Virus Personnal Defender 2009 Résolu/Fermé

Question

Bonjour a tous :)

Voici mon problème :
J'ai une fenêtre qui souvre toute seule et revenant régulièrement me disant que j'ai un spyware dans mon ordi.
Le seul moyen de l'enlever serai de télécharger Personnal Defender 2009.
J'ai vu sur commentcamarche.net qu'il s'agit en fait d'un virus.
Mon antivirus, BitDefender total security 2008, ne le détecte pas et Spybot S&D non plus. :/

J'ai fais un scann avec HijackThis que voici : 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:56:34, on 11/11/2008
Platform: Windows Vista  (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32	askeng.exe
C:\Windows\System32undll32.exe
C:\Windows\System32undll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Users\FNAC\AppData\Roaming\Google\visfdw.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\BitDefender\BitDefender 2008\seccenter.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\BitDefender\BitDefender 2008\uiscan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Users\FNAC\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32
vsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [winlogone] "C:\Users\FNAC\AppData\Roaming\Google\visfdw.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\Program Files\Mozilla Firefox\plugins\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\System32\csrsrv32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

Utilisateur anonyme · Answer

Salut, ============================Si vista:================================ =>Désactiver l'UAC de vista DEMARRER=>PANNEAU DE CONFIGURATION=>COMPTES UTILISATEURS: Cliquez ensuite sur Activer ou désactiver le contrôle des comptes d'utilisateurs. L'UAC vous demandera une confirmation ; cliquez sur le bouton Continuer. * Dans la nouvelle fenêtre , décocher la case Utiliser le contrôle des comptes d'utilisateurs pour vous aider à protéger votre ordinateur et cliquez sur OK. =>Redémarrer votre pc. désactiver l'uac ==>>Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.<<=== Toolbar-S&D !! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !! * double-cliques sur l'.exe pour lancer l'installe et laisses toi guider ... * Une fois fait, cliques sur le raccourci créé sur ton bureau pour lancer l'outil . * Choisis l'option 1 ( "recherche") et tapes "entrée" . * Une fois le scan finit , un rapport va apparaître, copie/colles l'intégralité de son contenu dans ta prochaine réponse ... ( le rapport est en outre sauvegardé ici -> C:\TB.txt ) Tutoriel Toolbard-S&D

Maxmax74 · Answer

-----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-60 )
   BIOS : Version 1.0
   USER : FNAC ( Administrator )
   BOOT : Normal boot
   Antivirus : Bitdefender Antivirus 8.0 (Activated)
   Firewall  : Bitdefender Firewall 8.0 (Activated)
   C:\ (Local Disk) - NTFS - Total:224 Go (Free:184 Go)
   D:\ (Local Disk) - NTFS - Total:232 Go (Free:227 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)
   G:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [1] ( 11/11/2008|14:44 )

   [ UAC => 0 ]

   -----------\  Recherche de Fichiers / Dossiers ...

   C:\Program Files\DAEMON Tools Toolbar
   C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
   C:\Program Files\DAEMON Tools Toolbar\Resources
   C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml

   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\ Need for Speed Underground 2 crack-serial-keygen (2).lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\ Need for Speed Underground 2 crack-serial-keygen.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\( PC GAME) NEED FOR SPEED UNDERGROUND 2 full game cd1+cd2+crack.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\Crack + Keygen.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\crack00.dat.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\Need for Speed Underground 2 crack-serial-keygen.exe.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\need for speed underground 2 crack.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\need for speed underground 2 keygen [ssg] (2).lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\need for speed underground 2 keygen [ssg].lnk


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 11/11/2008|14:45 - Option : [1]

   -----------\  Fin du rapport a 14:45:33,92



Voila

Utilisateur anonyme · Answer

Re,

Fais ceci maintenant :


Nettoyage avec ToolBar S&D :

!! Déconnectes toi et fermes toute tes applications en cours le temps de la manipe !!

Relances Toolbar-S&D en double-cliquant sur le raccourci.
-->Tapes sur l'option 2 ( "nettoyage" ) puis tapes sur "Entrée".

Note : ne touches à rien lors de la suppression !

Un rapport sera généré à la fin du processus : postes son contenu dans ta prochaine réponse
accompagné d'un nouveau rapport hijackthis pour analyse ...

