Trojan CHOPHAR.A

valérie -  
Bonjour,

Mon ordi est infecté par TROJ_CHOPHAR.A
L'antivirus (PC CILLIN de Trend Micro) le détecte, le met en quarantaine mais il revient sans arrêt.
D'autre part j'ai fait SPYBOT et AD-AWARE qui détectent (et nettoient ) sans arrêt CoolWWWSearch.Yexe ou .WCADW.
Cette infection perturbe l'affichage de la page d'internet explorer.
Au départ, à l'ouverture d'internet une page http:/secure 32 s'ouvrait et dans la barre d'adresse se déroulait le contenu du PC (style explorateur).
J'ai supprimé avec Chaos Schreder l'indication secure 32.html.
Voici ce que donne le scan en ligne de BitDefender :
C:\!Submit\05-29-2005\alledit.dll: infected with Adware.Look2me.AB
C:\!Submit\05-29-2005\aului.dll: infected with Adware.Look2me
C:\!Submit\05-29-2005\az18051ue.dll: infected with Adware.Look2me
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW1.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW1.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW10.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW10.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW11.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW11.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW12.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW12.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW13.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW13.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW14.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW14.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW15.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW15.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW16.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW16.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW17.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW17.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW18.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW18.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW19.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW19.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW2.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW2.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW20.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW20.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW21.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW21.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW22.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW22.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW23.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW23.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW3.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW3.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW4.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW4.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW5.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW5.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW6.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW6.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW7.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW7.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW8.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW8.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW9.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchWCADW9.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe1.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe1.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe2.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe2.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe3.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe3.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe4.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe4.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe5.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe5.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe6.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe6.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe7.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe7.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe8.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe8.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe9.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchYexe9.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit1.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit1.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit10.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit10.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit11.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit11.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit12.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit12.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit13.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit13.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit14.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit14.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit15.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit15.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit16.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit16.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit17.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit17.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit18.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit18.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit19.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit19.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit2.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit2.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit20.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit20.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit21.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit21.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit22.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit22.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit23.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit23.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit24.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit24.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit25.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit25.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit26.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit26.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit27.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit27.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit28.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit28.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit29.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit29.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit3.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit3.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit30.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit30.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit31.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit31.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit32.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit32.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit33.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit33.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit34.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit34.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit35.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit35.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit36.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit36.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit37.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit37.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit38.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit38.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit39.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit39.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit4.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit4.