Virus winupgro

Question

Bonjour,

infecté par wibnupgro depuis une heure environ, j'utilise lapplication findykill. mon rapport est arrivé mais je ne sait pas ce que je peux supprimer en tte confiance sans abimer l'ordinateur. 

merci

Utilisateur anonyme · Answer

re,

comme promis je passe ,


Télécharge ToolsCleaner sur ton bureau. 
--> 
http://pc-system.fr/ 
http://www.commentcamarche.net/telecharger/telecharger 34055291 toolscleaner

# Clique sur Recherche et laisse le scan agir ... 
# Clique sur Suppression pour finaliser. 
# Tu peux, si tu le souhaites, te servir des Options facultatives. 
# Clique sur Quitter pour obtenir le rapport. 
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 


ensuite :

Telecharge FindyKill sur ton bureau :

--> Lance l installation avec les parametres par default

--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 1 (Recherche)

--> Post le rapport FindyKill.txt 

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

Tuto : malekal
Tuto : 01net

toto09 · Answer

ok donc je ferme findykill qui a déja scanné mon ordinateur la. jai déja le rapport sous les yeux. tant pis je le ferme quand mm ?

Utilisateur anonyme · Answer

oué 

tu suis la procédure stp

toto09 · Answer

ok ca marche merci

toto09 · Answer

dsl dcasser les couilles avec ca mais une fois que le virus sera détruit (si cest possible bien sur), mon antivirus sera réinstallé et msn aussi ??

Utilisateur anonyme · Answer

oui pas de soucis

toto09 · Answer

[ Rapport ToolsCleaner version 2.3.0 (par A.Rothstein & dj QUIOU) ]

-->- Recherche: 

C:\FindyKill.txt: trouvé !
C:\Documents and Settings
athan\Menu Démarrer\Programmes\FindyKill: trouvé !
C:\Program Files\FindyKill: trouvé !

---------------------------------
-->- Suppression: 

C:\FindyKill.txt: supprimé !
C:\Documents and Settings
athan\Menu Démarrer\Programmes\FindyKill: supprimé !
C:\Program Files\FindyKill: ERREUR DE SUPPRESSION !!

toto09 · Answer

juste en attendant, pourquoi me faire désinstaller et réinstaller findykill ?(je suis novice et j'eassaie de comprendre un peu)

Utilisateur anonyme · Answer

ok 

recommence avec findykill avec le lien fourni

Utilisateur anonyme · Answer

c juste au cas ou tu aurais pas la bonne version

toto09 · Answer

ok pas dprise de risque. et c'est vous qui l'avez programmée cette appli ?

Utilisateur anonyme · Answer

oui ,en effet avec l aide d une personne

toto09 · Answer

----------------- FindyKill V4.712 ------------------

* User : nathan - PENTABOSS
* Emplacement : C:\Program Files\FindyKill
* Outils Mis a jours le 14/01/09 par Chiquitine29
* Recherche effectuée à 22:01:34 le 15/01/2009
* Windows XP - Internet Explorer 6.0.2900.2180
 
((((((((((((((((( *** Recherche *** ))))))))))))))))))  
 
 
--------------- [ Processus actifs ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4apimgr.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\lotus
otes
tmulti.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
 
--------------- [ Fichiers/Dossiers infectieux ] ----------------  
 
 
»»»» Presence des fichiers dans C: 
 
 
»»»» Presence des fichiers dans C:\WINDOWS 
 
Found ! [25/03/2007 10:37] - "C:\WINDOWS\exefld" 
 
»»»» Presence des fichiers dans C:\WINDOWS\Prefetch 
 
Found ! - C:\WINDOWS\prefetch\139250.EXE-0BA0215C.pf 
Found ! - C:\WINDOWS\prefetch\177468.EXE-186CAC57.pf 
Found ! - C:\WINDOWS\prefetch\192750.EXE-2753CF01.pf 
Found ! - C:\WINDOWS\prefetch\5678421.EXE-2A173B90.pf 
Found ! - C:\WINDOWS\prefetch\FLEC006.EXE-19A758F6.pf 
Found ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf 
Found ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf 
Found ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-041ABFAF.pf 
 
»»»» Presence des fichiers dans C:\WINDOWS\system32 
 
Found ! [15/01/2009 20:59] - C:\WINDOWS\system32\mdelk.exe 
Found ! [15/01/2009 20:59] - C:\WINDOWS\system32\wintems.exe 
Found ! [15/01/2009 20:59] - C:\WINDOWS\system32\ban_list.txt 
 
»»»» Presence des fichiers dans C:\WINDOWS\system32\drivers 
 
Found ! [29/02/2008 20:49] - "C:\WINDOWS\system32\drivers\down" 
 
»»»» Presence des fichiers dans C:\Documents and Settings
athan\Application Data 
 
Found ! [15/01/2009 21:00] - "C:\Documents and Settings
athan\Application Data\m\flec006.exe" 
Found ! [15/01/2009 21:00] - "C:\Documents and Settings
athan\Application Data\m\list.oct" 
Found ! [15/01/2009 21:00] - "C:\Documents and Settings
athan\Application Data\m\data.oct" 
Found ! [15/01/2009 21:00] - "C:\Documents and Settings
athan\Application Data\m\srvlist.oct" 
Found ! [15/01/2009 21:02] - "C:\Documents and Settings
athan\Application Data\m\shared" 
Found ! [15/01/2009 21:00] - "C:\Documents and Settings
athan\Application Data\m" 
Found ! [15/01/2009 20:55] - "C:\Documents and Settings
athan\Application Data\drivers" 
Found ! [15/01/2009 20:58] - "C:\Documents and Settings
athan\Application Data\drivers\srosa.sys" 
Found ! [15/01/2009 20:58] - "C:\Documents and Settings
athan\Application Data\drivers\srosa2.sys" 
Found ! [10/05/2005 02:07] - "C:\Documents and Settings
athan\Application Data\drivers\winupgro.exe" 
Found ! [15/01/2009 21:01] - "C:\Documents and Settings
athan\Application Data\drivers\downld" 
 
»»»» Presence des fichiers dans C:\DOCUME~1
athan\LOCALS~1\Temp 
 
 
--------------- [ Registre / Startup ] ----------------  
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersionun]
   msnmsgr="C:\Program Files\MSN Messenger\msnmsgr.exe" /background
   H/PC Connection Agent="C:\Program Files\Microsoft ActiveSync\wcescomm.exe"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersionun]
   avast!=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
   HPDJ Taskbar Utility=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
   NvCplDaemon=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
   nwiz=nwiz.exe /install
   QuickTime Task="C:\Program Files\QuickTime\qttask.exe" -atboottime
   DAEMON Tools-1033="C:\Program Files\D-Tools\daemon.exe"  -lang 1033
   CloneCDTray="C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
   NvMediaCenter=RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
   WinampAgent=C:\Program Files\Winamp\winampa.exe
   TkBellExe="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents=
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents\IMAIL=
   Installed=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents\MAPI=
   Installed=1
   NoChange=1
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversionun\OptionalComponents\MSFS=
   Installed=1
 