Maxmax74 · Answer

-----------\  ToolBar S&D 1.2.4   XP/Vista

   Microsoft® Windows Vista™ Édition Familiale Premium  ( v6.0.6001 ) Service Pack 1
   X86-based PC ( Multiprocessor Free : AMD Turion(tm) 64 X2 Mobile Technology TL-60 )
   BIOS : Version 1.0
   USER : FNAC ( Administrator )
   BOOT : Normal boot
   Antivirus : Bitdefender Antivirus 8.0 (Activated)
   Firewall  : Bitdefender Firewall 8.0 (Activated)
   C:\ (Local Disk) - NTFS - Total:224 Go (Free:184 Go)
   D:\ (Local Disk) - NTFS - Total:232 Go (Free:227 Go)
   E:\ (CD or DVD)
   F:\ (CD or DVD)
   G:\ (CD or DVD)

   "C:\ToolBar SD" ( MAJ : 27-10-2008|09:25 )
   Option : [2] ( 11/11/2008|14:53 )

   [ UAC => 1 ]

   -----------\ SUPPRESSION

   Supprime! - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\FirefoxDTT
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\Resources
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\uninst.exe
   Supprime! - C:\Program Files\DAEMON Tools Toolbar\_DTLite.xml
   Supprime! - C:\Program Files\DAEMON Tools Toolbar

   -----------\  Recherche de Fichiers / Dossiers ...


   -----------\  [..\Internet Explorer\Main]

   [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
   "Local Page"="C:\Windows\system32\blank.htm"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Start Page"="http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART"
   "Url"="https://www.msn.com/fr-fr/actualite/"

   [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
   "Start Page"="https://www.msn.com/fr-fr/"
   "Default_Page_URL"="https://www.msn.com/fr-fr/?ocid=iehp"
   "Default_Search_URL"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"
   "Search Page"="https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF"


   --------------------\  Recherche d'autres infections

   --------------------\  Cracks & Keygens ..

   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\ Need for Speed Underground 2 crack-serial-keygen (2).lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\ Need for Speed Underground 2 crack-serial-keygen.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\( PC GAME) NEED FOR SPEED UNDERGROUND 2 full game cd1+cd2+crack.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\Crack + Keygen.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\crack00.dat.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\Need for Speed Underground 2 crack-serial-keygen.exe.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\need for speed underground 2 crack.lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\need for speed underground 2 keygen [ssg] (2).lnk
   C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\need for speed underground 2 keygen [ssg].lnk


   [ UAC => 1 ]


   1 - "C:\ToolBar SD\TB_1.txt" - 11/11/2008|14:45 - Option : [1]
   2 - "C:\ToolBar SD\TB_2.txt" - 11/11/2008|14:54 - Option : [2]

   -----------\  Fin du rapport a 14:54:51,10

Utilisateur anonyme · Answer

Re,

Fait moi un nouveau hijackthis.

merci

Maxmax74 · Answer

pour info, la fenêtre disant qu'il y a un spyware revient encore.



 Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:02:57, on 11/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\System32\wsqmcons.exe
C:\Windows\system32\conime.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\FNAC\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll (file missing)
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [winlogone] "C:\Users\FNAC\AppData\Roaming\Google\visfdw.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\System32\csrsrv32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

Utilisateur anonyme · Answer

Re,

Combofix. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...

Fais exactement ce qui suit :



Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !) :
Fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " : dans la fenêtre qui s'ouvre tape C-Fix, choisis le bureau comme destination et valide : 

--------------------------------------------- [ ! ATTENTION ! ] ----------------------------------------------------------
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation (si jamais tu en as et que je ne les ai pas vu sur le rapport hijackthis....)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre...

Tuto ici : TUTO
---------------------------------------------------------------------------------------------------------------------------------

Ensuite :

Double-clique sur C-Fix.exe (= combofix.exe ) .

Appuie sur une touche pour démarrer le scan .