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit40.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit40.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit41.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit41.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit42.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit42.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit43.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit43.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit44.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit44.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit45.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit45.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit46.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit46.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit47.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit47.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit5.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit5.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit6.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit6.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit7.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit7.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit8.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit8.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit9.zip=>sbRecovery.reg: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DSOExploit9.zip=>sbRecovery.ini: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\TIBS.zip=>ms1.exe: password protected
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\TIBS.zip=>sbRecovery.ini: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>arrow1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>arrow2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bck1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bck2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt11.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt12.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt13.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt21.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt22.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt23.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt31.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt32.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt33.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt41.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt42.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt43.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt51.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt52.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt53.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt61.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>bt62.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox3.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>checkbox4.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>default.skn: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>defbtn3.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph2.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph3.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph4.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph5.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph6.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>glyph7.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>main.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>preview.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>sprite1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>tab1.bmp: password protected
C:\Program Files\Lavasoft\Ad-Aware SE Personal\Skins\Ad-Aware SE default.ask=>tab2.bmp: password protected
C:\System Volume Information\_restore{1D3CE8F7-B48B-444B-8B2D-2C75DF3C00FB}\RP179\A0070147.exe: suspect Generic.Malware.Mdld.6BFBFE04
C:\WINDOWS\inet20003\mm4.exe: suspect Generic.Malware.Mdld.6BFBFE04
C:\WINDOWS\inet20003\mm4.exe.bak: suspect Generic.Malware.Mdld.6BFBFE04
C:\WINDOWS\inet20003\services.exe: suspect Generic.Malware.Sdld.5EA03D19
C:\WINDOWS\kl.exe: infected with Trojan.Spy.Agent.JL
C:\WINDOWS\system32\amivvaxx.dll: infected with Adware.Look2me
C:\WINDOWS\system32\awi2dvag.dll: infected with Adware.Look2me
C:\WINDOWS\system32\aycups.dll: infected with Adware.Look2me
C:\WINDOWS\system32\bvowselc.dll: infected with Adware.Look2me
C:\WINDOWS\system32\cVtsrvut.dll: infected with Adware.Look2me
C:\WINDOWS\system32\dCdramp.dll: infected with Adware.Look2me
C:\WINDOWS\system32\dfsapi.dll: infected with Adware.Look2me
C:\WINDOWS\system32\djlayx.dll: infected with Adware.Look2me
C:\WINDOWS\system32\dkgeng.dll: infected with Adware.Look2me
C:\WINDOWS\system32\dumsrpcn.dll: infected with Adware.Look2me
C:\WINDOWS\system32\dwnhpast.dll: infected with Adware.Look2me
C:\WINDOWS\system32\EGAPI2.dll: infected with Adware.Look2me
C:\WINDOWS\system32\eifpixio130.dll: infected with Adware.Look2me
C:\WINDOWS\system32\enrml1911.dll: infected with Adware.Look2me
C:\WINDOWS\system32\eocwiab.dll: infected with Adware.Look2me
C:\WINDOWS\system32\exent97.dll: infected with Adware.Look2me
C:\WINDOWS\system32\EZBTEG.DLL: infected with Adware.Look2me
C:\WINDOWS\system32\fbsrch.dll: infected with Adware.Look2me
C:\WINDOWS\system32\gD402ghmg64a2.dll: infected with Adware.Look2me
C:\WINDOWS\system32\HKActiveX.dll: infected with Adware.Look2me
C:\WINDOWS\system32\ibseng.dll: infected with Adware.Look2me
C:\WINDOWS\system32\iCssam.dll: infected with Adware.Look2me
C:\WINDOWS\system32\iFspolcy.dll: infected with Adware.Look2me
C:\WINDOWS\system32\igenginenew.dll: infected with Adware.Look2me
C:\WINDOWS\system32\igv6mon.dll: infected with Adware.Look2me
C:\WINDOWS\system32\JCGI500.DLL: infected with Adware.Look2me
C:\WINDOWS\system32\JDGI500.DLL: infected with Adware.Look2me
C:\WINDOWS\system32\jkcript.dll: infected with Adware.Look2me
C:\WINDOWS\system32\kmdno1.dll: infected with Adware.Look2me
C:\WINDOWS\system32\kndusx.dll: infected with Adware.Look2me
C:\WINDOWS\system32\mgsap.dll: infected with Adware.Look2me
C:\WINDOWS\system32\minetobj.dll: infected with Adware.Look2me
C:\WINDOWS\system32\mJrmla911d.dll: infected with Adware.Look2me
C:\WINDOWS\system32\mnw3prt.dll: infected with Adware.Look2me
C:\WINDOWS\system32\mqpmsnsv.dll: infected with Adware.Look2me
C:\WINDOWS\system32\mujet40.dll: infected with Adware.Look2me
C:\WINDOWS\system32\murepl40.dll: infected with Adware.Look2me
C:\WINDOWS\system32\mwglibnt.dll: infected with Adware.Look2me
C:\WINDOWS\system32\mwidle.dll: infected with Adware.Look2me
C:\WINDOWS\system32\nqobjapi.dll: infected with Adware.Look2me
C:\WINDOWS\system32\nqxpnt.dll: infected with Adware.Look2me
C:\WINDOWS\system32\nsprovau.dll: infected with Adware.Look2me
C:\WINDOWS\system32\nstmsg.dll: infected with Adware.Look2me
C:\WINDOWS\system32\oabc16gt.dll: infected with Adware.Look2me
C:\WINDOWS\system32\oqbccr32.dll: infected with Adware.Look2me
C:\WINDOWS\system32\paytime.exe: suspect GenPack:Generic.Malware.Ssp.C295E597
C:\WINDOWS\system32\pjcCllct.dll: infected with Adware.Look2me
C:\WINDOWS\system32\pkchdprf.dll: infected with Adware.Look2me
C:\WINDOWS\system32\rFsman.dll: infected with Adware.Look2me
C:\WINDOWS\system32\scdocvw.dll: infected with Adware.Look2me
C:\WINDOWS\system32\siredir.dll: infected with Adware.Look2me
C:\WINDOWS\system32\smdocvw.dll: infected with Adware.Look2me
C:\WINDOWS\system32\srarddlg.dll: infected with Adware.Look2me
C:\WINDOWS\system32\swlgntfy.dll: infected with Adware.Look2me
C:\WINDOWS\system32\sxc_os.dll: infected with Adware.Look2me
C:\WINDOWS\system32\sypblb.dll: infected with Adware.Look2me
C:\WINDOWS\system32\tVpi32.dll: infected with Adware.Look2me
C:\WINDOWS\system32\uglmon.dll: infected with Adware.Look2me
C:\WINDOWS\system32\whspdmoe.dll: infected with Adware.Look2me
C:\WINDOWS\system32\wjaudsdk.dll: infected with Adware.Look2me
C:\WINDOWS\system32\wP2time.dll: infected with Adware.Look2me
C:\WINDOWS\system32\wqvdmoe.dll: infected with Adware.Look2me
C:\WINDOWS\system32\wrbvw.dll: infected with Adware.Look2me
C:\WINDOWS\system32\wU2time.dll: infected with Adware.Look2me
C:\WINDOWS\system32\xvnroll.dll: infected with Adware.Look2me
C:\WINDOWS\tool1.exe: infected with BehavesLike:Win32.ExplorerHijack