[HKEY_CURRENT_USER\software\local appwizard-generated applications\install]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\msnmsgr]
[HKEY_CURRENT_USER\software\local appwizard-generated applications\winupgro]
 
--------------- [ Registre / Clés infectieuses ] ----------------  
 
 
Found ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\Local AppWizard-Generated Applications\msnmsgr 
Found ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\Local AppWizard-Generated Applications\winupgro 
Found ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\bisoft 
Found ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\DateTime4 
Found ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\FFC 
Found ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\MuleAppData 
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\msnmsgr 
Found ! - HKEY_CURRENT_USER\Software\Local AppWizard-Generated Applications\winupgro 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\srosa 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\srosa 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SROSA 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SROSA 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SROSA 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_SK9OU0S 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sK9Ou0s 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sK9Ou0s 
Found ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sK9Ou0s 
Found ! - HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\mule_st_key 
Found ! - HKEY_CURRENT_USER\Software\bisoft 
Found ! - HKEY_CURRENT_USER\Software\DateTime4 
 
/!\ Infection active : HKLM\SYSTEM\...\Services\srosa -> Start = 0x1
/!\ Infection active : HKLM\SYSTEM\...\Services\sK9Ou0s -> Start = 0x1
 
--------------- [ Etat / Services ] ---------------- 
 
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot 
 
  /!\ Mode sans echec non fonctionnel !! 
 
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal 
 
  /!\ Mode sans echec non fonctionnel !! 
 
Clé manquante : HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network 
 
  /!\ Mode sans echec non fonctionnel !! 
 


+- Services : [ Auto=2 / Demande=3 / Désactivé=4 ] 

/!\ Ndisuio - Type de démarrage = 4 
 
/!\ Ip6Fw - Type de démarrage = 4 
 
/!\ SharedAccess - Type de démarrage = 4 
 
/!\ wuauserv - Type de démarrage = 4 
 
/!\ wscsvc - Type de démarrage = 4 
 
 
--------------- [ Recherche dans supports amovibles] ----------------  
 
 
+- Informations : 

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe

 
+- presence des fichiers :  

 
 
--------------- [ Registre / Mountpoint2 ] ----------------  
 
 
-> Not found ! 
 
 
------------------- ! Fin du rapport ! --------------------

Utilisateur anonyme · Answer

oki

en fait , t as des traces d une anciennes infection plus une des nouvelles 

>>faudrait serieusement arreter les cracks 


--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 2 (Suppression)


/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "Cleaning complete"

/!\ Ne te sert pas du pc durant la suppression , ton bureau ne sera pas accessible c est normal !

-------> ensuite post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides
/!\ A lire dans tons cas 1 : http://www.libellules.ch/...
/!\ A lire dans tons cas 2 : http://forum.malekal.com/ftopic893.php
/!\ A visionner : http://secuboxlabs.fr/archives/computertoday.html

toto09 · Answer

yahya kho

----------------- FindyKill V4.712 ------------------

* User : nathan - PENTABOSS
* executed from : C:\Program Files\FindyKill
* Update on 14/01/09 par Chiquitine29
* Start at 22:30:04 the 15/01/2009
* Windows XP - Internet Explorer 6.0.2900.2180
 
 
((((((((((((((( *** deleting *** ))))))))))))))))))  
 
 
--------------- [ Active Processes ] ----------------  
 

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\userinit.exe
 
--------------- [ Infected files / folders ] ----------------  
 
 
»»»» Supression files in C: 
 
 
»»»» Supression files in C:\WINDOWS 
 
Deleted ! - "C:\WINDOWS\exefld"  
 
»»»» Supression files in C:\WINDOWS\Prefetch 
 
Deleted ! - C:\WINDOWS\prefetch\139250.EXE-0BA0215C.pf 
Deleted ! - C:\WINDOWS\prefetch\177468.EXE-186CAC57.pf 
Deleted ! - C:\WINDOWS\prefetch\192750.EXE-2753CF01.pf 
Deleted ! - C:\WINDOWS\prefetch\5678421.EXE-2A173B90.pf 
Deleted ! - C:\WINDOWS\prefetch\FLEC006.EXE-19A758F6.pf 
Deleted ! - C:\WINDOWS\prefetch\MDELK.EXE-1D176F91.pf 
Deleted ! - C:\WINDOWS\prefetch\WINTEMS.EXE-2A563F9B.pf 
Deleted ! - C:\WINDOWS\prefetch\WINUPGRO.EXE-041ABFAF.pf 
 
»»»» Supression files in C:\WINDOWS\system32 
 
Deleted ! - C:\WINDOWS\system32\mdelk.exe  
Deleted ! - C:\WINDOWS\system32\wintems.exe  
Deleted ! - C:\WINDOWS\system32\ban_list.txt  
 
»»»» Supression files in C:\WINDOWS\system32\drivers 
 
Deleted ! - "C:\WINDOWS\system32\drivers\down"  
 