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

Maxmax74 · Answer

ComboFix 08-11-10.01 - FNAC 2008-11-11 15:31:56.1 - NTFSx86 Microsoft® Windows Vista™ Édition Familiale Premium 6.0.6001.1.1252.1.1036.18.996 [GMT 1:00] Lancé depuis: c:\users\FNAC\Desktop\C-Fix.exe * Un nouveau point de restauration a été créé . ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-11 au 2008-11-11 )))))))))))))))))))))))))))))))))))) . 2008-11-11 14:44 . 2008-11-11 14:54 d-------- C:\ToolBar SD 2008-11-11 14:44 . 2008-11-11 14:44 268 --ah----- C:\sqmdata00.sqm 2008-11-11 14:44 . 2008-11-11 14:44 244 --ah----- C:\sqmnoopt00.sqm 2008-11-11 13:53 . 2008-11-11 13:53 d-------- C:\PerfLogs 2008-11-11 11:09 . 2008-11-11 12:52 d-a------ c:\users\All Users\TEMP 2008-11-11 11:09 . 2008-11-11 12:52 d-a------ c:\progra~2\TEMP 2008-11-09 19:53 . 2008-11-09 20:44 d-------- c:\users\All Users\Spybot - Search & Destroy 2008-11-09 19:53 . 2008-11-09 19:54 d-------- c:\program files\Spybot - Search & Destroy 2008-11-09 19:53 . 2008-11-09 20:44 d-------- c:\progra~2\Spybot - Search & Destroy 2008-11-09 19:33 . 2008-11-11 15:35 81,984 --a------ c:\windows\System32\bdod.bin 2008-11-09 14:57 . 2008-11-09 14:57 d-------- c:\users\FNAC\AppData\Roaming\BitDefender 2008-11-09 14:56 . 2008-11-09 14:57 d-------- c:\users\All Users\BitDefender 2008-11-09 14:56 . 2008-11-09 14:56 d-------- c:\program files\BitDefender 2008-11-09 14:56 . 2008-11-09 14:57 d-------- c:\progra~2\BitDefender 2008-11-09 14:37 . 2008-11-09 14:56 d-------- c:\program files\Common Files\BitDefender 2008-11-09 02:22 . 2008-11-09 02:22 d-------- c:\program files\EA GAMES 2008-11-08 16:20 . 2008-11-08 17:06 d-------- c:\program files\uTorrent 2008-11-08 16:19 . 2008-11-09 02:15 d-------- c:\users\FNAC\AppData\Roaming\uTorrent 2008-11-08 09:07 . 2008-11-08 11:46 d-------- c:\users\FNAC\AppData\Roaming\LimeWire 2008-11-08 09:07 . 2008-11-08 09:06 410,976 --a------ c:\windows\System32\deploytk.dll 2008-11-08 09:06 . 2008-11-08 09:06 d-------- c:\program files\Java 2008-11-07 23:55 . 2008-11-07 23:55 d-------- c:\program files\DAEMON Tools Lite 2008-11-07 23:51 . 2008-11-08 16:33 d-------- c:\users\FNAC\AppData\Roaming\DAEMON Tools 2008-11-07 23:51 . 2008-11-07 23:51 717,296 --a------ c:\windows\System32\drivers\sptd.sys 2008-11-07 23:49 . 2008-11-07 23:50 d-------- c:\program files\LimeWire 2008-11-02 19:07 . 2008-08-05 10:49 428,544 --a------ c:\windows\System32\EncDec.dll 2008-11-02 19:07 . 2008-08-05 10:49 293,376 --a------ c:\windows\System32\psisdecd.dll 2008-11-02 19:07 . 2008-08-05 10:48 217,088 --a------ c:\windows\System32\psisrndr.ax 2008-11-02 19:07 . 2008-08-05 10:48 177,664 --a------ c:\windows\System32\mpg2splt.ax 2008-11-02 19:07 . 2008-08-05 10:48 80,896 --a------ c:\windows\System32\MSNP.ax 2008-11-01 15:33 . 2008-11-08 10:31 246,671,587 --a------ c:\windows\MEMORY.DMP 2008-10-30 09:54 . 2008-10-30 10:25 d-------- c:\program files\DofusBeta 2008-10-30 09:52 . 2008-10-31 22:42 d-------- c:\program files\Wakfu 2008-10-29 21:06 . 2008-11-08 10:56 d-------- c:\users\All Users\eMule 2008-10-29 21:06 . 2008-11-08 10:56 d-------- c:\progra~2\eMule 2008-10-29 20:49 . 2008-11-08 10:56 d-------- c:\program files\eMule 2008-10-29 14:59 . 2008-08-12 04:39 443,392 --a------ c:\windows\System32\win32spl.dll 2008-10-29 14:59 . 2008-01-19 08:36 37,888 --a------ c:\windows\System32\printcom.dll 2008-10-29 11:19 . 2008-10-29 11:20 d-------- c:\program files\Safari 2008-10-25 08:24 . 2008-01-19 08:33 2,623,488 --a------ c:\windows\System32\SLsvc.exe 2008-10-25 08:24 . 2008-01-19 08:33 2,091,520 --a------ c:\windows\System32\dfsr.exe 2008-10-25 08:24 . 2008-01-19 08:36 1,541,120 --a------ c:\windows\System32\onex.dll 2008-10-25 08:24 . 2008-01-19 08:29 705,536 --a------ c:\windows\System32\imagesp1.dll 2008-10-25 08:24 . 2008-01-19 05:10 681,984 --a------ c:\windows\System32\drivers\spsys.sys 2008-10-25 08:24 . 2008-01-19 08:42 51,768 --a------ c:\windows\System32\PSHED.DLL 2008-10-25 08:22 . 2008-01-19 08:33 8,139,264 --a------ c:\windows\System32\ssBranded.scr 2008-10-25 08:21 . 2008-01-19 08:35 3,072,000 --a------ c:\windows\System32 etworkmap.dll 2008-10-25 08:20 . 2008-01-19 08:34 6,103,040 --a------ c:\windows\System32\chtbrkr.dll 2008-10-25 08:19 . 2008-01-19 07:06 8,147,456 --a------ c:\windows\System32\wmploc.DLL 2008-10-25 07:48 . 2008-01-19 08:36 357,888 --a------ c:\windows\System32\wbemcomn.dll 2008-10-25 07:47 . 2008-01-19 08:36 704,512 --a------ c:\windows\System32\SmiEngine.dll 2008-10-25 07:47 . 2008-01-19 08:36 218,624 --a------ c:\windows\System32\wdscore.dll 2008-10-25 07:47 . 2008-01-19 08:36 139,264 --a------ c:\windows\System32\SmiInstaller.dll 2008-10-25 07:47 . 