HELP !!!i nfecté par des virus msn Fermé

Question

Bonjour,
j'ai reçu hier un message sur msn et j'ai cliquer par erreur, sur le message venant d'un contact, j'ai cliquer sur" foto facebooky...." j'ai été infectée par plein de virus, cheval de troie.J'ai avast qui a mis en quarantaine des virus mais je n'arrive pas à m'en débarrasser. Tout fonctionne sur l'ordinateur, mais il y a toujours des alertes de virus quand je scan avec avastl; j'ai même fait un scan avec secuser, n'a rien trouvé,mais j'ai encore des alertes. j'ai supprimé msn pour le moment, et j'ai lu les commentaires liés aux virus d'hier et d'aujourdhui ,mais je n'arrive pas à m'en sortir. j'ai trouvé: Win 32:Rbot-GJB[Trj] mais aussi win32 : Agent -XMJ[spy] et win32: Adware-gen[Asw] et j'en ai surement d'autres, ils sont en quarantaine mais ils réapparaissent encore.
svp aidez moi, je suis démunie...merci d'avance pour votre aide.

angeome · Answer

https://ads.adextrem.com/delivery/directlink.php?slot=10907&tracker1=msntrucastuce.fr

telecharge le 2eme programme jesper que ca pourra t'aider

snoopie · Answer

merci d'avoir poster une réponse... merci.je suis en train de faire l'analyse antivirus msn...vais je m'en débarasser?

snoopie · Answer

Je ne m'y connais pas en informatique et ça fait 9h que j'essaie de me débarrasser de mes virus.Alors j'ai utilisé "cleanvirus "comme me l'a conseillé angeome , il n'y avait pas de virus mais pourtant des virus étaient toujours présents. j'ai alors été regarder un peu partout sur les forums et j'ai telechargé MSNFix à partir du lien : 

http://sosvirus.changelog.fr/MSNFix.zip 

j'ai suivi l'aide de

 https://www.malekal.com/supprimer-virus-desinfecter-pc/

j'ai fait comme ils ont dit. au début c'était infecté avec fenètre rouge, j'ai redemarré l'ordinateur et relancé l'analyse tout comme ils disent. 
depuis j'ai refait l'analyse 2 fois et rien ne semble infecté. 

essaie, je pense que c'est bien de faire ça, j'espère avoir réussi!
en fait je ne m'y connais pas assez pour en être certaine

quelqu'un de connaisseur pourrait-il nous confirmer que c'est la bonne solution pour que l'on puisse arriver à bout des virus

merci

snoopie · Answer

j'ai effectué un scan avec malwarebytes. des fichiers étaient infectés, j'ai supprimés
voici le rapport:
pouvez vous m'aidez?

alwarebytes' Anti-Malware 1.31
Version de la base de données: 1504
Windows 5.1.2600 Service Pack 2

16/12/2008 02:41:44
mbam-log-2008-12-16 (02-41-44).txt

Type de recherche: Examen complet (A:\|C:\|E:\|F:\|I:\|J:\|)
Eléments examinés: 112899
Temps écoulé: 27 minute(s), 4 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 21
Valeur(s) du Registre infectée(s): 1
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 13
Fichier(s) infecté(s): 17

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\funwebproductsinstaller.start (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\funwebproductsinstaller.start.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.htmlpanel.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\mywebsearch.pseudotransparentplugin.1 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{147a976f-eee1-4377-8ea7-4716e4cdd239} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{a4730ebe-43a6-443e-9776-36915d323ad3} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{7e66936c-fea0-4984-ad26-7b6661ac5b2e} (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\ISTsvc (Adware.ISTBar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\&Search\ (Adware.Hotbar) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\101x135 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\PopSwatr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\PopSwatr\History (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Installr\4.bin (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\settings.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\settings.dat.bak (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\settings.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History\search (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\MyWebSearch\bar\History\search2 (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\00415A3A.urr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\00AAAD87.urr (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\wrkparam.lst (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\00AC056C.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\0010767F.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\ScreenSaver\Images\00110A7B.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\Shared\0047277D.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\PopSwatr\History
otallow (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Program Files\FunWebProducts\PopSwatr\History\allowed (Adware.MyWebSearch) -> Quarantined and deleted successfully.

anthony5151 · Answer

Bonsoir,


Ce qui est détecté ici par MalwareBytes n'a pas de rapport avec l'infection msn, c'est une autre infection. MSNFix a t il réglé ton problème avec MSN ?  Peux-tu poster le rapport correspondant ?  (il a été enregistré dans le même dossier que MSNFix sous forme date_heure.txt )


Ensuite, fais ceci stp :

• Télécharge Random's System Information Tool (RSIT) de random/random, et enregistre le sur ton Bureau.
• Double clique sur RSIT.exe pour lancer l'outil.
• Clique sur ' continue ' à l'écran Disclaimer.
• Si l'outil HijackThis n'est pas présent ou non détecté sur l'ordinateur, RSIT le téléchargera (autorise l'accès dans ton pare-feu, si demandé) et tu devras accepter la licence.
• Une fois le scan terminé, deux rapports vont apparaitre. Poste le contenu de log.txt

snoopie · Answer

voici le résultat pour hijack

03:04 16/12/2008Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:04:27, on 16/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Documents and Settingsicox\Bureau\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
c:\Program Files\Numericable\Mon Assistant Internet\bin\mpbtn.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.free.fr/freebox/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer par NUMERICABLE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [divwin] divwin.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Documents and Settingsicox\Bureau\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: GStartup.lnk = C:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: Mon Assistant Internet.lnk = C:\Program Files\Numericable\Mon Assistant Internet\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5054F860-748D-4840-B7B4-DDDB428421AF} (phoneaccess Class) - http://ip.sponsoradulto.com/cab/4/fr/phoneaccess.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Environnement d'exécution Java 1.4.1_01) - 
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Environnement d'exécution Java 1.4.1_01) - 
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

snoopie · Answer

voici le résultat pour msn fix

[C:\WINDOWS\system32\winhlp32.exe] 577624F19D0441C9111F2AF26C81E04D
[C:\WINDOWS\system32\winmsd.exe] 7EBF8A4B608AFB79C67F4E4A9C5885BB
[C:\WINDOWS\system32\winspool.exe] 0B4B94B78123E8035B84105BC024F9F8
[C:\WINDOWS\system32\winver.exe] 9CD9DB5CCEE972A162C31239F16E0925
[C:\WINDOWS\system32\winlogon.exe] 123EEA158F74D0F67A51DCDF065D1091
[C:\WINDOWS\system32\winmine.exe] EA682C022F7204CC8E8C9EF5DCE29356
[C:\WINDOWS\system32\winchat.exe] 2A99260794224489F29B628717B7947E

snoopie · Answer

voici le rapport que tu m'as demandé avec ramdon sytem... voici le rapport log.txt


03:09 16/12/2008Logfile of random's system information tool 1.04 (written by random/random)
Run by ricox at 2008-12-16 03:07:48
Microsoft Windows XP Professionnel Service Pack 2
System drive C: has 619 MB (6%) free of 10 GB
Total RAM: 511 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:07:52, on 16/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Documents and Settingsicox\Bureau\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
c:\Program Files\Numericable\Mon Assistant Internet\bin\mpbtn.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settingsicox\Bureau\RSIT.exe
C:\Program Files\Trend Micro\HijackThisicox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.free.fr/freebox/index.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer par NUMERICABLE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [divwin] divwin.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\NUMERI~1\MONASS~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Documents and Settingsicox\Bureau\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: GStartup.lnk = C:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: Mon Assistant Internet.lnk = C:\Program Files\Numericable\Mon Assistant Internet\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5054F860-748D-4840-B7B4-DDDB428421AF} (phoneaccess Class) - http://ip.sponsoradulto.com/cab/4/fr/phoneaccess.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Environnement d'exécution Java 1.4.1_01) - 
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Environnement d'exécution Java 1.4.1_01) - 
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

anthony5151 · Answer

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau. 
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe 
Double clique sur SDFix.exe et choisis Install pour l'extraire dans un dossier dédié sur le Bureau. Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici : 
• Redémarre ton ordinateur 
• Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8 (une pression par seconde). 
• A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître. 
• Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée". 
• Choisis ton compte. 