»»»» Supression files in C:\Documents and Settings
athan\Application Data 
 
Deleted ! - "C:\Documents and Settings
athan\Application Data\m\flec006.exe"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\m\list.oct"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\m\data.oct"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\m\srvlist.oct"  
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\3DS Export for Inventor 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\@RISK 4.5.5.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\A.I.Studio WatzNew 1.9.5.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Aardvark News Desk 1.01.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Adam Brody Screensaver 3.5.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Amazon.co.uk 0.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Ambisonics Player 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Amethyst CIPHER 1.05.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Annuaire 3.23.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Antivir.Personal.Edition.2006.+.crack.by.PcM@ster1.&.PcM@ster2.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Apple Math 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Aptana 0.2.7.13425.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\ASAP Advanced FTP Password Recovery 1.2.6.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Avira.Antivir.Premium.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\AWS Desktop Clock 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\B+ Tree 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Beatles Vista Icons.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\BG.-.Kompilacija.(2005).-.Den.i.nosht.(by.PANDA_1960).zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Bill Central Time Billing 2004.05.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Birthday Calendar Reminder 3.6 Build 422.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\BitNami Roller Stack 4.0-4.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Black ModXP 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Bollywood Mantra Sidebar 0.1.3.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\CatsCradle 3.7.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Claros Downloader 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\ClearInfo 0.50 Final.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\ClubDJ Pro 3.0.2.5.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\COLORCUBE Snake Screensaver 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Coloring Book 7 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\CTcontrol mini 1.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\dhtmlxTree 1.6.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Displaying 58001 - 60000 of 107598.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\DivX Cover Maker 2.2.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\DJ Java Decompiler 3.10.10.93.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\DSP Centercut 1.4.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\EasyPlay 1.0.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Email Extractor Websites N Mailer 1.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Express Talk VoIP Softphone 3.10.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Extract Data and Text from Multiple Text and HTML Files Software 9.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Ezy Invoice 7 Build 4.5.3.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Fast Bookmark 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\File Organiser 1.163.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\FSExplorer 1.0.0.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Gecko Programming Language 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\GetWebPics Home edition 2.9.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Glary Utilities PRO 2.9.518.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Gmail Icon Notifier 0.5 Beta.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Go to Selection 1.2.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Graphic-Chart ActiveX Components 3.000.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Grossout Shadow.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\GRSeo - Search Engine Optimizer 2.5.40.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Happy Diary 4.0.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Harry Potter Screen Saver 3.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Hartford Courant News 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Hex to Decimal Converter 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Home & Landscape Design Center 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\IE Cache Extractor 1.1 beta 6.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\JamDTA.net 4.0.3.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\jusqu'en.2041.Par.LE.GAU.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Katakana 1.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\kmAnywhere 2005 Pro 2005 build 060901.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\KUpTime 1.0.9.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\ListShares 1.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Locate Address in Israel 0.11.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Lockspam for Outlook 3.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Magic CHM Merge Home Edition 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Manual 30 Doctors 5 Calls Scheduler 3.33.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Mcafee.Internet.Security.Suite.2006.v8.0.113.3.no.shit.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Mcafee.Internet.Security.Suite.2006.v8.0.Fr_dreamteam.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\McAFee_Internet_Security_9_0_espaÇŸ¶ñol_2007.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Microsoft Research Search 1.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Moonlight Shadow Lake Screensaver 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Movavi MP4 Video Suite 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Mp3 Tag Assistant Professional 2.91 Build 255.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\MusicRandomizer 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\NaNoWriMo Word Count 1.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\NOD32.v2.50.16.Admin.WinXP.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\NOD32_2.50.45_Standard_German_for_goldesel.6x.to_by_M0rpheuss.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared
Vidia Vulcan Demo.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\OfficeHub 3.0.4.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\OsaSync Lite 8.2.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\OZItoFugawi 1.0.10.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\PageFocus Thumbnail 1.60.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Pager 0.9.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Panda_Platinum_Internet_Security_v8.03.00.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Peter Max 3.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\PhpGmailDrive 0.3.0a.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Pilgrim's theme 0.2.3.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Portabilizer 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Portable Offline Browser 5.2.2878 SR1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Psy Frame 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Quote Reader 4.0.575.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\RegSeeker 1.55.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Retouch Pilot Lite 3.0.4.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\SafeCache 0.9.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Sandtrap 1.6.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Secure Dial 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Shefinds 1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Simnor System Control 2007.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Site MonNak 2006 1.0.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\SOFTWIN.Bitdefender.Professional.Plus.v9.0.WinALL.Incl.License.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\SSCP Free Test Exam Questions 10.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Stuart Thompson Screensaver.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Symantec.Antivirus.10.1.5.5000.Corporate.Edition.German-MooBS.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Symantec.AntiVirus.Client.Corporate.8.1_kor.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Synopsis - Visual Programming Tool 2.0.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\SysSense 1.3.7.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared	-rox Studio 1.5.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\TalkItTypeIt 1.2.7.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\The Rocking One toolbar for IE 4.5.132.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\TimeCard Calc 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Tourism Malaysia - Sport Screensaver.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared	outes.les.clÇ¸.pour.avast.4.6.et.4.7.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\TreePad Size 1.21.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Trouts Talking Internet Clock 2.3.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Twilight Icon Pack.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\U&I Information Management System 3.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\UnAward 3.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\WatermarkIt 1.0.1.8.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\WebCam Video Plugin for Miranda 0.0.1.8.9.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Website Mentor 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Wel! QickLaunch 1.1.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\XataSoft Mail Notifier 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\XMLValidator4UE 1.0.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\YASA MP4 Video Converter 3.2.51.1827.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\Z-OpenLock 4.1 Build 07.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\ZIPCodeWorld United States Gold Edition November 2006.zip 
Deleted ! - C:\Documents and Settings
athan\Application Data\m\shared\ZoneAlarm Free 7.1.100.000.zip 
Deleted ! - "C:\Documents and Settings
athan\Application Data\m\shared"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\m"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\drivers\srosa.sys"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\drivers\srosa2.sys"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\drivers\winupgro.exe"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\drivers\downld"  
Deleted ! - "C:\Documents and Settings
athan\Application Data\drivers"  
 
»»»» Supression files in C:\DOCUME~1
athan\LOCALS~1\Temp 
 
 
»»»» Supression files in C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5 
 
Deleted ! - C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5\8BTLB79U\mxd[1].jpg    
Deleted ! - C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5\E512NQ94\b64_1[1].jpg    
Deleted ! - C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5\FF5BVH8S\b64[1].jpg    
Deleted ! - C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5\G1CMNS1R\servernames[1].htm    
Deleted ! - C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5\WVKFEJE5\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5\XCUVUK4M\b64_3[1].jpg    
Deleted ! - C:\Documents and Settings
athan\Local Settings\Temporary Internet Files\Content.IE5\ZDBZLT2H\file[1].txt    
 
--------------- [  Registry / Infected keys ] ---------------- 
 
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\srosa   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_SK9OU0S   
Deleted ! - HKEY_CURRENT_USER\Software\bisoft   
Deleted ! - HKEY_CURRENT_USER\Software\DateTime4   
Deleted ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\Local AppWizard-Generated Applications\msnmsgr   
Deleted ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\Local AppWizard-Generated Applications\winupgro   
Deleted ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\FFC   
Deleted ! - HKEY_USERS\S-1-5-21-1547161642-823518204-682003330-1011\Software\MuleAppData   
 
--------------- [ States / Restarting of services ] ---------------- 
 
+- Safe boot mode restored ! 


+- Services : [ Auto=2 / Request=3 / Disable=4 ] 

Ndisuio - Type of startup  = 3 
 
Ip6Fw - Type of startup  = 2 
 
SharedAccess - Type of startup  = 2 
 
wuauserv - Type of startup  = 2 
 
wscsvc - Type of startup  = 2 
 
 
---------------   [ Cleaning removable drives ] ----------------  
 
+- Informations : 

C: - Lecteur fixe

D: - Lecteur fixe

E: - Lecteur fixe

 
+- deleting files : 
 
 
--------------- [ Registry / Mountpoint2 ] ----------------  
 
 
 -> Not found ! 
 