2008-01-19 08:33 130,560 --a------ c:\windows\System32\PkgMgr.exe 2008-10-25 07:47 . 2008-01-19 08:36 129,536 --a------ c:\windows\System32\sqmapi.dll 2008-10-25 07:46 . 2008-01-19 08:34 305,152 --a------ c:\windows\System32\msdelta.dll 2008-10-25 07:46 . 2008-01-19 08:34 258,560 --a------ c:\windows\System32\dpx.dll 2008-10-25 07:46 . 2008-01-19 08:34 246,784 --a------ c:\windows\System32\drvstore.dll 2008-10-25 07:46 . 2008-01-19 08:35 35,328 --a------ c:\windows\System32\mspatcha.dll 2008-10-20 17:08 . 2008-10-20 17:10 d-------- c:\program files\EA SPORTS 2008-10-18 19:05 . 2008-09-18 03:16 2,032,640 --a------ c:\windows\System32\win32k.sys 2008-10-18 19:05 . 2008-08-27 02:06 288,768 --a------ c:\windows\System32\drivers\srv.sys 2008-10-18 19:02 . 2008-09-18 06:09 3,601,464 --a------ c:\windows\System32 tkrnlpa.exe 2008-10-18 19:02 . 2008-09-18 06:09 3,549,240 --a------ c:\windows\System32 toskrnl.exe 2008-10-18 19:01 . 2008-10-02 02:32 1,383,424 --a------ c:\windows\System32\mshtml.tlb 2008-10-18 19:01 . 2008-10-02 04:49 827,392 --a------ c:\windows\System32\wininet.dll 2008-10-14 22:21 . 2003-09-12 08:44 11,376 --a------ c:\windows\System32\drivers\SECDRV.SYS 2008-10-14 16:19 . 2008-11-08 16:33 d-------- c:\users\FNAC\AppData\Roaming\BitZipper 2008-10-14 16:14 . 2008-10-14 16:14 287 --a------ c:\windows\game.ini 2008-10-14 16:05 . 2008-10-14 16:05 d-------- c:\program files\Activision 2008-10-13 19:39 . 2008-11-11 13:37 27,240 --a------ c:\users\FNAC\AppData\Roaming vModes.dat 2008-10-12 13:11 . 2008-10-12 13:11 d-------- c:\users\All Users\Messenger Plus! 2008-10-12 13:11 . 2008-10-12 13:11 d-------- c:\progra~2\Messenger Plus! 2008-10-12 10:59 . 2008-11-08 16:33 d-------- c:\users\FNAC\AppData\Roaming\Apple Computer 2008-10-12 10:58 . 2008-10-12 10:58 d-------- c:\program files\iTunes 2008-10-12 10:58 . 2008-10-12 10:58 d-------- c:\program files\iPod 2008-10-12 10:56 . 2008-10-12 10:56 d-------- c:\program files\Bonjour 2008-10-12 10:51 . 2008-10-12 10:58 d-------- c:\users\All Users\Apple Computer 2008-10-12 10:51 . 2008-10-12 10:55 d-------- c:\program files\QuickTime 2008-10-12 10:51 . 2008-10-12 10:58 d-------- c:\progra~2\Apple Computer 2008-10-12 10:47 . 2008-10-12 10:47 d-------- c:\program files\Apple Software Update 2008-10-12 10:42 . 2008-10-12 10:42 d-------- c:\users\All Users\Apple 2008-10-12 10:42 . 2008-10-12 10:52 d-------- c:\program files\Common Files\Apple 2008-10-12 10:42 . 2008-10-12 10:42 d-------- c:\progra~2\Apple 2008-10-12 10:33 . 2008-10-12 10:33 d-------- c:\program files\Messenger Plus! Live 2008-10-11 23:32 . 2008-01-19 08:34 15,872 --a------ c:\windows\System32\hcrstco.dll 2008-10-11 23:32 . 2006-11-02 10:46 8,704 --a------ c:\windows\System32\hccoin.dll 2008-10-11 23:29 . 2008-10-11 23:29 9,847,296 --a------ c:\windows\System32\NlsData000a.dll 2008-10-11 23:22 . 2008-10-11 23:22 69,632 --a------ c:\windows\System32\Mpeg2Data.ax 2008-10-11 23:22 . 2008-10-11 23:22 57,856 --a------ c:\windows\System32\MSDvbNP.ax 2008-10-11 21:42 . 2008-10-11 21:56 d-------- c:\program files\Windows Live 2008-10-11 21:42 . 2008-10-11 21:56 d--hsc--- c:\program files\Common Files\WindowsLiveInstaller 2008-10-11 21:41 . 2008-10-11 21:41 d-------- c:\users\All Users\WLInstaller 2008-10-11 21:41 . 2008-10-11 21:41 d-------- c:\progra~2\WLInstaller 2008-10-11 20:34 . 2008-10-19 08:28 d-------- c:\users\FNAC\AppData\Roaming\Skype 2008-10-11 18:40 . 2008-10-11 18:40 361,984 --a------ c:\windows\System32\IPSECSVC.DLL 2008-10-11 18:40 . 2008-10-11 18:40 272,896 --a------ c:\windows\System32\polstore.dll 2008-10-11 18:40 . 2008-10-11 18:40 61,440 --a------ c:\windows\System32\winipsec.dll 2008-10-11 18:40 . 2008-10-11 18:40 28,672 --a------ c:\windows\System32\FwRemoteSvr.dll 2008-10-11 18:38 . 2008-10-11 18:38 269,312 --a------ c:\windows\System32\es.dll 2008-10-11 18:32 . 2008-10-11 18:32 988,216 --a------ c:\windows\System32\winload.exe 2008-10-11 18:32 . 2008-10-11 18:32 927,288 --a------ c:\windows\System32\winresume.exe 2008-10-11 18:32 . 2008-10-11 18:32 615,992 --a------ c:\windows\System32\ci.dll 2008-10-11 18:32 . 2008-10-11 18:32 378,368 --a------ c:\windows\System32\srcore.dll 2008-10-11 18:32 . 2008-10-11 18:32 318,464 --a------ c:\windows\System32 strui.exe 2008-10-11 18:32 . 2008-10-11 18:32 46,592 --a------ c:\windows\System32\setbcdlocale.dll 2008-10-11 18:32 . 2008-10-11 18:32 40,960 --a------ c:\windows\System32\srclient.dll 2008-10-11 18:32 . 2008-10-11 18:32 19,000 --a------ c:\windows\System32\kd1394.dll 2008-10-11 18:32 . 2008-10-11 18:32 14,848 --a------ c:\windows\System32\srdelayed.exe 2008-10-11 18:32 . 2008-10-11 18:32 6,656 --a------ c:\windows\System32\kbd106n.dll 2008-10-11 18:28 . 2008-10-11 18:28 d-------- c:\program files\MSXML 4.0 2008-10-11 16:32 . 