "Options" puis "Avancé", tu décoches la case "Effacer uniquement les fichiers etc...". Tu vas dans "Nettoyeur", tu fais "Analyse". Une fois terminé, tu lances le nettoyage. Puis tu vas dans "Registre", tu fais "Chercher des erreurs". Une fois terminé, tu répares toutes les erreurs sans sauvegarder la base de registre.
accompagné d'un nouveau rapport hijackthis pour analyse ...

philjofr · Answer

voilà le histjack apres le ccleaner:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:08:53, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mwww.yahoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file)
O2 - BHO: (no name) - {38434192-B415-43F8-B55A-94CE516B9784} - (no file)
O2 - BHO: (no name) - {4816822F-6BB2-4314-A4DA-D5909E06D766} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file)
O2 - BHO: (no name) - {8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\Windows Live Toolbar\stmain.dll
O2 - BHO: (no name) - {A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file)
O2 - BHO: (no name) - {E6DE5385-105C-4209-ADC4-BB350A388402} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EA493A70-7653-41F0-BFF6-564780474B4D} - (no file)
O2 - BHO: (no name) - {ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file)
O2 - BHO: (no name) - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - (no file)
O2 - BHO: (no name) - {FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: iifGxVPH - C:\WINDOWS\
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

philjofr · Answer

voilà le histjack apres le ccleaner:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:08:53, on 03/11/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mwww.yahoo.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file)
O2 - BHO: (no name) - {38434192-B415-43F8-B55A-94CE516B9784} - (no file)
O2 - BHO: (no name) - {4816822F-6BB2-4314-A4DA-D5909E06D766} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file)
O2 - BHO: (no name) - {8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\Windows Live Toolbar\stmain.dll
O2 - BHO: (no name) - {A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O2 - BHO: (no name) - {DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file)
O2 - BHO: (no name) - {E6DE5385-105C-4209-ADC4-BB350A388402} - (no file)
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: (no name) - {EA493A70-7653-41F0-BFF6-564780474B4D} - (no file)
O2 - BHO: (no name) - {ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file)
O2 - BHO: (no name) - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - (no file)
O2 - BHO: (no name) - {FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [RestoreIT!] "C:\Program Files\Phoenix Technologies Ltd\RecoverPro_XP\VBPTASK.EXE" VBStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Fichiers communs\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [NBJ] "C:\Program Files\Ahead\Nero BackItUp\NBJ.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Fichiers communs\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Outil de détection de support Picture Motion Browser.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Program Files\MP3 Player Utilities 3.75\AMVConverter\grab.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 3.75\MediaManager\grab.html
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - 
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - 
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: iifGxVPH - C:\WINDOWS\
O23 - Service: EpsonBidirectionalService - Unknown owner - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: Service Framework McAfee (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN
ipsvc.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: PsShutdown (PsShutdownSvc) - Systems Internals - C:\WINDOWS\System32\PSSDNSVC.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

philjofr · Answer

bon je vais aller au lit...mon ordi est maintenat tout propre...je te dois une fière chandelle!!!merci bcp Gloldorak et y'a pas de doute tu portes bien ton pseudo...rien ne te resiste...
tu nr m'as pas repondu pour l'antivius efficace..que vaut celui qui est a télécharger sur cette page: AvastPro4.8?

Utilisateur anonyme · Answer

Re,

Te conseil celui la antivir

Relance hijack et clique sur "Do a system scan only"
Ensuite recherche ces lignes et coches les cases

O2 - BHO: (no name) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - (no file)
O2 - BHO: (no name) - {33E4BDD5-F3D0-4BE6-A4AB-DF1320CF86EC} - (no file)
O2 - BHO: (no name) - {38434192-B415-43F8-B55A-94CE516B9784} - (no file)
O2 - BHO: (no name) - {4816822F-6BB2-4314-A4DA-D5909E06D766} - (no file)
O2 - BHO: (no name) - {7BA3FECD-693C-452A-84C5-C0F47552B6F7} - (no file)
O2 - BHO: (no name) - {8DF8454C-9CE4-402A-8A7C-24707CE61FD4} - (no file)
O2 - BHO: (no name) - {A0A39315-9982-44F4-91D1-86E7CEA7E512} - (no file)
O2 - BHO: (no name) - {DC71E2D8-63FB-4302-9472-046BF6BA2F65} - (no file)
O2 - BHO: (no name) - {E6DE5385-105C-4209-ADC4-BB350A388402} - (no file)
O2 - BHO: (no name) - {EA493A70-7653-41F0-BFF6-564780474B4D} - (no file)
O2 - BHO: (no name) - {ebca3b29-a035-4ed6-b9a1-e0cc70d6a1a4} - (no file)
O2 - BHO: (no name) - {F62A47A7-4CA3-9D00-95A3-6724d43a9E8C} - (no file)
O2 - BHO: (no name) - {FA4E2625-26F9-4E67-B18A-B2E86A8702E9} - (no file)


Ensuite clique sur "Fix checked"

=>>Ensuite refait un rapport hijackthis.