• Puis, ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.bat pour lancer le script. 
• Appuie sur une touche pour commencer le processus de nettoyage. 
• Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer. 
• Appuie sur une touche pour redémarrer le PC. 
• Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers. 
• Après le chargement du Bureau, l'outil terminera son travail et affichera Finished. 
• Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau. 
• Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt : poste le sur le forum



Ensuite, télécharge et installe Malwarebytes' Anti-Malware
- A la fin de l'installation, veille à ce que l'option « mettre a jour Malwarebyte's Anti-Malware » soit cochée
- Lance MBAM et laisse les Mises à jour se télécharger (sinon fais les manuellement au lancement du programme)
- Puis va dans l'onglet "Recherche", coche "Exécuter un examen rapide" puis "Rechercher"
- Sélectionne tes disques durs" puis clique sur "Lancer l’examen" 
- A la fin du scan, clique sur Afficher les résultats
- Coche tous les éléments  détectés puis clique sur Supprimer la sélection
- Enregistre le rapport
- S'il t'est demandé de redémarrer, clique sur Yes

Poste le rapport de scan après la suppression ici

snoopie · Answer

Bonjour, alors je n'ai pas arrété aujourd'hui pour venir à bout de mes virus. En fait justement j'avais téléchargé malwarebytes. j'avais fait une analyse et j'avais des infections que j'ai éliminé.
depuis l'ordinateur n'a pas signalé de virus.

Je n'ai pas télecharger SDfix comme tu viens de me dire, car j'avais déjà telecharger malwarebytes et j'ai fais un scan directement. est ce que je devrai vraiment telecharger SDFix? 
je viens de refaire un scan rapide comme tu m'as dit: voici le rapport


Malwarebytes' Anti-Malware 1.31
Version de la base de données: 1504
Windows 5.1.2600 Service Pack 2

16/12/2008 19:39:43
mbam-log-2008-12-16 (19-39-43).txt

Type de recherche: Examen rapide
Eléments examinés: 49815
Temps écoulé: 5 minute(s), 16 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 0

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
(Aucun élément nuisible détecté)



est ce que ça veut dire que je ne n'ai plus de virus et j'en suis débarassée? 
que dois je faire de tous les logiciels que j'ai télechargé (malwarebytes, msnfix, cleanfix,hijackthis..) dois je les garder sur le bureau ou alors les désinstaller.
j'ai avast antivirus 
merci mille fois encore

anthony5151 · Answer

Re,

Désolé pour le délai de réponse.
Oui j'aimerais que tu fasses quand même le scan avec SDFix stp.
Ensuite, redémarre ton PC et poste un nouveau rapport hijackthis

snoopie · Answer

bonjour, merci bien c'est déjà bien gentil de m'aider

alors j'ia fait comme j'ai pu

voici le rapport du scan sdfix



[b]System Report[/b]
*************

Run on 19/12/2008 at 15:40

Microsoft Windows XP [version 5.1.2600]

Current user is an administrator

[b]Running Processes[/b]:

\SystemRoot\System32\smss.exe [424]
\??\C:\WINDOWS\system32\csrss.exe [492]
\??\C:\WINDOWS\system32\winlogon.exe [516]
C:\WINDOWS\system32\services.exe [560]
C:\WINDOWS\system32\lsass.exe [572]
C:\WINDOWS\system32\svchost.exe [724]
C:\WINDOWS\system32\svchost.exe [788]
C:\WINDOWS\System32\svchost.exe [856]
C:\WINDOWS\System32\svchost.exe [928]
C:\WINDOWS\System32\svchost.exe [1048]
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [1204]
C:\Program Files\Alwil Software\Avast4\ashServ.exe [1252]
C:\WINDOWS\system32\spoolsv.exe [1500]
C:\Program Files\Java\jre6\bin\jqs.exe [1696]
C:\WINDOWS\System32
vsvc32.exe [1740]
C:\WINDOWS\System32	cpsvcs.exe [1860]
C:\WINDOWS\System32\svchost.exe [1880]
C:\WINDOWS\System32\wdfmgr.exe [1916]
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [216]
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [352]
C:\WINDOWS\System32\alg.exe [732]
C:\WINDOWS\system32\wuauclt.exe [1380]
C:\WINDOWS\system32\WgaTray.exe [1124]
C:\WINDOWS\Explorer.EXE [1776]
C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe [2140]
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe [2148]
C:\WINDOWS\System32\LVCOMSX.EXE [2160]
C:\Program Files\Logitech\Video\LogiTray.exe [2168]
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe [2176]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2188]
C:\Program Files\Picasa2\PicasaMediaDetector.exe [2224]
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2264]
C:\Program Files\Java\jre6\bin\jusched.exe [2284]
F:\Reader\Reader_sl.exe [2336]
C:\Documents and Settingsicox\Bureau\Nokia PC Suite 7\PCSuite.exe [2372]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe [2380]
C:\WINDOWS\system32\ctfmon.exe [2404]
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2716]
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2724]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2860]
c:\Program Files\Numericable\Mon Assistant Internet\bin\mpbtn.exe [2964]
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe [3068]
C:\WINDOWS\system32\wuauclt.exe [3108]
C:\Program Files\Logitech\Video\FxSvr2.exe [3144]
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe [3340]
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [3720]
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe [3808]
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe [3836]
C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\update\update.exe [1460]


[b]Drivers - Running[/b]:

Aavmker4
ACPI
AFD
AmdK7
Aspi32
aswFsBlk
aswMon2
aswRdr
aswSP
aswTdi
atapi
audstub
Beep
Cdfs
Cdrom
cmuda
Disk
dmio
dmload
Fallback
Fastfat
Fdc
Fips
Flpydisk
FltMgr
Fsks
Ftdisk
gameenum
Gpc
HTTP
i8042prt
Imapi
IpNat
IPSec
isapnp
K56
Kbdclass
KSecDD
LVUSBSta
mnmdd
Mouclass
MountMgr
MRxDAV
MRxSmb
Msfs
mssmbios
ms_mpu401
Mup
NDIS
NdisTapi
Ndisuio
NdisWan
NDProxy
NetBIOS
NetBT
Npfs
Ntfs
Null
nv
Parport
PartMgr
ParVdm
PCI
PCIIde
PID_0928
PptpMiniport
PSched
Ptilink
PxHelp20
RasAcd
Rasl2tp
RasPppoe
Raspti
Rdbss
RDPCDD
rdpdr
redbook
serenum
Serial
sisagp
SISNIC
SoftFax
sr
Srv
swenum
sysaudio
Tcpip
TermDD
Tones
Update
usbhub
usbohci
V124
VgaSave
VolSnap
Wanarp
wdmaud