 
--------------- [ Searching Other Infections ] ----------------  
 
 
Références de comparaison Bagle MD5 :

113ac36b77630a2f67dd6cb7844406a4  C:\WINDOWS\system32\mdelk.exe 
113ac36b77630a2f67dd6cb7844406a4  C:\WINDOWS\system32\wintems.exe 
0f9eeeada1694dde3b1817e2833e1a22  C:\Documents and Settings
athan\Application Data\drivers\winupgro.exe 

Suspect ! - 0f9eeeada1694dde3b1817e2833e1a22  C:\Program Files\MSN Messenger\msnmsgr.exe  
 
--------------- [ Searching Cracks / Keygen ] ----------------  
 
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r00
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r01
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r02
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r03
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r04
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r05
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r06
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r07
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r08
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r09
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.r10
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.rar
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK\fm2009-crack&patch.sfv
 
 
---------------- ! End of report ! ------------------

Utilisateur anonyme · Answer

ok 

---> Télécharge OTMoveIt3 (OldTimer) sur ton Bureau : 
http://oldtimer.geekstogo.com/OTMoveIt3.exe 

---> Double-clique sur OTMoveIt3.exe afin de le lancer. 

---> Copie (Ctrl+C) le texte suivant ci-dessous : 



:processes 
explorer.exe 

:files 
C:\Program Files\MSN Messenger\msnmsgr.exe 
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009

:commands 
[emptytemp] 
[start explorer] 
[reboot] 


---> Colle (Ctrl+V) le texte précédemment copié dans le cadre Paste Instructions for Items to be Moved. 

---> Clique maintenant sur le bouton MoveIt! puis ferme OTMoveIt3. 

Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer. 
Accepte en cliquant sur YES. 

---> Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\ 
Le nom du rapport correspond au moment de sa création : date_heure.log

toto09 · Answer

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\Program Files\MSN Messenger\msnmsgr.exe moved successfully.
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009\CRACK moved successfully.
C:\Documents and Settings
athan\Bureau\FOOTBALL_MANAGER_2009 moved successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1
athan\LOCALS~1\Temp\etilqs_dd6eHTyBzSipr6zNOO5m scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS	emp\Perflib_Perfdata_2b8.dat scheduled to be deleted on reboot.
File delete failed. C:\WINDOWS	emp\vmware-vmount.log scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully
 
OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 01152009_225455

Files moved on Reboot...
File C:\DOCUME~1
athan\LOCALS~1\Temp\etilqs_dd6eHTyBzSipr6zNOO5m not found!
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.
C:\WINDOWS	emp\Perflib_Perfdata_2b8.dat moved successfully.
C:\WINDOWS	emp\vmware-vmount.log moved successfully.
C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings
athan\Local Settings\Application Data\Mozilla\Firefox\Profiles\6bh4wyqx.default\XUL.mfl moved successfully.

Utilisateur anonyme · Answer

ok réinstal msn 

et ton antivirus , je te conseil celui ci :

Telecharge et instales l'antivirus Antivir Personal Edition Classic : 

->Antivir le telecharger

-> http://www.commentcamarche.net/telecharger/telecharger 55 antivir

tuto : https://www.malekal.com/avira-free-security-antivirus-gratuit/
tuto : http://www.swl1f.net/viewtopic.php?f=14&t=59 

ensuite désinstal findykill (option3)

et : ::

élécharge HijackThis (outils de diagnostic) ici : 

->  Fais un clic droit sur un des liens et choisi enregistrer la cible sous .... le bureau

->  http://www.trendsecure.com/portal/en-US/_download/HJTInstall.exe 
->  http://static.commentcamarche.net/www.commentcamarche.net/download/fichiers/HJTInstall.exe

-> Fais un double-clic sur HJTInstall.exe afin de lancer l'installation 

-> Clique sur Install ensuite sur I Accept 

-> Clique sur Do a scan system and save log file 

-> Le bloc-notes s'ouvrira, fais un copier-coller de tout son contenu ici dans ta prochaine réponse

toto09 · Answer

en attendant, j'aimerai me pemcher un peu plus sur l'"univers" informatique afin d'éviter de renouveler ce genre de mésaventure mais cet "univers" est tellement vaste que je ne sais pas trop par ou commencer. jai trouver un site "le journal du geek" qui explique bcp de chose mais jai des grosses lacunes au niveau du vocabulaire comme vous pouvez vous en douter. vous ne savez pas par où je pourrai commencer pour etre un peu plus caller ?? genre trainer sur des forums, ou des sites qui me permettrai daméliorer un tant soi peu mes piètre connaissance en la matière ??

toto09 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:34:49, on 15/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4apimgr.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\lotus
otes
tmulti.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\system32undll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebManager Class - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - C:\Program Files\BitDownload\TorrentManager.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [drvsyskit] C:\Documents and Settings
athan\Application Data\drivers\winupgro.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [mule_st_key] C:\Documents and Settings
athan\Application Data\m\flec006.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: FireDaemon Service: jfwproxy (jfwproxy) - Sublime Solutions Pty Ltd - C:\Program Files\FireDaemon\FireDaemon.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus
otes
tmulti.exe
O23 - Service: MySql - Unknown owner - C:/mysql44/bin/mysqld-nt.exe
O23 - Service: MySQL5 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\omtsreco.exe
O23 - Service: OracleServiceXE - Oracle Corporation - c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
O23 - Service: OracleXEClrAgent - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exe
O23 - Service: OracleXETNSListener - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\BIN	nslsnr.exe
O23 - Service: Privoxy (privoxy) (privoxy) - Unknown owner - "C:\Program Files\Privoxy\privoxy.exe" (file missing)
O23 - Service: Privoxy Internet Proxy - The Privoxy team - www.privoxy.org - C:\Program Files\Privoxy\privoxy.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

Utilisateur anonyme · Answer

hé bien tu peux trainer sur ce forum comme je l ai fais a mes débuts 

Télécharge Ad-remover ( de C_XX ) sur ton bureau ( et pas ailleurs!) : 

http://sd-1.archive-host.com/membres/up/16506160323759868/AD-R.exe

! Déconnecte toi et ferme toutes applications en cours ! 

* Clique sur "Ad-R.exe" pour lancer l'installation et laisse les paramètres d'installe par défaut . 
* Double-clique sur le raccourci Ad-remover qui est sur ton bureau pour lancer l'outil . 
* Au menu principal choisis l'option "A" et tape sur [entrée] . 

Laisse travailler l'outil et ne touche à rien ... 

--> Poste le rapport qui apparait à la fin . 