2008-10-11 16:32 d----c--- c:\windows\System32\DRVSTORE 2008-10-11 16:32 . 2008-10-11 16:32 d-------- c:\users\All Users\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-11 16:32 . 2008-10-11 16:32 d-------- c:\progra~2\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-10-11 16:32 . 2008-04-17 12:12 107,368 --a------ c:\windows\System32\GEARAspi.dll 2008-10-11 16:32 . 2008-04-17 12:12 15,464 --a------ c:\windows\System32\drivers\GEARAspiWDM.sys 2008-10-11 15:20 . 2008-10-13 20:07 d-------- c:\users\All Users\TrackMania 2008-10-11 15:20 . 2008-10-13 20:07 d-------- c:\progra~2\TrackMania 2008-10-11 15:03 . 2008-10-11 15:03 4,240,384 --a------ c:\windows\System32\GameUXLegacyGDFs.dll 2008-10-11 15:03 . 2008-10-11 15:03 1,695,744 --a------ c:\windows\System32\gameux.dll 2008-10-11 15:03 . 2008-10-11 15:03 28,160 --a------ c:\windows\System32\Apphlpdm.dll 2008-10-11 15:01 . 2008-10-11 15:01 303,616 --a------ c:\windows\System32\wmpeffects.dll 2008-10-11 15:01 . 2008-10-11 15:01 2,048 --a------ c:\windows\System32 zres.dll 2008-10-11 14:58 . 2008-10-11 14:58 295,936 --a------ c:\windows\System32\gdi32.dll 2008-10-11 14:58 . 2008-10-11 14:58 113,664 --a------ c:\windows\System32\drivers mcast.sys . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-11 13:07 174 --sha-w c:\program files\desktop.ini 2008-11-11 12:56 --------- d-----w c:\program files\Windows Sidebar 2008-11-11 12:56 --------- d-----w c:\program files\Windows Photo Gallery 2008-11-11 12:56 --------- d-----w c:\program files\Windows Mail 2008-11-11 12:56 --------- d-----w c:\program files\Windows Journal 2008-11-11 12:56 --------- d-----w c:\program files\Windows Defender 2008-11-11 12:56 --------- d-----w c:\program files\Windows Collaboration 2008-11-11 12:56 --------- d-----w c:\program files\Windows Calendar 2008-11-11 12:51 --------- d-----w c:\progra~2\NVIDIA 2008-11-11 10:00 82,432 ----a-w c:\windows\System32\axaltocm.dll 2008-11-11 10:00 101,888 ----a-w c:\windows\System32\ifxcardm.dll 2008-11-09 13:59 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-11-09 13:59 --------- d-----w c:\progra~2\Symantec 2008-11-09 13:42 --------- d-----w c:\program files\Symantec 2008-11-09 13:42 --------- d-----w c:\program files\Norton 360 2008-11-08 15:33 --------- d-----w c:\users\FNAC\AppData\Roaming\CyberLink 2008-10-18 18:50 --------- d-----w c:\progra~2\Microsoft Help 2008-10-14 21:09 --------- d-----w c:\program files\Microsoft Games 2008-10-14 15:16 --------- d--h--w c:\program files\InstallShield Installation Information 2008-10-11 22:29 801,280 ----a-w c:\windows\System32\NaturalLanguage6.dll 2008-10-11 14:03 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll 2008-10-11 14:03 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll 2008-10-11 14:03 2,560 ----a-w c:\windows\AppPatch\AcRes.dll 2008-10-11 14:03 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll 2008-10-11 14:03 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll 2008-10-11 13:28 --------- d-----w c:\program files\Common Files\Adobe 2008-10-11 11:37 --------- d-----w c:\progra~2\Sonic 2008-10-11 11:36 --------- d-----w c:\program files\Google 2008-10-11 10:51 --------- d-----w c:\users\FNAC\AppData\Roaming\Packard Bell 2008-10-01 11:01 32,000 ----a-w c:\windows\system32\drivers\usbaapl.sys 2008-09-25 10:55 --------- d-----w c:\program files\Camera Assistant Software Lite 2008-08-29 08:18 87,336 ----a-w c:\windows\System32\dns-sd.exe 2008-08-29 07:53 61,440 ----a-w c:\windows\System32\dnssd.dll . ((((((((((((((((((((((((((((((((( Points de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920] "Steam"="c:\program files\Steam\Steam.exe" [2008-10-11 1410296] "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-07-24 490952] "winlogone"="c:\users\FNAC\AppData\Roaming\Google\visfdw.exe" [2008-11-08 104960] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-09 845360] "CardReaderMonitor"="c:\program files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe" [2007-07-25 643072] "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-01-11 232184] "MSPService"="c:\program files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe" [2007-06-12 102400] "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-02-21 366400] "toolbar_eula_launcher"="c:\program files\Packard Bell\GOOGLE_EULA\EULALauncher.exe" [2007-02-20 28672] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-08 136600] "BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 61440] "BDAgent"="c:\program files\BitDefender\BitDefender 2008\bdagent.exe" [2008-11-09 368640] "Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 c:\windows\KHALMNPR.Exe] c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\ Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-10-11 805392] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "FilterAdministratorToken"= 1 (0x1) "EnableUIADesktopToggle"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\System32\csrsrv32.