[b]Drivers - Stopped[/b]:

Abiosdsk
abp480n5
ACPIEC
ADILOADER
adiusbaw
adpu160m
aec
Aha154x
aic78u2
aic78xx
AliIde
amsint
asc
asc3350p
asc3550
ASCTRM
AsyncMac
Atdisk
Atmarpc
basic2
catchme
cbidf2k
CCDECODE
cd20xrnt
Cdaudio
Changer
CmdIde
Cpqarray
ctljystk
dac960nt
dmboot
DMusic
dpti2o
drmkaud
emu10k
emu10k1
hidgame
hpn
HPZid412
HPZipr12
HPZius12
HSFHWBS2
HSF_DP
hsf_msft
i2omgmt
i2omp
ini910u
IntelIde
ip6fw
IpFilterDriver
IpInIp
IRENUM
kmixer
lbrtfdc
Modem
MODEMCSA
mraid35x
MSKSSRV
MSPCLOCK
MSPQM
MSTEE
NABTSFEC
NdisIP
nmwcd
nmwcdc
NwlnkFlt
NwlnkFwd
pccsmcfd
PCIDump
Pcmcia
PDCOMP
PDFRAME
PDRELI
PDRFRAME
perc2
perc2hib
ql1080
Ql10wnt
ql12160
ql1240
ql1280
RDPWD
Rksample
Secdrv
Sfloppy
sfman
Simbad
SiS7012
SLIP
Sparrow
splitter
streamip
swmidi
symc810
symc8xx
sym_hi
sym_u3
TDPIPE
TDTCP
TosIde
Udfs
ultra
upperdev
usbccgp
usbprint
usbscan
usbser
UsbserFilt
USBSTOR
ViaIde
wanatw
Wdf01000
WDICA
winachsf
WpdUsb
WS2IFSL
WSTCODEC


[b]Services - Running[/b]:

ALG
aswUpdSv
AudioSrv
avast!
avast!
avast!
BITS
Browser
CryptSvc
DcomLaunch
Dhcp
dmserver
Dnscache
ERSvc
Eventlog
EventSystem
FastUserSwitchingCompatibility
helpsvc
Iprip
JavaQuickStarterService
lanmanserver
lanmanworkstation
LmHosts
Netman
Nla
NVSvc
PlugPlay
PolicyAgent
ProtectedStorage
RasMan
RemoteRegistry
RpcSs
SamSs
Schedule
seclogon
SENS
ServiceLayer
SharedAccess
ShellHWDetection
SimpTcp
Spooler
srservice
SSDPSRV
stisvc
TapiSrv
TermService
Themes
TrkWks
UMWdf
W32Time
WebClient
winmgmt
wscsvc
wuauserv
WZCSVC


[b]Services - Stopped[/b]:

Alerter
AppMgmt
ATI
CiSvc
ClipSrv
COMSysApp
dmadmin
GoogleDesktopManager-061008-081103
gusvc
HidServ
HTTPFilter
IDriverT
ImapiService
LPDSVC
Messenger
mnmsrvc
MSDTC
MSIServer
NetDDE
NetDDEdsdm
Netlogon
NtLmSsp
NtmsSvc
Pml
RasAuto
RDSessMgr
RemoteAccess
RpcLocator
RSVP
SCardSvr
SwPrv
SysmonLog
TlntSvr
upnphost
UPS
usnjsvc
VSS
WLSetupSvc
WmdmPmSN
Wmi
WmiApSrv
xmlprov


[b]Files Created/Modified - 60 Days[/b]:


C:\

19 Dec 2008 15:31:36  1 207 959 552 A.SH.     "C:\pagefile.sys"


C:\WINDOWS\

19 Dec 2008 15:31:38          2 048 A.S..     "C:\WINDOWS\bootstat.dat"
15 Dec 2008 17:45:18        286 720 A....     "C:\WINDOWS\PATCH.EXE"
15 Dec 2008 17:45:18         69 689 A....     "C:\WINDOWS\UNZIP.DLL"
15 Dec 2008 17:45:18        507 904 A....     "C:\WINDOWS\TMUPDATE.DLL"
15 Dec 2008 20:37:20         91 744 A....     "C:\WINDOWS\BPMNT.dll"
15 Dec 2008 20:37:20      1 213 784 A....     "C:\WINDOWS\vsapi32.dll"
15 Dec 2008 17:48:40         71 749 A....     "C:\WINDOWS\hcextoutput.dll"
15 Dec 2008 17:48:40        345 157 A....     "C:\WINDOWS	sc.exe"
26 Nov 2008 18:21:30      1 236 208 A....     "C:\WINDOWS\system32\aswBoot.exe"
16 Dec 2008 15:59:52        144 792 A....     "C:\WINDOWS\system32\java.exe"
16 Dec 2008 15:59:54        144 792 A....     "C:\WINDOWS\system32\javaw.exe"
16 Dec 2008 15:59:54        148 888 A....     "C:\WINDOWS\system32\javaws.exe"
16 Dec 2008 15:59:52        410 984 A....     "C:\WINDOWS\system32\deploytk.dll"
23 Oct 2008 14:00:16        283 648 A....     "C:\WINDOWS\system32\gdi32.dll"
13 Dec 2008  7:37:56      3 593 216 A....     "C:\WINDOWS\system32\mshtml.dll"
 9 Dec 2008 15:24:38     17 593 280 A....     "C:\WINDOWS\system32\MRT.exe"
22 Oct 2008 10:47:08         62 976 .....     "C:\WINDOWS\system32	zchange.exe"
26 Oct 2008 11:40:22        134 072 A....     "C:\WINDOWS\system32\FNTCACHE.DAT"
15 Dec 2008 18:27:02              0 A....     "C:\WINDOWS\Temp\gd2.tmp"
19 Dec 2008 15:39:44              0 A....     "C:\WINDOWS\Temp\scsA.tmp"
19 Dec 2008 15:31:46              6 A..H.     "C:\WINDOWS\Tasks\SA.DAT"
26 Nov 2008 18:18:26         93 296 A....     "C:\WINDOWS\system32\drivers\aswmon.sys"
26 Nov 2008 18:18:18         94 032 A....     "C:\WINDOWS\system32\drivers\aswmon2.sys"
24 Oct 2008 12:10:42        453 632 A....     "C:\WINDOWS\system32\drivers\mrxsmb.sys"
26 Nov 2008 18:15:36         26 944 A....     "C:\WINDOWS\system32\drivers\aavmker4.sys"
26 Nov 2008 18:17:36        111 184 A....     "C:\WINDOWS\system32\drivers\aswSP.sys"
26 Nov 2008 18:17:26         20 560 A....     "C:\WINDOWS\system32\drivers\aswFsBlk.sys"
26 Nov 2008 18:16:38         50 864 A....     "C:\WINDOWS\system32\drivers\aswTdi.sys"
26 Nov 2008 18:16:30         23 152 A....     "C:\WINDOWS\system32\drivers\aswRdr.sys"
 3 Dec 2008 19:52:38         38 496 A....     "C:\WINDOWS\system32\drivers\mbamswissarmy.sys"
 3 Dec 2008 19:52:34         15 504 A....     "C:\WINDOWS\system32\drivers\mbam.sys"
13 Dec 2008  7:37:56      3 593 216 .....     "C:\WINDOWS\system32\dllcache\mshtml.dll"
23 Oct 2008 14:00:16        283 648 .....     "C:\WINDOWS\system32\dllcache\gdi32.dll"
24 Oct 2008 12:10:42        453 632 .....     "C:\WINDOWS\system32\dllcache\mrxsmb.sys"
24 Oct 2008 12:10:42        453 632 .....     "C:\WINDOWS\Driver Cache\i386\mrxsmb.sys"
15 Dec 2008 20:37:18        669 168 A....     "C:\WINDOWS\AU_Temp\AU_Down\engine\engv87_nt386.zip"
15 Dec 2008 20:37:18         42 650 A....     "C:\WINDOWS\AU_Temp\AU_Down\product\auhccup1.zip"