Je suis donc au bout de mes ressources... Ce serait sympa de me donner un coup de main (Balltrap, Régis ??? ou autre !!). Merci
Configuration: WINDOWS XP

31 réponses

Résumé de la discussion

Des symptômes d'infection apparaissent avec TROJ_CHOPHAR.A détecté par Trend Micro, qui le met en quarantaine mais le voit réapparaître continuellement, accompagnés de perturbations d'affichage dans Internet Explorer. Des outils tels que Spybot et Ad-Aware détectent et nettoient des composants comme Look2me et CoolWWWSearchWCADW, mais des archives de récupération protégées et des éléments cryptés compliquent le nettoyage et la suppression durable. Par ailleurs, un scan en ligne BitDefender énumère des fichiers infectés, notamment des dll liées à Look2me et de nombreuses Recovery protégées par mot de passe, indiquant une infection étendue et complexe.

Bobot (l’IA à votre service)
  2. bernie61
    resalut
    si tu utilise bien ce pgm pour des images sur mobile alors ok sinon désinstalle car suspect
    C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe

    rien d'autre pour moi, ok bon surf a+
    1. valérie
      re

      je ne l'utilise pas du tout je vais le supprimer

      je te remercie encore pour ton aide (c'est la 2ème fois que je fais appel à ce forum) et ravie pour tout !!!

      A ;)
  3. valérie
    Re

    J'avais déjà supp les ibm 00001 mais je n'ai pas supp le dossier inet 2003
    j'ai fait un hijackthis (voir post 31)
    Pour le moment tt va bien
    plus de fenêtre à l'ouverture d'internet
    Y a t il autre chose à faire ?
    En tt cas merci de ton aide et bravo à toi et régis.

    A+
    1. bernie61
      re
      oui tu effaces tous les ibm000 peu importe l'extension

      efface le répertoire inet2003 aussi, pas rien que le contenu
      a+
      2. valérie
        Bonjour,

        J'ai qq précisions à demander.
        Je suis la méthode du post 29 . Tu écris :
        Vide tes fichiers temps et temporary internet file:

        :: Supprimer les fichiers temporaires ::
        vider tout le contenu de ces dossiers.

        :: Le contenu du dossier prefetch
        * C:\WINDOWS\Prefetch <= sauf le fichier layout.ini

        ce dossier est déjà vide ,i l n'y a même pas layout.ini

        ¤C:\WINDOWS\inet20003 : IL EST VIDE

        C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.exe : JE NE TROUVE QUE ibm00001 (sans .exe)
        et ibm00001.dll

        Sur quoi je dois agir avt de passer à la suite ?

        Je t'écris d'un autre poste car l'autre ordi est tjrs en mode ss échec
        Merci

        A+
        1. Utilisateur anonyme
          Bonjour,

          Méthode à suivre dans l'ordre...
          ----------------------------------------------------------------------------
          ¤Télécharge ces logiciels mais que tu n‘utilises pas tout de suite:

          1/

          Spybot S&D 1.4 <<nouvelle version.
          http://www.safer-networking.org/fr/index.html

          Démo d’utilisation (merci à Balltrap34 pour cette réalisation).
          http://pageperso.aol.fr/Balltrap34/demo%20spybot.htm