( le rapport est sauvegardé aussi sous C:\Ad-report.log ) 

( CTRL+A Pour tout selectionner , CTRL+C pour copier et CTRL+V pour coller ) 

Note : 
"Process.exe", une composante de l'outil, est détecté par certains antivirus (AntiVir, Dr.Web, Kaspersky Anti-Virus) comme étant un RiskTool. 
Il ne s'agit pas d'un virus, mais d'un utilitaire destiné à mettre fin à des processus. 
Mis entre de mauvaises mains, cet utilitaire pourrait arrêter des logiciels de sécurité (Antivirus, Firewall...) d'où l'alerte émise par ces antivirus.

toto09 · Answer

------- Logfile of AD-Remover 1.0.9.1 | ONLY XP/VISTA -------

Updated by C_XX on 14/01/2009 at 20:00

START AT: 23:46:08 | Jeu 15/01/2009 | Microsoft® Windows XP™  SP2 (v5.1.2600)
BOOT MODE: Normal
OPTION: Scan | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
PC: PENTABOSS | USER: nathan ( Current user is an administrator)
DRIVE(S): 
- C:\  (File System: NTFS)
- D:\  (File System: NTFS)
- E:\  (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\system32\

--- RUNNING PROCESSES: 37

+--------------------| Boonty/Boonty Games Elements found :

.
Service: "Boonty Games"
.
HKCR\boontybox
HKLM\Software\Boonty
HKLM\Software\Classes\boontybox
HKLM\SYSTEM\ControlSet001\Services\Boonty Games
HKLM\SYSTEM\CurrentControlSet\Services\Boonty Games
HKLM\SYSTEM\ControlSet003\Services\Boonty Games
.
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\Documents and Settings\All Users\Application Data\BOONTY
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses
C:\Documents and Settings\All Users\Application Data\BOONTY\Licenses\B45EA000.dat

+--------------------| Eorezo Elements found :

.
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\EoRezo
HKLM\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EoEngine
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Program Files\EoRezo
C:\Program Files\EoRezo\EoAdv
C:\Program Files\EoRezo\EoAdv\eoAdv.url
C:\Program Files\EoRezo\EoAdv\EoRezoBho.old

+--------------------| Everest Casino/Everest Poker Elements found :

.
.

+--------------------| FunWebProducts/MyWay/MyWebSearch/MyGlobalSearch Elements found :

.
.

+--------------------| It's TV Elements found :

.

+--------------------| Sweetim Elements found :

.
.

+--------------------| ADDED SCAN :


+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

..\6bh4wyqx.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.5 ~~~~

* Browser Search Default Engine:  "Google"
* Browser Search Selected Engine:  "Google"
* Browser Search Default Url:  "https://www.google.com/webhp?lr=&ie=UTF-8&oe=UTF-8&gws_rd=ssl"

.

+---------------------------------------------------------------------------+


~~~~ Internet Explorer version 6.0.2900.2180 ~~~~

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.google.fr/

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home

+---------------------------------------------------------------------------+

[~3138 bytes] - "C:\AD-report-Scan-15.01.2009.log"

END AT: 23:46:46 | 15/01/2009 - Time elapsed: 38.0 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 73 lines ]
+---------------------------------------------------------------------------+

toto09 · Answer

le virus est toujours la ?? findykill ne la pas supprimé ??

Utilisateur anonyme · Answer

Nettoyage AD-Remover : 

! Déconnecte toi et ferme toutes application en cours ( navigarteur compris ) ! 

* Relance "Ad-remover" : au menu principal choisis l'option "B" . 

* A l'écran de sélection ( écran ) : 

> choisis le(s) chiffre(s) suivant pour nettoyer les traces de : 

1 - "Boonty/BoontyGames" puis [entrée] 
2 - "Eorezo" puis [entrée] 


Une fois la sélection faite, tape S puis [entrée] pour lancer la suppression . 

--> le programme va travailler , ne touche à rien ... 


* Poste le rapport qui apparait à la fin + un nouvel Hijackthis pour analyse ... 

( le rapport est sauvegardé aussi sous C:\Ad-report.log ) 

/!\ Si le Bureau ne réapparait pas, presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tape explorer.exe et valide ) /!\

Utilisateur anonyme · Answer

le virus est toujours la ?? findykill ne la pas supprimé ??

si si mais il a des potes -;)

toto09 · Answer

putain le poste a poste cest fini !!!!!!!

toto09 · Answer

------- Logfile of AD-Remover 1.0.9.1 | ONLY XP/VISTA -------

Updated by C_XX on 14/01/2009 at 20:00

*** Limited to ***

Boonty/BoontyGames
Eorezo

******************

START AT: 23:54:07 | Jeu 15/01/2009 | Microsoft® Windows XP™  SP2 (v5.1.2600)
BOOT MODE: Normal
OPTION: Clean | EXECUTED FROM: C:\Program Files\Ad-remover\AD-Remover.bat
PC: PENTABOSS | USER: nathan ( Current user is an administrator)
DRIVE(S): 
- C:\  (File System: NTFS)
- D:\  (File System: NTFS)
- E:\  (File System: NTFS)
System Drive: C:\
Windows Directory: C:\WINDOWS\
System Directory: C:\WINDOWS\system32\

--- RUNNING PROCESSES: 35

(!) ---- IE start pages reset

+--------------------| Boonty/Boonty Games Elements Deleted :

.
Service: "Boonty Games"
.
HKCR\boontybox
HKLM\Software\Boonty
HKLM\SYSTEM\ControlSet003\Services\Boonty Games
.
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Documents and Settings\All Users\Application Data\BOONTY

+--------------------| Eorezo Elements Deleted :

.
HKCR\EoRezoBHO.EoBho
HKCR\EoRezoBHO.EoBho.1
HKCR\Interface\{B0D071A1-36B3-4757-A126-14C89C56013A}
HKCR\Typelib\{B4C656C9-F2E9-4E77-B3F4-443DF2BD778F}
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\EoRezo
HKLM\SOFTWARE\Classes\CLSID\{64F56FC1-1272-44CD-BA6E-39723696E350}
HKLM\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\EoEngine
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{64F56FC1-1272-44CD-BA6E-39723696E350}
.
C:\Program Files\EoRezo

(!) ---- Temp files deleted.
(!) ---- Recycle bin emptied in all drives.


+--------------------| ADDED SCAN :


+---------- Scanning prefs.js ... ( # Mozilla User Preferences )

..\6bh4wyqx.default\prefs.js :

~~~~ Mozilla FireFox version 3.0.5 ~~~~

* Browser Search Default Engine:  "Google"
* Browser Search Selected Engine:  "Google"
* Browser Search Default Url:  "https://www.google.com/webhp?lr=&ie=UTF-8&oe=UTF-8&gws_rd=ssl"

.