C:\Program Files\

15 Dec 2008 15:38:56      2 436 160 A...R     "C:\Program Files\Google\GoogleToolbar2.dll"
15 Dec 2008 15:39:00         52 272 A....     "C:\Program Files\Google\googletoolbar2user.exe"
15 Dec 2008 15:38:22        115 247 A....     "C:\Program Files\Picasa2\Uninstall.exe"
15 Dec 2008 15:37:24      5 355 320 A..H.     "C:\Program Files\Picasa2\setup.exe"
16 Dec 2008  2:11:16          8 701 A....     "C:\Program Files\Malwarebytes' Anti-Malware\unins000.dat"
16 Dec 2008  2:10:26        688 784 A....     "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
 3 Dec 2008 19:52:32         73 360 A....     "C:\Program Files\Malwarebytes' Anti-Malware\mbam.dll"
 3 Dec 2008 19:52:32        380 048 A....     "C:\Program Files\Malwarebytes' Anti-Malware\mbam-dor.exe"
 3 Dec 2008 19:52:32      1 265 296 A....     "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe"
 3 Dec 2008 19:52:34         73 360 A....     "C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll"
 3 Dec 2008 19:52:36         77 968 A....     "C:\Program Files\Malwarebytes' Anti-Malware\zlib.dll"
 3 Dec 2008 19:52:36         44 688 A....     "C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll"
 3 Dec 2008 19:52:34        399 504 A....     "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe"
 3 Dec 2008 19:52:34        170 640 A....     "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe"
16 Dec 2008 15:59:50            994 A....     "C:\Program Files\Java\jre6\Welcome.html"
26 Nov 2008 18:15:32        225 280 A....     "C:\Program Files\Alwil Software\Avast4\Aavm4h.dll"
26 Nov 2008 18:19:02        188 416 A....     "C:\Program Files\Alwil Software\Avast4\AavmGuih.dll"
26 Nov 2008 18:15:26         20 992 A....     "C:\Program Files\Alwil Software\Avast4\AavmRpch.dll"
26 Nov 2008 18:15:42         35 840 A....     "C:\Program Files\Alwil Software\Avast4\AhResMai.dll"
26 Nov 2008 18:17:12         32 768 A....     "C:\Program Files\Alwil Software\Avast4\ahResMes.dll"
26 Nov 2008 18:16:50         53 248 A....     "C:\Program Files\Alwil Software\Avast4\AhResNS.dll"
26 Nov 2008 18:18:40         29 696 A....     "C:\Program Files\Alwil Software\Avast4\AhResOut.dll"
26 Nov 2008 18:17:06         33 280 A....     "C:\Program Files\Alwil Software\Avast4\ahResP2P.dll"
26 Nov 2008 18:19:12         43 008 A....     "C:\Program Files\Alwil Software\Avast4\AhResStd.dll"
26 Nov 2008 18:15:56         53 248 A....     "C:\Program Files\Alwil Software\Avast4\AhResWS.dll"
26 Nov 2008 18:18:00         65 536 A....     "C:\Program Files\Alwil Software\Avast4\AhRuiMai.dll"
26 Nov 2008 18:17:10         36 864 A....     "C:\Program Files\Alwil Software\Avast4\ahRuiMes.dll"
26 Nov 2008 18:16:48         36 864 A....     "C:\Program Files\Alwil Software\Avast4\AhRuiNS.dll"
26 Nov 2008 18:18:12         90 112 A....     "C:\Program Files\Alwil Software\Avast4\AhRuiOut.dll"
26 Nov 2008 18:17:04         22 528 A....     "C:\Program Files\Alwil Software\Avast4\ahRuiP2P.dll"
26 Nov 2008 18:19:10         57 344 A....     "C:\Program Files\Alwil Software\Avast4\AhRuiStd.dll"
26 Nov 2008 18:16:02         49 152 A....     "C:\Program Files\Alwil Software\Avast4\AhRuiWS.dll"
26 Nov 2008 18:11:32        225 280 A....     "C:\Program Files\Alwil Software\Avast4\ashBase.dll"
26 Nov 2008 18:13:20         98 304 A....     "C:\Program Files\Alwil Software\Avast4\ashCfgP.dll"
26 Nov 2008 18:13:32        131 072 A....     "C:\Program Files\Alwil Software\Avast4\ashCfgT.dll"
26 Nov 2008 18:13:38        151 552 A....     "C:\Program Files\Alwil Software\Avast4\ashChest.dll"
26 Nov 2008 18:18:40        204 600 A....     "C:\Program Files\Alwil Software\Avast4\ashOutXt.dll"
26 Nov 2008 18:15:02         76 880 A....     "C:\Program Files\Alwil Software\Avast4\ashShell.dll"
26 Nov 2008 18:11:38         53 248 A....     "C:\Program Files\Alwil Software\Avast4\ashSODBC.dll"
26 Nov 2008 18:12:00        233 472 A....     "C:\Program Files\Alwil Software\Avast4\ashSSqlt.dll"
26 Nov 2008 18:12:16         48 128 A....     "C:\Program Files\Alwil Software\Avast4\ashSXML.dll"
26 Nov 2008 18:11:44        118 784 A....     "C:\Program Files\Alwil Software\Avast4\ashTask.dll"
26 Nov 2008 18:13:12        327 680 A....     "C:\Program Files\Alwil Software\Avast4\ashUInt.dll"
26 Nov 2008 18:16:26         65 536 A....     "C:\Program Files\Alwil Software\Avast4\ashWsFtr.dll"
26 Nov 2008 18:11:36        659 456 A....     "C:\Program Files\Alwil Software\Avast4\aswAux.dll"
26 Nov 2008 18:12:04         11 584 A....     "C:\Program Files\Alwil Software\Avast4\aswIdle.dll"
26 Nov 2008 18:11:08         22 528 A....     "C:\Program Files\Alwil Software\Avast4\aswInteg.dll"
26 Nov 2008 18:09:34        327 680 A....     "C:\Program Files\Alwil Software\Avast4\aswRawFS.dll"
26 Nov 2008 18:09:02        147 456 A....     "C:\Program Files\Alwil Software\Avast4\aswRes.dll"
26 Nov 2008 18:17:00        106 496 A....     "C:\Program Files\Alwil Software\Avast4\avCommEx.dll"
26 Nov 2008 18:13:42         13 656 A....     "C:\Program Files\Alwil Software\Avast4\AVSSHOOK.dll"
26 Nov 2008 18:12:54        917 504 A....     "C:\Program Files\Alwil Software\Avast4\XT1922.dll"
26 Nov 2008 18:13:48        274 640 A....     "C:\Program Files\Alwil Software\Avast4\ashAvast.exe"
26 Nov 2008 18:14:04        130 440 A....     "C:\Program Files\Alwil Software\Avast4\ashBug.exe"
26 Nov 2008 18:14:16         68 640 A....     "C:\Program Files\Alwil Software\Avast4\ashChest.exe"
26 Nov 2008 18:14:10         53 792 A....     "C:\Program Files\Alwil Software\Avast4\ashCnsnt.exe"
26 Nov 2008 18:18:52         81 000 A....     "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
26 Nov 2008 18:13:54         50 184 A....     "C:\Program Files\Alwil Software\Avast4\ashLogV.exe"
26 Nov 2008 18:18:32        254 040 A....     "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe"
26 Nov 2008 18:18:58        208 720 A....     "C:\Program Files\Alwil Software\Avast4\ashPopWz.exe"
26 Nov 2008 18:14:58        282 880 A....     "C:\Program Files\Alwil Software\Avast4\ashQuick.exe"
26 Nov 2008 18:18:46        155 160 A....     "C:\Program Files\Alwil Software\Avast4\ashServ.exe"
26 Nov 2008 18:14:22        126 320 A....     "C:\Program Files\Alwil Software\Avast4\ashSimp2.exe"
26 Nov 2008 18:15:22        159 280 A....     "C:\Program Files\Alwil Software\Avast4\ashSimpl.exe"
26 Nov 2008 18:13:56         17 920 A....     "C:\Program Files\Alwil Software\Avast4\ashSkPcc.exe"