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.mkdmp3enc"= c:\progra~1\CYBERL~1\MAGICS~1\Kernel\Burner\MKDMP3Enc.ACM [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{12459AED-4379-463E-8D1F-4971D62CDD0E}"= c:\program files\CyberLink\MagicSports\MagicSports.exe:CyberLink MagicSports "{2F727BB2-9FEC-4CF1-82EE-BB6050F43963}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{D9ED3585-62EB-436B-9390-463BB8130B41}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote "{CA7D829C-6688-4221-993B-47F160D041AD}"= c:\program files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone) "{FB44F911-9C81-4858-AEDC-A616D40D6CD3}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{5891F6E4-88FA-4204-8F22-FF38022D1A28}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour "{776E4382-967A-42BA-B93A-8F61EA746BF9}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes "{0D5ED70C-CDD0-409E-9CFE-57DA9E86EF20}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes "{BB44AEB9-A148-4CD7-9EFC-82372AB800FC}"= UDP:c:\program files\eMule\emule.exe:eMule "{B7CBE4B3-8416-4B40-A642-5BD96F5F9E86}"= TCP:c:\program files\eMule\emule.exe:eMule "{147A368D-0948-463B-AF62-C3F007498A8B}"= UDP:c:\program files\Dofus\UpLauncher.exe:Dofus "{7029A331-82B1-42ED-84F8-FC6FC5611D25}"= TCP:c:\program files\Dofus\UpLauncher.exe:Dofus "{EA344197-091E-4C68-96DB-97295618844D}"= UDP:c:\program files\Wakfu\UpLauncher.exe:Wakfu "{CD022EB2-383C-49DA-9AE7-7CD230C51524}"= TCP:c:\program files\Wakfu\UpLauncher.exe:Wakfu "{B4D215DE-AD48-4D8D-9CB5-EC2D667E92BB}"= UDP:4711:eMule_TCP "{70F12CE1-F786-4515-88C8-1C044DDA42B8}"= TCP:4672:eMule_UDP "{F79625B3-EEE8-408C-A6A0-7E05439122E3}"= UDP:30470:eMule_TCP "{14A7C29F-E449-427B-88CA-E6D414345C7A}"= TCP:4507:eMule_UDP "TCP Query User{1F7B0232-BA17-4F7A-B791-958C3F15A84C}c:\program files\limewire\limewire.exe"= UDP:c:\program files\limewire\limewire.exe:LimeWire "UDP Query User{F9A94EAD-9397-4B55-A95A-58D3DCBE4EA9}c:\program files\limewire\limewire.exe"= TCP:c:\program files\limewire\limewire.exe:LimeWire "{F4093C10-7CB5-41B6-8CC6-CEF753502088}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In) "{CA9A4F3E-4E0E-405E-A579-1E9BF792F661}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In) "TCP Query User{4872FC0D-B680-4DB3-81F5-277807D46587}c:\users\fnac\desktop\utorrent.exe"= UDP:c:\users\fnac\desktop\utorrent.exe:utorrent.exe "UDP Query User{3DA8E85D-9B9B-42FB-BE43-367C081BCA32}c:\users\fnac\desktop\utorrent.exe"= TCP:c:\users\fnac\desktop\utorrent.exe:utorrent.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile] "EnableFirewall"= 0 (0x0) R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\DRIVERS\bdfndisf.sys [2008-06-02 86792] R3 RTL8187B;Realtek RTL8187B Wireless 802.11b/g 54Mbps USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-10-05 288256] R3 RTSTOR;USB Mass Storage Device;c:\windows\system32\drivers\RTSTOR.SYS [2007-06-15 47616] R3 vm331avs;Bison Webcam;c:\windows\system32\Drivers\vm331avs.sys [2007-09-07 943016] S3 Steam Client Service;Steam Client Service;c:\program files\Common Files\Steam\SteamService.exe [2008-10-11 87288] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] bdx REG_MULTI_SZ scan [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] \shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{903e5fd9-9a04-11dd-948b-00140b402e67}] \shell\AutoRun\command - G:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3b786bc-ad77-11dd-8980-00140b402e67}] \shell\AutoRun\command - F:\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d3b786bd-ad77-11dd-8980-00140b402e67}] \shell\AutoRun\command - G:\RunGame.exe *Newly Created Service* - PROCEXP90 . . ------- Examen supplémentaire ------- . FireFox -: Profile - c:\users\FNAC\AppData\Roaming\Mozilla\Firefox\Profiles onxmbds.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.fr/firefox . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 15:35:01 Windows 6.0.6001 Service Pack 1 NTFS Recherche de processus cachés ... Recherche d'éléments en démarrage automatique cachés ... Recherche de fichiers cachés ... ************************************************************************** . --------------------- DLLs chargées dans les processus actifs --------------------- PROCESSUS: c:\windows\Explorer.exe -> c:\users\FNAC\AppData\Roaming\Google\ovlfwl.dll . Heure de fin: 2008-11-11 15:37:50 ComboFix-quarantined-files.txt 2008-11-11 14:36:41 Avant-CF: 197,201,420,288 octets libres Après-CF: 197,238,169,600 octets libres 286 --- E O F --- 2008-11-11 10:07:37