+---------------------------------------------------------------------------+


~~~~ Internet Explorer version 6.0.2900.2180 ~~~~

+--[HKEY_CURRENT_USER\..\Internet Explorer\MAIN]

Start Page : hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

+--[HKEY_LOCAL_MACHINE\..\Internet Explorer\MAIN]

Start Page : hxxp://fr.msn.com/

+---------------------------------------------------------------------------+

[~2471 bytes] - "C:\AD-report-Clean-15.01.2009.log"
[~3470 bytes] - "C:\AD-report-Scan-15.01.2009.log"

END AT: 23:57:13 | 15/01/2009 - Time elapsed: 3 minutes, 5 seconds 

+---------------------------------------------------------------------------+
+------------------------------- [ E.O.F - 59 lines ]
+---------------------------------------------------------------------------+

Hijack:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:59:17, on 15/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4apimgr.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\lotus
otes
tmulti.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebManager Class - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - C:\Program Files\BitDownload\TorrentManager.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [drvsyskit] C:\Documents and Settings
athan\Application Data\drivers\winupgro.exe
O4 - HKCU\..\Run: [german.exe] C:\WINDOWS\system32\wintems.exe
O4 - HKCU\..\Run: [mule_st_key] C:\Documents and Settings
athan\Application Data\m\flec006.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: FireDaemon Service: jfwproxy (jfwproxy) - Sublime Solutions Pty Ltd - C:\Program Files\FireDaemon\FireDaemon.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus
otes
tmulti.exe
O23 - Service: MySql - Unknown owner - C:/mysql44/bin/mysqld-nt.exe
O23 - Service: MySQL5 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\omtsreco.exe
O23 - Service: OracleServiceXE - Oracle Corporation - c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
O23 - Service: OracleXEClrAgent - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exe
O23 - Service: OracleXETNSListener - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\BIN	nslsnr.exe
O23 - Service: Privoxy (privoxy) (privoxy) - Unknown owner - "C:\Program Files\Privoxy\privoxy.exe" (file missing)
O23 - Service: Privoxy Internet Proxy - The Privoxy team - www.privoxy.org - C:\Program Files\Privoxy\privoxy.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

Utilisateur anonyme · Answer

ok t es un chef ,


Télécharge JavaRa.zip de Paul 'Prm753' McLain et Fred de Vries. 
Décompresse le fichier sur ton bureau (clique droit > Extraire tout.) 
Double-clique sur le répertoire JavaRa obtenu. 
Puis double-clique sur le fichier JavaRa.exe (le .exe peut ne pas s'afficher) 
Clique sur Search For Updates. 
Sélectionne Update Using jucheck.exe puis clique sur Search. 
Autorise le processus à se connecter s'il te le demande, clique sur Install et suis les instructions d'installation. Cela prendra quelques minutes. 
Quand l'installation est terminée, revient à l'écran de JavaRa et clique sur Remove Older Versions. 
Clique sur Oui pour confirmer. L'outil va travailler, clique ensuite sur Ok, puis une deuxième fois sur Ok. 
Un rapport va s'ouvrir, copie-colle le dans ta prochaine réponse. 
Note : le rapport se trouve aussi à la racine de la partition système, en général C:\ sous le nom JavaRa.log 
(c:\JavaRa.log) 
Ferme l'application. 

ensuite :

-> Télécharge Ccleaner (n'installe pas la barre d'outil Yahoo): 


http://download.piriform.com/ccsetup210.exe

https://www.01net.com/telecharger/windows/Utilitaire/nettoyeurs_et_installeurs/fiches/32599.html

-> Tuto : https://www.malekal.com/tutoriel-ccleaner/ (fais registre : corriger les erreures et lancer le nettoyage)

ensuite :


regarde ceci concernant avast : 

antivir vs avast : 

-> http://forum.malekal.com/ftopic3528.php 


alors je te conseille de le desinstaller et d´installer antivir a la place 

Telecharge et instales l'antivirus Antivir Personal Edition Classic : 

->Antivir le telecharger

-> http://www.commentcamarche.net/telecharger/telecharger 55 antivir

tuto : https://www.malekal.com/avira-free-security-antivirus-gratuit/
tuto : http://www.swl1f.net/viewtopic.php?f=14&t=59 

Pour désinstaller Avast telecharge cet outil


et ensuite un nouveau hijackthis stp

toto09 · Answer

JavaRa 1.12 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Fri Jan 16 00:11:15 2009

Found and removed: C:\Program Files\Java\jre1.5.0_06

Found and removed: C:\Program Files\Java\jre1.5.0_09

Found and removed: Software\JavaSoft\Java2D\1.5.0_03

Found and removed: Software\JavaSoft\Java2D\1.5.0_05

Found and removed: Software\JavaSoft\Java2D\1.5.0_09

Found and removed: Software\JavaSoft\Java2D\1.5.0_11

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Classes\JavaPlugin.150_06

Found and removed: SOFTWARE\Classes\JavaPlugin.150_09

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_06

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.5.0_09

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_06

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.5.0_09

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510006

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D510009

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510006

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D510009

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150060}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0150090}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_06

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.5.0_09

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.5.0_06\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Java\jre1.5.0_09\

------------------------------------

Finished reporting.



AVS scan



Avira AntiVir Personal
Date de création du fichier de rapport : vendredi 16 janvier 2009  00:13

La recherche porte sur 1038808 souches de virus.

Détenteur de la licence :Avira AntiVir PersonalEdition Classic
Numéro de série : 0000149996-ADJIE-0001
Plateforme :      Windows XP
Version de Windows :(Service Pack 2)  [5.1.2600]
Mode Boot :       Démarré normalement
Identifiant :     nathan
Nom de l'ordinateur :PENTABOSS

Informations de version :
BUILD.DAT     : 8.2.0.52       16931 Bytes  02/12/2008 14:55:00
AVSCAN.EXE    : 8.1.4.10      315649 Bytes  18/11/2008 08:21:00
AVSCAN.DLL    : 8.1.4.1        49921 Bytes  21/07/2008 13:44:27
LUKE.DLL      : 8.1.4.5       164097 Bytes  12/06/2008 12:44:16
LUKERES.DLL   : 8.1.4.0        13057 Bytes  04/07/2008 07:30:27
ANTIVIR0.VDF  : 7.1.0.0     15603712 Bytes  27/10/2008 11:30:36
ANTIVIR1.VDF  : 7.1.0.56      411136 Bytes  09/11/2008 16:57:13
ANTIVIR2.VDF  : 7.1.0.89      221184 Bytes  16/11/2008 16:16:47
ANTIVIR3.VDF  : 7.1.0.97       45056 Bytes  17/11/2008 16:38:59
Version du moteur: 8.2.0.31  
AEVDF.DLL     : 8.1.0.6       102772 Bytes  14/10/2008 10:05:56