26 Nov 2008 18:13:58         61 440 A....     "C:\Program Files\Alwil Software\Avast4\ashSkPck.exe"
26 Nov 2008 18:11:50         68 640 A....     "C:\Program Files\Alwil Software\Avast4\ashUpd.exe"
26 Nov 2008 18:16:24        352 920 A....     "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe"
19 Nov 2008 18:51:28         31 552 A....     "C:\Program Files\Alwil Software\Avast4\aswChLic.exe"
26 Nov 2008 18:12:08         18 752 A....     "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"
26 Nov 2008 18:21:10         68 640 A....     "C:\Program Files\Alwil Software\Avast4\sched.exe"
26 Nov 2008 18:15:06         68 640 A....     "C:\Program Files\Alwil Software\Avast4\VisthAux.exe"
26 Nov 2008 18:15:14         53 280 A....     "C:\Program Files\Alwil Software\Avast4\VisthLic.exe"
26 Nov 2008 18:14:48         53 280 A....     "C:\Program Files\Alwil Software\Avast4\VisthUpd.exe"
26 Nov 2008 18:09:14        131 072 A....     "C:\Program Files\Alwil Software\Avast4\aswCmnB.dll"
26 Nov 2008 18:09:10         86 016 A....     "C:\Program Files\Alwil Software\Avast4\aswCmnOS.dll"
26 Nov 2008 18:09:20        192 512 A....     "C:\Program Files\Alwil Software\Avast4\aswCmnS.dll"
26 Nov 2008 18:11:22      1 269 760 A....     "C:\Program Files\Alwil Software\Avast4\aswEngin.dll"
26 Nov 2008 18:10:56         86 016 A....     "C:\Program Files\Alwil Software\Avast4\aswScan.dll"
15 Dec 2008 15:37:38            572 A....     "C:\Program Files\Google\Google Desktop Search\ak ### GoogleDesktopSetup.exe -uninstall"
15 Dec 2008 18:27:14        205 824 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopOffice.dll"
15 Dec 2008 18:27:14         34 816 A....     "C:\Program Files\Google\Google Desktop Search\gzlib.dll"
15 Dec 2008 15:37:36        203 776 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopCommon.dll"
15 Dec 2008 18:27:16        122 880 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopMozilla.dll"
15 Dec 2008 18:27:16        162 816 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopDeskbar2.dll"
15 Dec 2008 18:27:16        135 168 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopHyper.dll"
15 Dec 2008 18:27:16         66 048 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopActions.dll"
15 Dec 2008 15:37:36        113 664 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll"
15 Dec 2008 15:37:12      1 842 160 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopUpdate.exe"
15 Dec 2008 15:37:36        572 416 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopResources_fr.dll"
15 Dec 2008 15:37:36         29 744 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe"
15 Dec 2008 15:37:36        103 936 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopIE.dll"
15 Dec 2008 15:37:36        500 224 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopAPI2.dll"
15 Dec 2008 15:37:12      1 842 160 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe"
16 Dec 2008 17:08:36        212 992 A....     "C:\Program Files\Google\Google Desktop Search\pdftotext.exe"
15 Dec 2008 18:27:16        112 640 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopMail.dll"
15 Dec 2008 15:36:02        101 888 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.dll"
15 Dec 2008 15:37:36          4 999 A....     "C:\Program Files\Google\Google Desktop Search	opic_sites.dat"
15 Dec 2008 18:27:18        150 016 A....     "C:\Program Files\Google\Google Desktop Search\GoogleDesktopSSD.dll"
15 Dec 2008 18:27:18        406 528 A....     "C:\Program Files\Google\Google Desktop Search\GoogleUIEngine.dll"
15 Dec 2008 15:37:38      1 993 728 A....     "C:\Program Files\Google\Google Desktop Search\GoogleServices.dll"
15 Dec 2008 15:38:28              3 A....     "C:\Program Files\Picasa2untime\hlpsys.dll"
15 Dec 2008 21:00:58        396 288 A....     "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe"
15 Dec 2008 21:00:58        396 288 A....     "C:\Program Files\Trend Micro\HijackThisicox.exe"
15 Dec 2008 22:37:10          5 624 A....     "C:\Program Files\AxBx\Clean Virus MSN\unins000.dat"
15 Dec 2008 14:11:18      1 972 600 A....     "C:\Program Files\AxBx\Clean Virus MSN\CleanVirusMSN.exe"
13 Nov 2008 11:58:00      1 241 628 A....     "C:\Program Files\AxBx\Clean Virus MSN\sig_msn.dat"
15 Dec 2008 14:05:04          6 420 A....     "C:\Program Files\AxBx\Clean Virus MSN\sig_msn2.dat"
13 Nov 2008 12:02:02      9 106 656 A....     "C:\Program Files\AxBx\Clean Virus MSN\mdpe_msn.dat"
15 Dec 2008 14:05:44        652 600 A....     "C:\Program Files\AxBx\Clean Virus MSN\mdpe_msn2.dat"
18 Dec 2008 15:15:50         92 536 A....     "C:\Program Files\Fichiers communs\Adobe\Updater6\AdobeUpdaterInstallMgr.exe"
18 Dec 2008 15:16:24      2 519 416 A....     "C:\Program Files\Fichiers communs\Adobe\Updater6\Adobe_Updater.exe"
10 Nov 2008  6:00:34        262 144 A....     "C:\Program Files\Java\jre6\binegutils.dll"
16 Dec 2008 15:59:52      1 130 496 A....     "C:\Program Files\Java\jre6\bin\awt.dll"
16 Dec 2008 15:59:52        110 592 A....     "C:\Program Files\Java\jre6\bin\axbridge.dll"
16 Dec 2008 15:59:52        192 512 A....     "C:\Program Files\Java\jre6\bin\cmm.dll"
16 Dec 2008 15:59:52        143 360 A....     "C:\Program Files\Java\jre6\bin\dcpr.dll"
16 Dec 2008 15:59:52         77 824 A....     "C:\Program Files\Java\jre6\bin\deploy.dll"
16 Dec 2008 15:59:52        410 984 A....     "C:\Program Files\Java\jre6\bin\deploytk.dll"
16 Dec 2008 15:59:52         16 896 A....     "C:\Program Files\Java\jre6\bin\dt_shmem.dll"
16 Dec 2008 15:59:52         13 312 A....     "C:\Program Files\Java\jre6\bin\dt_socket.dll"
16 Dec 2008 15:59:52        339 968 A....     "C:\Program Files\Java\jre6\bin\fontmanager.dll"
16 Dec 2008 15:59:52         15 872 A....     "C:\Program Files\Java\jre6\bin\hpi.dll"
16 Dec 2008 15:59:52        139 264 A....     "C:\Program Files\Java\jre6\bin\hprof.dll"
16 Dec 2008 15:59:52         98 304 A....     "C:\Program Files\Java\jre6\bin\instrument.dll"
16 Dec 2008 15:59:52         12 800 A....     "C:\Program Files\Java\jre6\bin\ioser12.dll"
16 Dec 2008 15:59:52          7 680 A....     "C:\Program Files\Java\jre6\bin\j2pcsc.dll"
16 Dec 2008 15:59:52         37 376 A....     "C:\Program Files\Java\jre6\bin\j2pkcs11.dll"
16 Dec 2008 15:59:52         10 240 A....     "C:\Program Files\Java\jre6\bin\jaas_nt.dll"
16 Dec 2008 15:59:52         32 664 A....     "C:\Program Files\Java\jre6\bin\java-rmi.exe"
16 Dec 2008 15:59:52        126 976 A....     "C:\Program Files\Java\jre6\bin\java.dll"