          2/

          Ad-Aware SE 1.06 <<nouvelle version.
          http://www.lavasoftusa.com/software/adaware/
          -Une aide:
          http://www.tutopat.com/viewtopic.php?t=1191
          - installe le patch français, tu pourras le trouver ici:
          http://download.lavasoft.de.edgesuite.net/public/pllangs.exe
          et une petite vidéo d'utilisation ici:(merci à Moe31 pour cette réalisation).
          http://pageperso.aol.fr/balltrap34/adawrevid.asf
          ----------------------------------------------------------------------------
          ¤Affiche tous les fichiers et dossiers :
          Clique sur démarrer/panneau de configuration/outil/option des dossiers/affichage

          Coche « afficher les fichiers et dossiers cachés »

          Décoche la case "Masquer les fichiers protégés du système d'exploitation (recommandé)"

          Décoche « masquer les extensions dont le type est connu »
          Puis fais «Ok» pour valider les changements.

          Et appliquer !
          ----------------------------------------------------------------------------
          ¤Relance HijackThis, coche les cases devant ces lignes et ensuite clique sur fix checked :

          F3 - REG:win.ini: run=C:\WINDOWS\inet20003\services.exe

          O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)

          O4 - HKLM\..\Run: [second] C:\Documents and Settings\Val‚rie\Bureau\l2mfix\second.bat

          O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe

          O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe

          O4 - HKCU\..\Run: [Shell] "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.exe"

          O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe

          ----------------------------------------------------------------------------
          ¤Démarre en mode sans échec :
          Pour cela, tu tapotes la touche F8 dès le début de l’allumage du pc sans t’arrêter
          Une fenêtre va s’ouvrir tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
          Une fois sur le bureau s’il n’y a pas toutes les couleurs et autres c’est normal !
          (Si F8 ne marche pas utilise la touche F5).
          ----------------------------------------------------------------------------
          ¤Vide tes fichiers temps et temporary internet file:

          :: Supprimer les fichiers temporaires ::
          vider tout le contenu de ces dossiers.

          * C:\Documents and Settings\ton compte\Local Settings\Temp
          * C:\Documents and Settings\tous les autres comptes\Local Settings\Temp
          * C:\Windows\Temp

          :: Le contenu du dossier prefetch ::

          * C:\WINDOWS\Prefetch <= sauf le fichier layout.ini

          * Ne pas oublier de vider la corbeille !
          ----------------------------------------------------------------------------
          ¤Recherche et supprime ceci:
          attention seulement les fichiers (si présents).

          C:\WINDOWS\inet20003

          C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.exe

          ----------------------------------------------------------------------------
          ¤ Passe Ad-Aware et supprime tout ce qu’il trouve + supprime les quarantaines…
          ----------------------------------------------------------------------------
          ¤ Passe Spybot et corrige tout ce qu’il trouve + vaccine + supprime les quarantaines…
          ----------------------------------------------------------------------------
          ¤ Vide ta Corbeille.
          ----------------------------------------------------------------------------
          ¤ Redémarre en mode normal, relance Hijackthis et copie/colle un nouveau rapport sur le forum.

          Précise tes soucis s’il en reste....

          Tiens-moi au courant

          A+
          1. valérie
            Re

            Par rapport au post 30, j'ai pris qq initiatives :

            j'ai dc supp ibm00001 même sans la mention .exe et les dll qui s'y rapportaient crées à l'heure de l'invasion par le trojan (?)
            puis Ad Aware et Spybot

            voici l'hijackthis qui en résulte :

            Logfile of HijackThis v1.99.0
            Scan saved at 14:14:39, on 07/01/2006
            Platform: Windows XP SP2 (WinNT 5.01.2600)
            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

            Running processes:
            C:\WINDOWS\System32\smss.exe
            C:\WINDOWS\system32\winlogon.exe
            C:\WINDOWS\system32\services.exe
            C:\WINDOWS\system32\lsass.exe
            C:\WINDOWS\system32\svchost.exe
            C:\WINDOWS\System32\svchost.exe
            C:\WINDOWS\system32\spoolsv.exe
            C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
            C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
            c:\fotowin\RTETPISv.exe
            C:\WINDOWS\System32\svchost.exe
            C:\Program Files\Trend Micro\Tmntsrv.exe
            C:\WINDOWS\Explorer.EXE
            C:\Program Files\Trend Micro\PCCPFW.exe
            C:\Program Files\Winamp\winampa.exe
            C:\WINDOWS\htpatch.exe
            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
            C:\Program Files\iTunes\iTunesHelper.exe
            C:\Program Files\QuickTime\qttask.exe
            C:\Program Files\Trend Micro\pccguide.exe
            C:\Program Files\Trend Micro\PCCClient.exe
            C:\Program Files\Trend Micro\Pop3trap.exe
            C:\Program Files\MessengerPlus! 3\MsgPlus.exe
            C:\Program Files\Java\jre1.5.0\bin\jusched.exe
            C:\WINDOWS\system32\ctfmon.exe
            C:\Program Files\iPod\bin\iPodService.exe
            C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe
            C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
            C:\Program Files\Trend Micro\WebTrap.EXE
            C:\WINDOWS\system32\wuauclt.exe
            C:\Documents and Settings\Valérie\Mes documents\utilitaires\HijackThis.exe