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques 

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 
* Clique sur Recherche et laisse le scan se terminer. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse


[color=red][b]Désactive et réactive la Restauration du système :/b/color
 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration dans accessoires----outils systeme----restauration du systeme.


Merci.

philjofr · Answer

bonjour goldorak, 

mon ordi tourne comme un avion!!! J'ai fait un point de restauration comme tu me l'a préconisé et voici le rapport Tcleaner:

[ Rapport ToolsCleaner version 2.2.5 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\fixnavi.txt: trouvé !
C:\lopR.txt: trouvé !
C:\avenger.txt: trouvé !
C:\SDFIX: trouvé !
C:\Lop SD: trouvé !
C:\Vundofix backups: trouvé !
C:\Qoobox: trouvé !
C:\_OtMoveIt: trouvé !
C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: trouvé !
C:\Documents and Settings\Jo\Bureau\SmitFraudFix.zip: trouvé !
C:\Documents and Settings\Jo\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Jo\Bureau\OtMoveIt2.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\hijackthis.log: trouvé !
C:\Documents and Settings\Jo\Bureau\SmitFraudfix: trouvé !
C:\Documents and Settings\Jo\Bureau\Documents de tous\Document Philippe\vundoFix.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\programme\SdFix.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\programme\Navilog1.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\programme\HJTInstall.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\programme\SmitFraudFix.exe: trouvé !
C:\Documents and Settings\Jo\Bureau\programme\SmitFraudfix: trouvé !
C:\Documents and Settings\Jo\Bureau\rapport 03 11 2008\fixnavi.txt: trouvé !
C:\Documents and Settings\Jo\Bureau\rapport 03 11 2008\lopR.txt: trouvé !
C:\Documents and Settings\Jo\Bureau\SmitfraudFix\SmitFraudfix: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Navilog1\Navilog1.bat: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Bureau\Navilog1.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1\Navilog1.lnk: supprimé !
C:\Documents and Settings\Jo\Bureau\SmitFraudFix.zip: supprimé !
C:\Documents and Settings\Jo\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Jo\Bureau\OtMoveIt2.exe: supprimé !
C:\Documents and Settings\Jo\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !!
C:\Documents and Settings\Jo\Bureau\SmitFraudFix.exe: supprimé !
C:\Documents and Settings\Jo\Bureau\Documents de tous\Document Philippe\vundoFix.exe: supprimé !
C:\Documents and Settings\Jo\Bureau\programme\SdFix.exe: supprimé !
C:\Documents and Settings\Jo\Bureau\programme\Navilog1.exe: supprimé !
C:\Documents and Settings\Jo\Bureau\programme\HJTInstall.exe: supprimé !
C:\Documents and Settings\Jo\Bureau\programme\SmitFraudFix.exe: supprimé !
C:\Program Files\Navilog1\Navilog1.bat: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\fixnavi.txt: supprimé !
C:\lopR.txt: supprimé !
C:\avenger.txt: supprimé !
C:\Documents and Settings\Jo\Bureau\hijackthis.log: supprimé !
C:\Documents and Settings\Jo\Bureau\rapport 03 11 2008\fixnavi.txt: supprimé !
C:\Documents and Settings\Jo\Bureau\rapport 03 11 2008\lopR.txt: supprimé !
C:\Program Files\Trend Micro\HijackThis\hijackthis.log: supprimé !
C:\SDFIX: supprimé !
C:\Lop SD: supprimé !
C:\Vundofix backups: supprimé !
C:\Qoobox: supprimé !
C:\_OtMoveIt: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Navilog1: supprimé !
C:\Documents and Settings\Jo\Bureau\SmitFraudfix: supprimé !
C:\Documents and Settings\Jo\Bureau\programme\SmitFraudfix: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Je vais installer Antivir, y a-t-il des choses spécifiques à faire pour qu'il marche et se mette a jour automatiquement? Dois-je désinstallé mon antivirus actuel?
Merci pour tes réponses précieuses, 
A bientôt; 
Philjofr

Utilisateur anonyme · Answer

Salut,

C:\Documents and Settings\Jo\Bureau\ComboFix.exe: ERREUR DE SUPPRESSION !! 

Ensuite désinstalle ton antivirus avant de mettre ANTIVIR.

@+

Pub intemprestives et antivirus windows 2009

54 réponses

Discussions similaires

Newsletters