16 Dec 2008 15:59:52        144 792 A....     "C:\Program Files\Java\jre6\bin\java.exe"
16 Dec 2008 15:59:52         58 776 A....     "C:\Program Files\Java\jre6\bin\javacpl.exe"
16 Dec 2008 15:59:54        144 792 A....     "C:\Program Files\Java\jre6\bin\javaw.exe"
16 Dec 2008 15:59:54        148 888 A....     "C:\Program Files\Java\jre6\bin\javaws.exe"
16 Dec 2008 15:59:54         14 336 A....     "C:\Program Files\Java\jre6\bin\java_crw_demo.dll"
16 Dec 2008 15:59:54          5 120 A....     "C:\Program Files\Java\jre6\bin\jawt.dll"
16 Dec 2008 15:59:54         79 256 A....     "C:\Program Files\Java\jre6\bin\jbroker.exe"
16 Dec 2008 15:59:54         36 352 A....     "C:\Program Files\Java\jre6\bin\JdbcOdbc.dll"
16 Dec 2008 15:59:54        167 936 A....     "C:\Program Files\Java\jre6\bin\jdwp.dll"
16 Dec 2008 15:59:54        274 432 A....     "C:\Program Files\Java\jre6\bin\jkernel.dll"
16 Dec 2008 15:59:54         77 824 A....     "C:\Program Files\Java\jre6\bin\jli.dll"
16 Dec 2008 15:59:54         94 208 A....     "C:\Program Files\Java\jre6\bin\jp2iexp.dll"
16 Dec 2008 15:59:54         22 424 A....     "C:\Program Files\Java\jre6\bin\jp2launcher.exe"
16 Dec 2008 15:59:54          8 192 A....     "C:\Program Files\Java\jre6\bin\jp2native.dll"
16 Dec 2008 15:59:54         34 816 A....     "C:\Program Files\Java\jre6\bin\jp2ssv.dll"
16 Dec 2008 15:59:54        147 456 A....     "C:\Program Files\Java\jre6\bin\jpeg.dll"
16 Dec 2008 15:59:54         98 304 A....     "C:\Program Files\Java\jre6\bin\jpicom.dll"
16 Dec 2008 15:59:54        110 592 A....     "C:\Program Files\Java\jre6\bin\jpiexp.dll"
16 Dec 2008 15:59:54         98 304 A....     "C:\Program Files\Java\jre6\bin\jpinscp.dll"
16 Dec 2008 15:59:54         65 536 A....     "C:\Program Files\Java\jre6\bin\jpioji.dll"
16 Dec 2008 15:59:54        122 880 A....     "C:\Program Files\Java\jre6\bin\jpishare.dll"
16 Dec 2008 15:59:54        152 984 A....     "C:\Program Files\Java\jre6\bin\jqs.exe"
16 Dec 2008 15:59:54         54 680 A....     "C:\Program Files\Java\jre6\bin\jqsnotify.exe"
16 Dec 2008 15:59:54        147 456 A....     "C:\Program Files\Java\jre6\bin\jsound.dll"
16 Dec 2008 15:59:54         18 432 A....     "C:\Program Files\Java\jre6\bin\jsoundds.dll"
16 Dec 2008 15:59:54        382 384 A....     "C:\Program Files\Java\jre6\bin\jucheck.exe"
16 Dec 2008 15:59:54         54 680 A....     "C:\Program Files\Java\jre6\bin\jureg.exe"
16 Dec 2008 15:59:54        136 600 A....     "C:\Program Files\Java\jre6\bin\jusched.exe"
16 Dec 2008 15:59:54         33 176 A....     "C:\Program Files\Java\jre6\bin\keytool.exe"
16 Dec 2008 15:59:54         33 176 A....     "C:\Program Files\Java\jre6\bin\kinit.exe"
16 Dec 2008 15:59:54         33 176 A....     "C:\Program Files\Java\jre6\bin\klist.exe"
16 Dec 2008 15:59:54         33 176 A....     "C:\Program Files\Java\jre6\bin\ktab.exe"
16 Dec 2008 15:59:54         18 432 A....     "C:\Program Files\Java\jre6\bin\management.dll"
16 Dec 2008 15:59:54        602 112 A....     "C:\Program Files\Java\jre6\bin\mlib_image.dll"
16 Dec 2008 15:59:54        348 160 A....     "C:\Program Files\Java\jre6\bin\msvcr71.dll"
16 Dec 2008 15:59:54        266 293 A....     "C:\Program Files\Java\jre6\bin\msvcrt.dll"
16 Dec 2008 15:59:54         77 824 A....     "C:\Program Files\Java\jre6\bin
et.dll"
16 Dec 2008 15:59:54         20 480 A....     "C:\Program Files\Java\jre6\bin
io.dll"
16 Dec 2008 15:59:54        410 984 A....     "C:\Program Files\Java\jre6\bin
pdeploytk.dll"
16 Dec 2008 15:59:54        132 504 A....     "C:\Program Files\Java\jre6\bin
pjpi160_11.dll"
16 Dec 2008 15:59:54        126 976 A....     "C:\Program Files\Java\jre6\bin
poji610.dll"
16 Dec 2008 15:59:56          8 192 A....     "C:\Program Files\Java\jre6\bin
pt.dll"
16 Dec 2008 15:59:56         33 176 A....     "C:\Program Files\Java\jre6\bin\orbd.exe"
16 Dec 2008 15:59:56         33 176 A....     "C:\Program Files\Java\jre6\bin\pack200.exe"
16 Dec 2008 15:59:56         33 176 A....     "C:\Program Files\Java\jre6\bin\policytool.exe"
16 Dec 2008 15:59:56          5 120 A....     "C:\Program Files\Java\jre6\binmi.dll"
16 Dec 2008 15:59:56         33 176 A....     "C:\Program Files\Java\jre6\binmid.exe"
16 Dec 2008 15:59:56         33 176 A....     "C:\Program Files\Java\jre6\binmiregistry.exe"
16 Dec 2008 15:59:56         33 176 A....     "C:\Program Files\Java\jre6\bin\servertool.exe"
16 Dec 2008 15:59:56        131 072 A....     "C:\Program Files\Java\jre6\bin\splashscreen.dll"
16 Dec 2008 15:59:56        320 920 A....     "C:\Program Files\Java\jre6\bin\ssv.dll"
16 Dec 2008 15:59:56         17 816 A....     "C:\Program Files\Java\jre6\bin\ssvagent.exe"
16 Dec 2008 15:59:56         16 384 A....     "C:\Program Files\Java\jre6\bin\sunmscapi.dll"
16 Dec 2008 15:59:56         33 176 A....     "C:\Program Files\Java\jre6\bin	nameserv.exe"
16 Dec 2008 15:59:56        245 400 A....     "C:\Program Files\Java\jre6\bin\unicows.dll"
16 Dec 2008 15:59:56         61 440 A....     "C:\Program Files\Java\jre6\bin\unpack.dll"
16 Dec 2008 15:59:56        128 408 A....     "C:\Program Files\Java\jre6\bin\unpack200.exe"
16 Dec 2008 15:59:56         31 744 A....     "C:\Program Files\Java\jre6\bin\verify.dll"
16 Dec 2008 15:59:56         24 701 A....     "C:\Program Files\Java\jre6\bin\w2k_lsa_auth.dll"
16 Dec 2008 15:59:56        110 592 A....     "C:\Program Files\Java\jre6\bin\wsdetect.dll"
16 Dec 2008 15:59:56         47 104 A....     "C:\Program Files\Java\jre6\bin\zip.dll"
19 Dec 2008 15:32:18         70 766 A....     "C:\Program Files\Alwil Software\Avast4\DATA\iNews.htm"
15 Dec 2008 19:14:54              0 A....     "C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat"
19 Dec 2008 15:08:10        229 320 A....     "C:\Program Files\Alwil Software\Avast4\DATA\aswar1.dll"
19 Dec 2008 15:31:44        229 320 A....     "C:\Program Files\Alwil Software\Avast4\DATA\aswar0.dll"
19 Dec 2008 15:31:44        391 216 A....     "C:\Program Files\Alwil Software\Avast4\DATA\clnr0.dll"
19 Dec 2008 15:31:44        309 912 A....     "C:\Program Files\Alwil Software\Avast4\DATA\dllcc0.dat"
19 Dec 2008 15:31:44          9 080 A....     "C:\Program Files\Alwil Software\Avast4\DATA\exts0.dll"
15 Dec 2008 18:36:56        159 792 A....     "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll"
26 Nov 2008 18:08:16         98 304 A....     "C:\Program Files\Alwil Software\Avast4\FRENCH\Base.dll"