            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
            O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
            O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
            O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
            O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
            O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
            O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\pccguide.exe"
            O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PCCClient.exe"
            O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\Pop3trap.exe"
            O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
            O4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe" tray
            O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
            O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
            O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
            O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
            O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
            O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
            O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
            O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
            O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://els6.ac-toulouse.fr/qp2.cab
            O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
            O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
            O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
            O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
            O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
            O16 - DPF: {952F9A71-131A-11D5-8404-00500445A7D0} (ActiveMiniplug Class) - https://intranet.unss.org/plugins/mplugax.cab
            O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
            O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
            O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
            O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
            O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
            O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
            O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
            O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
            O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
            O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - C:\Program Files\Trend Micro\PCCPFW.exe
            O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
            O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
            O23 - Service: RTE : Partage TAPI - Unknown - c:\fotowin\RTETPISv.exe
            O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
            O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - C:\Program Files\Trend Micro\Tmntsrv.exe
            O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
            O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

            Pour l'instant qd je relance internet il n'y a plus les messages d'erreur concernant sevices.exe de inet ....

            C est bon signe non ?

            A +
        2. valérie
          Le voici :
          Logfile of HijackThis v1.99.0
          Scan saved at 23:27:30, on 06/01/2006
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
          C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
          c:\fotowin\RTETPISv.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Trend Micro\Tmntsrv.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Trend Micro\PCCPFW.exe
          C:\Program Files\Winamp\winampa.exe
          C:\WINDOWS\htpatch.exe
          C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\QuickTime\qttask.exe
          C:\Program Files\Trend Micro\pccguide.exe
          C:\Program Files\Trend Micro\PCCClient.exe
          C:\Program Files\Trend Micro\Pop3trap.exe
          C:\Program Files\MessengerPlus! 3\MsgPlus.exe
          C:\Program Files\Java\jre1.5.0\bin\jusched.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe
          C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
          C:\Program Files\Trend Micro\WebTrap.EXE
          C:\WINDOWS\system32\wuauclt.exe
          C:\Documents and Settings\Valérie\Mes documents\utilitaires\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          F3 - REG:win.ini: run=C:\WINDOWS\inet20003\services.exe
          O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
          O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
          O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
          O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
          O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\pccguide.exe"
          O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PCCClient.exe"
          O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\Pop3trap.exe"
          O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
          O4 - HKLM\..\Run: [second] C:\Documents and Settings\Val‚rie\Bureau\l2mfix\second.bat
          O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe" tray
          O4 - HKCU\..\Run: [Shell] "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.exe"
          O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
          O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
          O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
          O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
          O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
          O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
          O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
          O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
          O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://els6.ac-toulouse.fr/qp2.cab
          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
          O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
          O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
          O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
          O16 - DPF: {952F9A71-131A-11D5-8404-00500445A7D0} (ActiveMiniplug Class) - https://intranet.unss.org/plugins/mplugax.cab
          O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
          O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
          O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
          O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
          O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
          O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
          O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
          O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
          O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - C:\Program Files\Trend Micro\PCCPFW.exe
          O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
          O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
          O23 - Service: RTE : Partage TAPI - Unknown - c:\fotowin\RTETPISv.exe
          O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
          O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - C:\Program Files\Trend Micro\Tmntsrv.exe
          O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
          O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

          A+
          1. Utilisateur anonyme
            re,

            peux tu redemarrer ton pc et remettre un hijack this?

            a+
            1. valérie
              J'ai fait ce qu'a dit bernie au post 23.
              Qd l'ordi redémarre il y a des messages indiquant qu'il ne trouve pas le fichier service.exe et qu'il ne peut pas éxécuter inet 20003.

              est-ce que je laisse la config pour scanner les dossiers et syst cachés ?