AESCRIPT.DLL  : 8.1.1.15      332156 Bytes  11/11/2008 14:00:07
AESCN.DLL     : 8.1.1.5       123251 Bytes  07/11/2008 15:06:41
AERDL.DLL     : 8.1.1.3       438645 Bytes  04/11/2008 13:58:38
AEPACK.DLL    : 8.1.3.4       393591 Bytes  11/11/2008 09:41:39
AEOFFICE.DLL  : 8.1.0.30      196986 Bytes  07/11/2008 15:06:41
AEHEUR.DLL    : 8.1.0.71     1487222 Bytes  07/11/2008 15:06:41
AEHELP.DLL    : 8.1.1.3       119157 Bytes  07/11/2008 15:06:41
AEGEN.DLL     : 8.1.1.0       319859 Bytes  07/11/2008 15:06:41
AEEMU.DLL     : 8.1.0.9       393588 Bytes  14/10/2008 10:05:56
AECORE.DLL    : 8.1.4.1       172405 Bytes  07/11/2008 15:06:41
AEBB.DLL      : 8.1.0.3        53618 Bytes  14/10/2008 10:05:56
AVWINLL.DLL   : 1.0.0.12       15105 Bytes  09/07/2008 08:40:02
AVPREF.DLL    : 8.0.2.0        38657 Bytes  16/05/2008 09:27:58
AVREP.DLL     : 8.0.0.2        98344 Bytes  31/07/2008 12:02:15
AVREG.DLL     : 8.0.0.1        33537 Bytes  09/05/2008 11:26:37
AVARKT.DLL    : 1.0.0.23      307457 Bytes  12/02/2008 08:29:19
AVEVTLOG.DLL  : 8.0.0.16      119041 Bytes  12/06/2008 12:27:46
SQLITE3.DLL   : 3.3.17.1      339968 Bytes  22/01/2008 17:28:02
SMTPLIB.DLL   : 1.2.0.23       28929 Bytes  12/06/2008 12:49:36
NETNT.DLL     : 8.0.0.1         7937 Bytes  25/01/2008 12:05:07
RCIMAGE.DLL   : 8.0.0.51     2371841 Bytes  04/07/2008 07:23:16
RCTEXT.DLL    : 8.0.52.1       86273 Bytes  17/07/2008 10:08:43

Configuration pour la recherche actuelle :
Nom de la tâche..................: Répertoire système Windows
Fichier de configuration.........: C:\Program Files\Avira\AntiVir PersonalEdition Classic\setupprf.dat
Documentation....................: bas
Action principale................: interactif
Action secondaire................: ignorer
Recherche sur les secteurs d'amorçage maître: marche
Recherche sur les secteurs d'amorçage: marche
Secteurs d'amorçage..............: C:, 
Recherche dans les programmes actifs: marche
Recherche en cours sur l'enregistrement: marche
Recherche de Rootkits............: arrêt
Fichier mode de recherche........: Sélection de fichiers intelligente
Recherche sur les archives.......: marche
Limiter la profondeur de récursivité: 20
Archive Smart Extensions.........: marche
Heuristique de macrovirus........: marche
Heuristique fichier..............: moyen

Début de la recherche : vendredi 16 janvier 2009  00:13

La recherche sur les processus démarrés commence :
Processus de recherche 'avscan.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avgnt.exe' - '1' module(s) sont contrôlés
Processus de recherche 'avguard.exe' - '1' module(s) sont contrôlés
Processus de recherche 'sched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'antivir_workstation_winu_fr_h.exe' - '1' module(s) sont contrôlés
Processus de recherche 'notepad.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiprvse.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wmiapsrv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'jqs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'msiexec.exe' - '1' module(s) sont contrôlés
Processus de recherche 'JavaRa.exe' - '1' module(s) sont contrôlés
Processus de recherche 'HijackThis.exe' - '1' module(s) sont contrôlés
Processus de recherche 'firefox.exe' - '1' module(s) sont contrôlés
Processus de recherche 'explorer.exe' - '1' module(s) sont contrôlés
Processus de recherche 'alg.exe' - '1' module(s) sont contrôlés
Processus de recherche 'vmnetdhcp.exe' - '1' module(s) sont contrôlés
Processus de recherche 'vmnat.exe' - '1' module(s) sont contrôlés
Processus de recherche 'vmount2.exe' - '1' module(s) sont contrôlés
Processus de recherche 'vmware-authd.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'StarWindService.exe' - '1' module(s) sont contrôlés
Processus de recherche 'SMAgent.exe' - '1' module(s) sont contrôlés
Processus de recherche 'tcpsvcs.exe' - '1' module(s) sont contrôlés
Processus de recherche 'nvsvc32.exe' - '1' module(s) sont contrôlés
Processus de recherche 'ntmulti.exe' - '1' module(s) sont contrôlés
Processus de recherche 'cvpnd.exe' - '1' module(s) sont contrôlés
Processus de recherche 'AppleMobileDeviceService.exe' - '1' module(s) sont contrôlés
Processus de recherche 'rapimgr.exe' - '1' module(s) sont contrôlés
Processus de recherche 'wcescomm.exe' - '1' module(s) sont contrôlés
Processus de recherche 'realsched.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winampa.exe' - '1' module(s) sont contrôlés
Processus de recherche 'CloneCDTray.exe' - '1' module(s) sont contrôlés
Processus de recherche 'daemon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'spoolsv.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'svchost.exe' - '1' module(s) sont contrôlés
Processus de recherche 'lsass.exe' - '1' module(s) sont contrôlés
Processus de recherche 'services.exe' - '1' module(s) sont contrôlés
Processus de recherche 'winlogon.exe' - '1' module(s) sont contrôlés
Processus de recherche 'csrss.exe' - '1' module(s) sont contrôlés
Processus de recherche 'smss.exe' - '1' module(s) sont contrôlés
'44' processus ont été contrôlés avec '44' modules

La recherche sur les secteurs d'amorçage maître commence :
Secteur d'amorçage maître HD0
    [INFO]      Aucun virus trouvé !
Secteur d'amorçage maître HD1
    [INFO]      Aucun virus trouvé !

La recherche sur les secteurs d'amorçage commence :
Secteur d'amorçage 'C:\'
    [INFO]      Aucun virus trouvé !

La recherche sur les renvois aux fichiers exécutables (registre) commence.
Le registre a été contrôlé ( '56' fichiers).


La recherche sur les fichiers sélectionnés commence :

Recherche débutant dans 'C:\WINDOWS\system32'
C:\WINDOWS\system32\drivers\sptd.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !
C:\WINDOWS\system32\drivers\sptd5421.sys
    [AVERTISSEMENT] Impossible d'ouvrir le fichier !


Fin de la recherche : vendredi 16 janvier 2009  00:16
Temps nécessaire: 02:22 Minute(s)

La recherche a été effectuée intégralement

    206 Les répertoires ont été contrôlés
   5848 Des fichiers ont été contrôlés
      0 Des virus ou programmes indésirables ont été trouvés
      0 Des fichiers ont été classés comme suspects
      0 Des fichiers ont été supprimés
      0 Des virus ou programmes indésirables ont été réparés
      0 Les fichiers ont été déplacés dans la quarantaine
      0 Les fichiers ont été renommés
      2 Impossible de contrôler des fichiers
   5846 Fichiers non infectés
      9 Les archives ont été contrôlées
      2 Avertissements
      0 Consignes

Hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:21:03, on 16/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MICROS~4apimgr.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\lotus
otes
tmulti.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings
athan\Bureau\JavaRa\JavaRa.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avscan.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebManager Class - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - C:\Program Files\BitDownload\TorrentManager.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: FireDaemon Service: jfwproxy (jfwproxy) - Sublime Solutions Pty Ltd - C:\Program Files\FireDaemon\FireDaemon.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus
otes
tmulti.exe
O23 - Service: MySql - Unknown owner - C:/mysql44/bin/mysqld-nt.exe
O23 - Service: MySQL5 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\omtsreco.exe
O23 - Service: OracleServiceXE - Oracle Corporation - c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
O23 - Service: OracleXEClrAgent - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exe
O23 - Service: OracleXETNSListener - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\BIN	nslsnr.exe
O23 - Service: Privoxy (privoxy) (privoxy) - Unknown owner - "C:\Program Files\Privoxy\privoxy.exe" (file missing)
O23 - Service: Privoxy Internet Proxy - The Privoxy team - www.privoxy.org - C:\Program Files\Privoxy\privoxy.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

Utilisateur anonyme · Answer

t as été vite 

comment va le pc ??

toto09 · Answer

il vient de rebooter. lorsque jai double cliquer sur mon icone de windows live messenger jai peur davoir involontairement réactiver winupgro. estce le cas ?? si oui envoie moi un trojan que je meurs une bonne fois pour toute de désespoir...

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:33:05, on 16/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\lotus
otes
tmulti.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\System32	cpsvcs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: e-Carte Bleue Browser Helper Object - {2E03C0FD-4C48-43A7-9A54-00240C70FF16} - C:\WINDOWS\system32\BhoECart.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebManager Class - {D5792AA9-D373-4039-8670-2CDAB6A71F15} - C:\Program Files\BitDownload\TorrentManager.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [drvsyskit] C:\Documents and Settings
athan\Application Data\drivers\winupgro.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Créer un Favori de l'appareil mobile... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Planificateur Avira AntiVir Personal - Free Antivirus (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: FireDaemon Service: jfwproxy (jfwproxy) - Sublime Solutions Pty Ltd - C:\Program Files\FireDaemon\FireDaemon.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - C:\Program Files\lotus
otes
tmulti.exe
O23 - Service: MySql - Unknown owner - C:/mysql44/bin/mysqld-nt.exe
O23 - Service: MySQL5 - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oraclexe\app\oracle\product\10.2.0\server\BIN\omtsreco.exe
O23 - Service: OracleServiceXE - Oracle Corporation - c:\oraclexe\app\oracle\product\10.2.0\server\bin\ORACLE.EXE
O23 - Service: OracleXEClrAgent - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\bin\OraClrAgnt.exe
O23 - Service: OracleXETNSListener - Unknown owner - C:\oraclexe\app\oracle\product\10.2.0\server\BIN	nslsnr.exe
O23 - Service: Privoxy (privoxy) (privoxy) - Unknown owner - "C:\Program Files\Privoxy\privoxy.exe" (file missing)
O23 - Service: Privoxy Internet Proxy - The Privoxy team - www.privoxy.org - C:\Program Files\Privoxy\privoxy.exe
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Lite XII.SP1\RpcSandraSrv.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

toto09 · Answer

je suis dégouté

Utilisateur anonyme · Answer

lorsque jai double cliquer sur mon icone de windows live messenger jai peur davoir involontairement réactiver winupgro

antivir a réagit ??

Utilisateur anonyme · Answer

arf 

Telecharge FindyKill sur ton bureau :

--> Lance l installation avec les parametres par default

--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 1 (Recherche)

--> Post le rapport FindyKill.txt 

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque

Tuto : malekal
Tuto : 01net

Utilisateur anonyme · Answer

non pas payé 

d ailleurs vé en causer xd

Utilisateur anonyme · Answer

donc oui je confirme t es raprti pour un tour 

mais t inkiete 

dis moi eplique ce que tu as fais :

lorsque jai double cliquer sur mon icone de windows live messenger jai peur davoir involontairement réactiver winupgro 


soit precis stp et :

fais juste ce que je te demande rien d autre :


--> Double clic sur le raccourci FindyKill sur ton bureau

--> Au menu principal,choisi l option 2 (Suppression)


/!\ il y aura 2 redémarrage, laisse travailler l outils jusqu a l apparition du message "Cleaning complete"

/!\ Ne te sert pas du pc durant la suppression , ton bureau ne sera pas accessible c est normal !

-------> ensuite post le rapport FindyKill.txt

Note : le rapport FindyKill.txt est sauvegardé a la racine du disque
Note : Si le Bureau ne réapparait pas presse Ctrl + Alt + Suppr , Onglet "Fichier" , "Nouvelle tâche" , tapes explorer.exe et valides

Utilisateur anonyme · Answer

c un passe temps :

http://www.commentcamarche.net/forum/affich 10518977 virus winupgro?page=2#41

Utilisateur anonyme · Answer

oué c net 

oki fé ceci stp :


Télécharge combofix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

Avant de telecharger clic sur enregistrer renome le en killbagle et enregistre le sur le bureau 


-> Double clique sur killbagle.exe. 
-> Tape sur la touche 1 (Yes) pour démarrer le scan. 
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt 

Avant d'utiliser ComboFix : 

-> Déconnecte toi d'internet et referme les fenêtres de tous les programmes en cours. 


Une fois fait, sur ton bureau double-clic sur killbagle.exe. 

- Répond oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc. 

/!\ Pendant la durée de cette étape, ne te sert pas du pc et n'ouvre aucun programmes. 

- En fin de scan il est possible que ComboFix ait besoin de redemarrer le pc pour finaliser la désinfection\recherche, laisses-le faire. 

- Un rapport s'ouvrira ensuite dans le bloc notes, ce fichier rapport Combofix.txt, est automatiquement sauvegardé et rangé à C:\Combofix.txt) 


-> Reviens sur le forum, et copie et colle la totalité du contenu de C:\Combofix.txt dans ton prochain message.

toto09 · Answer

le fichier va faire un back up de mes données ??

Utilisateur anonyme · Answer

vi c mieux

Utilisateur anonyme · Answer

oui t inkiete 

combofix va surtout ton bagle

Utilisateur anonyme · Answer

bagle est un ver informatique 

tu le chope via la p2p avec les cracks avant il passait via mails


tu t es réinfecté car tu m a pas écouté et aussi car le fix (le mien) que je t ai fais utilisé a des lacunes 

tu a cliké sur l exe "patché" par bagle ce qui recollé l infection

breff passe combofix et on nettoie et dodo -;)

Utilisateur anonyme · Answer

breff 

a demain

Utilisateur anonyme · Answer

OK Désinstal messenger etréinstal idem pour l antivirus 

si tufais ça a 16 h ça ira

bonne nuit 

++

Virus winupgro

44 réponses

Discussions similaires

Newsletters