26 Nov 2008 18:07:30         17 920 A....     "C:\Program Files\Alwil Software\Avast4\FRENCH\Boot.dll"
26 Nov 2008 18:08:16      2 572 288 A....     "C:\Program Files\Alwil Software\Avast4\FRENCH\Lang.dll"
26 Nov 2008 18:08:14         61 440 A....     "C:\Program Files\Alwil Software\Avast4\FRENCH\LangMai.dll"
20 Nov 2008 17:50:42          6 720 A....     "C:\Program Files\Alwil Software\Avast4\FRENCH\ENHANCED.HTM"
19 Dec 2008 15:33:32          2 236 A....     "C:\Program Files\Numericable\Mon Assistant Internet\wwwroot\RC_optionCats.html"
19 Dec 2008 15:33:32          1 171 A....     "C:\Program Files\Numericable\Mon Assistant Internet\wwwroot\alerter.html"
19 Dec 2008 15:33:32          6 607 A....     "C:\Program Files\Numericable\Mon Assistant Internet\wwwroot\RC_GeneralOptions.html"
19 Dec 2008 15:33:32          6 962 A....     "C:\Program Files\Numericable\Mon Assistant Internet\wwwroot\RC_CommOptions.html"
19 Dec 2008 15:33:32         13 388 A....     "C:\Program Files\Numericable\Mon Assistant Internet\wwwroot\RC_SecurityOptions.html"
19 Dec 2008 15:33:30          1 529 A....     "C:\Program Files\Numericable\Mon Assistant Internet\wwwroot\RC_FactoryLoader.html"
19 Dec 2008 15:33:32          1 171 A....     "C:\Program Files\Numericable\Mon Assistant Internet\wwwroot\alerter.html.tmp"
15 Dec 2008 15:36:00        534 016 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopResources_fr.dll"
15 Dec 2008 15:36:02      1 838 592 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktop.exe"
15 Dec 2008 15:36:02        111 104 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopIE.dll"
15 Dec 2008 15:36:02        552 960 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopAPI2.dll"
15 Dec 2008 15:36:02        241 152 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopOffice.dll"
15 Dec 2008 15:36:02         36 352 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_gzlib.dll"
15 Dec 2008 15:36:02        125 440 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopCommon.dll"
15 Dec 2008 15:36:02        135 680 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopMozilla.dll"
15 Dec 2008 15:36:02        168 448 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopDeskbar2.dll"
15 Dec 2008 15:36:02        105 984 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopMail.dll"
15 Dec 2008 15:36:02        176 640 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopHyper.dll"
15 Dec 2008 15:36:02         68 096 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopActions.dll"
15 Dec 2008 15:36:02        145 408 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopNetwork3.dll"
15 Dec 2008 15:35:38          4 999 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_topic_sites.dat"
15 Dec 2008 15:36:02        156 160 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleDesktopSSD.dll"
15 Dec 2008 15:36:02        348 160 A....     "C:\Program Files\Google\Google Desktop Search	emp\_PREV_GoogleUIEngine.dll"
15 Dec 2008 18:27:00        572 416 A....     "C:\Program Files\Google\Google Desktop Search\gcdtmp1\GoogleDesktopResources_fr.dll"
15 Dec 2008 18:27:00        203 776 A....     "C:\Program Files\Google\Google Desktop Search\gcdtmp1\GoogleDesktopCommon.dll"
15 Dec 2008 15:38:58        138 168 A....     "C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe"
15 Dec 2008 15:39:02         48 128 A....     "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462es_fr.dll"
15 Dec 2008 15:39:02        256 440 A....     "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\swg.dll"
15 Dec 2008 15:39:04        171 448 A....     "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe"
16 Dec 2008 15:59:52      2 359 296 A....     "C:\Program Files\Java\jre6\bin\client\jvm.dll"
16 Dec 2008 15:59:54         65 536 A....     "C:\Program Files\Java\jre6\bin
ew_plugin
pjp2.dll"
16 Dec 2008 15:59:54        348 160 A....     "C:\Program Files\Java\jre6\bin
ew_plugin\msvcr71.dll"
16 Dec 2008 15:59:54        410 984 A....     "C:\Program Files\Java\jre6\bin
ew_plugin
pdeploytk.dll"
16 Dec 2008 15:59:56         16 801 A....     "C:\Program Files\Java\jre6\lib\deploy\ffjcext.zip"
16 Dec 2008 15:59:56        152 576 A....     "C:\Program Files\Java\jre6\lib\deploy\lzma.dll"
26 Nov 2008 18:15:36         26 944 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\Aavmker4.sys"
26 Nov 2008 18:17:26         20 560 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\aswFsBlk.sys"
26 Nov 2008 18:18:26         93 296 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\aswMon.sys"
26 Nov 2008 18:18:18         94 032 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\aswMon2.sys"
26 Nov 2008 18:17:16         51 792 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\aswMonFlt.sys"
26 Nov 2008 18:16:30         23 152 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AswRdr.sys"
26 Nov 2008 18:17:36        111 184 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\aswSP.sys"
26 Nov 2008 18:16:38         50 864 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AswTdi.sys"
26 Nov 2008 18:15:40         25 168 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AMD64\Aavmker4.sys"
26 Nov 2008 18:17:30         22 096 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AMD64\aswFsBlk.sys"
26 Nov 2008 18:18:22         75 856 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AMD64\aswMon2.sys"
26 Nov 2008 18:17:24         64 592 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AMD64\aswMonFlt.sys"
26 Nov 2008 18:16:32         27 216 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AMD64\aswRdr.sys"
26 Nov 2008 18:17:50         89 168 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AMD64\aswSP.sys"
26 Nov 2008 18:16:42         57 936 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\AMD64\aswTdi.sys"
26 Nov 2008 18:17:28         37 968 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\IA64\aswFsBlk.sys"
26 Nov 2008 18:17:20        140 368 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\IA64\aswMonFlt.sys"
26 Nov 2008 18:16:34         55 376 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\IA64\aswRdr.sys"
26 Nov 2008 18:17:44        168 016 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\IA64\aswSP.sys"
26 Nov 2008 18:16:44        126 544 A....     "C:\Program Files\Alwil Software\Avast4\Setup\INF\IA64\aswTdi.sys"
16 Dec 2008 15:59:56         73 728 A....     "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll"