Utilisateur anonyme · Answer

Re,

-Télécharge et installe MalwareByte's Anti-Malware
Malwarebyte

- Mets le à jour

---
- Double clique sur le raccourci de MalwareByte's Anti-Malware qui est sur le bureau.
- Sélectionne Exécuter un examen complet si ce n'est pas déjà fait
- clique sur Rechercher

- Une fois le scan terminé, une fenêtre s'ouvre, clique sur sur Ok

- Si MalwareByte's n'a rien détecté, clique sur Ok Un rapport va apparaître ferme-le.

- Si MalwareByte's a détecté des infections, clique sur Afficher les résultats ensuite sur Supprimer la sélection

- Enregistre le rapport sur ton Bureau comme cela il sera plus facile à retrouver, poste ensuite ce rapport.

Note : Si MalwareByte's a besoin de redémarrer pour terminer la suppression, accepte en cliquant sur Ok

Tutoriel pour MalwareByte's

Maxmax74 · Answer

Malwarebytes' Anti-Malware 1.30
Version de la base de données: 1383
Windows 6.0.6001 Service Pack 1

11/11/2008 17:27:14
mbam-log-2008-11-11 (17-27-14).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 159320
Temps écoulé: 1 hour(s), 38 minute(s), 53 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winlogone (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Users\FNAC\AppData\Roaming\Google\visfdw.exe (Trojan.FakeAlert) -> Delete on reboot.