[b]Files with hidden attributes[/b]:

Mon 15 Dec 2008     5,355,320 A..H. --- "C:\Program Files\Picasa2\setup.exe"
Sun  2 Sep 2007         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 14 Aug 2003         1,206 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\ccReg_old.reg"
Thu 14 Aug 2003        12,888 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\CommonClient_old.reg"
Tue  4 Nov 2003         1,206 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\ccReg.reg"
Tue  4 Nov 2003        12,888 A..HR --- "C:\Program Files\Fichiers communs\Symantec Shared\Registry Backup\CommonClient.reg"


[b]Program Folders[/b]:

C:\Program Files\

ACD Systems
Adobe
Ahead
Alwil Software
ATI Technologies
AutoCAD 2004
AVIConverter Package
AxBx
BSPlayer
CDex_150
Common Files
ComPlus Applications
CONEXANT
CoverPro
CyberLink
DAP
DIFX
DiMAGE Viewer
directx
DivX
Easy CD-DA Extractor 8
ecrans2veille
Elaborate Bytes
eMule
Fichiers communs
GEOGRAPHIE
GetFlash
Google
Hewlett-Packard
InstallShield Installation Information
Internet Explorer
Java
Kodak
Lavasoft
Le Fournier sign‚
Live-Prod
Logitech
Malwarebytes' Anti-Malware
Messenger
Microsoft CAPICOM 2.1.0.2
microsoft frontpage
Microsoft Office
Microsoft Works
Microsoft Works Suite 2003
Motive
Movie Maker
MSN Gaming Zone
MUSICMATCH
NCH Swift Sound
NetMeeting
Netscape
Nokia
Numericable
Outlook Express
PC Connectivity Solution
Picasa2
Program Files
QuickTime
Real
Schoolhouse Technologies
Trend Micro
Uninstall Information
Western Digital
Windows Live
Windows Media Player
Windows NT
WindowsUpdate
xerox
Yahoo!

C:\Program Files\Fichiers communs\

Adobe
AOL
aolback
Designer
EPSON
Hewlett-Packard
InstallShield
KODAK
Logitech
Microsoft Shared
mozilla.org
MSSoap
Nokia
ODBC
PCSuite
Real
Services
SpeechEngines
Symantec Shared
System
WindowsLiveInstaller
xing shared


[b]Add/Remove Programs[/b]:



et voici le log de Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:57:49, on 19/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\WINDOWS\System32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
F:\Reader\Reader_sl.exe
C:\Documents and Settingsicox\Bureau\Nokia PC Suite 7\PCSuite.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
c:\Program Files\Numericable\Mon Assistant Internet\bin\mpbtn.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer par NUMERICABLE
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;<local>;localhost
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [divwin] divwin.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe 
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "C:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Documents and Settingsicox\Bureau\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: GStartup.lnk = C:\Program Files\Fichiers communs\GMT\GMT.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: Mon Assistant Internet.lnk = C:\Program Files\Numericable\Mon Assistant Internet\bin\matcli.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=https://www.free.fr/freebox/index.html
O15 - Trusted Zone: http://www.secuser.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {5054F860-748D-4840-B7B4-DDDB428421AF} (phoneaccess Class) - http://ip.sponsoradulto.com/cab/4/fr/phoneaccess.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD5/JSCDL/jre/6u11-b90/jinstall-6u11-windows-i586-jc.cab?e=1229439539421&h=4faf0146a458e01fe99c5e67486e6142/&filename=jinstall-6u11-windows-i586-jc.cab
O16 - DPF: {CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA} (Environnement d'exécution Java 1.4.1_01) - 
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe (file missing)
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

anthony5151 · Answer

Il y a encore une infection d'après le rapport hijackthis... On va s'en débarrasser en faisant ce qui suit !


/!\ A l'attention de ceux qui passent sur ce sujet /!\
Le logiciel qui suit n'est pas à utiliser à la légère ! Ne le faites que si un helpeur du forum vous l'a recommandé.


On va utiliser Combofix pour finir la désinfection. Attention, ce logiciel est très puissant, une mauvaise utilisation peut faire des dégâts...  Fais exactement ce qui suit : 

Télécharge ComboFix (de sUBs) sur ton Bureau (et pas ailleurs !). Pour cela, fais un clic droit sur ce lien et choisis "enregistrer la cible sous ... " et tape C-Fix dans dans la fenêtre qui s'ouvre, puis choisis le Bureau comme destination et valide :  http://download.bleepingcomputer.com/sUBs/ComboFix.exe

--------------------------------------------- [ ! ATTENTION ! ] ---------------------------------------------------------- 
!! déconnecte toi, ferme toutes tes applications en cours et DESACTIVE TOUTES TES DEFENCES (anti-virus, antispyware, pare-feu) le temps de la manipulation : en effet , activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil ( voir planter le PC )...Tu les réactiveras donc après !! 

Dans ton cas, il s'agit d'Avast (fais un clic-droit sur l'icone près de l'horloge et clique sur « Arrêter la protection résidente »)

---> Surtout, si tu rencontres des difficultés à ce niveau là, dis le moi avant de poursuivre... 

Tuto ici pour installer la Console de récupération (important en cas de problème) : https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix 
--------------------------------------------------------------------------------------------------------------------------------- 

Ensuite : 
double-clique sur C-Fix.exe (= combofix.exe ) . 

Appuie sur une touche pour démarrer le scan . 

Attention : n'utilise pas ta souris ni ton clavier pendant que le programme tourne. Cela pourrait figer l'ordi ---> si un message d'erreur windows apparait à un moment : clique sur la croix rouge en haut à droite de la fenêtre pour la fermer

Le rapport sera crée dans: C:\Combofix.txt , poste le ici stp

HELP !!!i nfecté par des virus msn

13 réponses

Discussions similaires