Utilisateur anonyme · Answer

Re,

Alors redemarre ton pc ce n'est pâs encore fait et ensuite tu me refait un hijackthis.

merci

Maxmax74 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:55:40, on 11/11/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32	askeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Realtek Semiconductor Corp\Realtek Card Reader Monitor\CardReaderMonitor.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Adobe\Reader 8.0\Readereader_sl.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Windows\system32\wuauclt.exe
C:\Users\FNAC\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://format.packardbell.com/cgi-bin/redirect/?country=FR&range=AD&phase=8&key=IESTART
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: ::1 localhost
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Google\Google_BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [CardReaderMonitor] C:\Program Files\Realtek Semiconductor Corp.\Realtek Card Reader Monitor\CardReaderMonitor.exe
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [MSPService] C:\Program Files\CyberLink\MagicSports\Kernel\MagicSports\MSPMirage.exe
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\Packard Bell\GOOGLE_EULA\EULALauncher.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: &Envoyer à OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - cmdmapping - (no file) (HKCU)
O13 - Gopher Prefix: 
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\Windows\System32\csrsrv32.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

Maxmax74 · Answer

La fenêtre n'est toujours pas revenu; il semblerai que la menace soir éradiquées :)
De tout c'est programme, lesquels puis-je supprimer :
Hijackthis
ToolbarSD
Malwarebytes
C-fix

Merci beaucoup =)

Utilisateur anonyme · Answer

Re,

Pour supprimer toutes les traces des logiciels qui ont servi à traiter les infections spécifiques 

Télécharge toolscleaner sur ton Bureau : 

toolscleaner

* Double-clique sur ToolsCleaner2.exe et laisse le travailler 
* Clique sur Recherche et laisse le scan se terminer. 
* Clique sur Suppression pour finaliser. 
* Tu peux, si tu le souhaites, te servir des Options facultatives. 
* Clique sur Quitter, pour que le rapport puisse se créer. 
* Le rapport (TCleaner.txt) se trouve à la racine de votre disque dur (C:\)...colle le dans ta réponse

Tutoriel toolscleaner

Désactive et réactive la Restauration du système :
 
1 Dans la barre des tâches de Windows, clique sur Démarrer.
 
2 Clique avec le bouton droit de la souris sur Poste de travail puis clique sur Propriétés.
 
3 Dans l'onglet Restauration du système, coche "Désactiver la Restauration du système"

4 Clique sur Appliquer.
  
5 Ensuite décoche "Désactiver la restauration du systeme"

6 clique sur appliquer puis ok

7 vas créer un point de restauration dans accessoires----outils systeme----restauration du systeme.

Maxmax74 · Answer

[ Rapport ToolsCleaner version 2.2.6 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\Combofix.txt: trouvé !
C:\TB.txt: trouvé !
C:\Qoobox: trouvé !
C:\Toolbar SD: trouvé !
C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\HijackThis.lnk: trouvé !
C:\Users\FNAC\Desktop\HijackThis.exe: trouvé !
C:\Users\FNAC\Desktop\ToolBarSD.exe: trouvé !
C:\Users\FNAC\Documents\hijackthis.log: trouvé !

---------------------------------
-->- Suppression: 

C:\Users\FNAC\AppData\Roaming\Microsoft\Windows\Recent\HijackThis.lnk: supprimé !
C:\Users\FNAC\Desktop\HijackThis.exe: supprimé !
C:\Users\FNAC\Desktop\ToolBarSD.exe: supprimé !
C:\Combofix.txt: supprimé !
C:\TB.txt: supprimé !
C:\Users\FNAC\Documents\hijackthis.log: supprimé !
C:\Qoobox: supprimé !
C:\Toolbar SD: supprimé !



Je trouve pas où désactiver la restauration du système
rappel : je suis sous vista ...

Utilisateur anonyme · Answer

Re,

regarde ici

Bonne soirée.

@+

Maxmax74 · Answer

Merci!!!
a+

Maxmax74 · Answer

J'ai un ptit problème maintenant: 
J'ai un jeu craké (je sais, c'est pas bien ^-^) mais je suis pas le seul.
Enfin voila, j'utilise daemon tools lite pour le faire marcher et depuis, j'arrive plus à lancer le jeu.
Les images des CDs sont bien construites.
Quand je double clik sur l'iconne, sa me met directement "nom_du_jeu" a cessé de fonctionner.
Comment le refaire marcher svp?

Virus Personnal Defender 2009

18 réponses

Discussions similaires