              A +
              2. valérie
                bonsoir et merci de prendre le relais,

                voici le rapport demandé :

                SmitFraudFix v2.11

                Rapport fait à 22:57:42,17 le 06/01/2006
                Executé à partir de C:\Documents and Settings\Val‚rie\Bureau\SmitfraudFix
                OS: Microsoft Windows XP [version 5.1.2600]

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Val‚rie\Application Data

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

                [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                "Source"="About:Home"
                "SubscribedURL"="About:Home"
                "FriendlyName"="Ma page d'accueil"

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

                [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
                "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"

                »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

                A +
                1. bernie61
                  salut régis
                  on a déjà passe Smitfrau san résultat

                  valérie, utilise l'effaceur de Hijack pour tous les fichiers dans inet2003

                  effaceur Hijackthis
                  ouvrir Hijackthis là en bas droite CONFIG puis onglet MISCtools, là " Delete a file on reboot ", cliq dessus et suivre chemin de fichier à effacer, il indique alors " voulez-vous redémarrer maintenant ", cliq sur NON si d'autres fichiers sont à sélectionner et à nouveau " Delete a file on reboot " .. puis cliq OUI quand tous les fichiers sont sélectionnés

                  a+
                  2. Utilisateur anonyme
                    salut Valerie

                    Télécharge ceci: (merci a S!RI pour ce petit programme).
                    http://siri.urz.free.fr/Fix/SmitfraudFix.zip
                    Exécute le, Double click sur Smitfraudfix.cmd choisit l’option 1, il va générer un rapport
                    Copie/colle le sur le poste stp.

                    PS:Bernie n a pas l air trop en accord avec ce prog lol
                    1. valerie
                      Je pense être administrateur (pas de mutisessions qd je démarre le PC).
                      J'ai déjà continué.

                      Impossible de supprimer (même avec chaos schreder) : dans inet 20003 mm4.exe et services.exe
                      imp. trouver paytime.exe

                      Je lance un CCcleaner et HJT
                      A+
                      1. bernie61
                        re
                        tu es admnistrateur? si pas log to sous un nom qui administrateur

                        sinon continue
                        a+
                        1. valérie
                          Voici le rapport HJT après avoir supp les temps et vidé la corbeille :

                          Logfile of HijackThis v1.99.0
                          Scan saved at 22:49:42, on 06/01/2006
                          Platform: Windows XP SP2 (WinNT 5.01.2600)
                          MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                          Running processes:
                          C:\WINDOWS\System32\smss.exe
                          C:\WINDOWS\system32\winlogon.exe
                          C:\WINDOWS\system32\services.exe
                          C:\WINDOWS\system32\lsass.exe
                          C:\WINDOWS\system32\svchost.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\WINDOWS\system32\spoolsv.exe
                          C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                          C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                          C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                          c:\fotowin\RTETPISv.exe
                          C:\WINDOWS\System32\svchost.exe
                          C:\Program Files\Trend Micro\Tmntsrv.exe
                          C:\WINDOWS\Explorer.EXE
                          C:\WINDOWS\inet20003\services.exe
                          C:\Program Files\Winamp\winampa.exe
                          C:\WINDOWS\htpatch.exe
                          C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
                          C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                          C:\Program Files\iTunes\iTunesHelper.exe
                          C:\Program Files\QuickTime\qttask.exe
                          C:\Program Files\Trend Micro\pccguide.exe
                          C:\Program Files\Trend Micro\PCCClient.exe
                          C:\Program Files\Trend Micro\Pop3trap.exe
                          C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                          C:\Program Files\Java\jre1.5.0\bin\jusched.exe
                          C:\WINDOWS\system32\ctfmon.exe
                          C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe
                          C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                          C:\Program Files\Trend Micro\WebTrap.EXE
                          C:\Program Files\Trend Micro\PCCPFW.exe
                          C:\WINDOWS\inet20003\mm4.exe
                          C:\Program Files\iPod\bin\iPodService.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                          C:\Program Files\Internet Explorer\iexplore.exe
                          C:\Documents and Settings\Valérie\Mes documents\utilitaires\HijackThis.exe

                          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                          F3 - REG:win.ini: run=C:\WINDOWS\inet20003\services.exe
                          O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
                          O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                          O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                          O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                          O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                          O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
                          O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
                          O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
                          O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                          O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
                          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                          O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\pccguide.exe"
                          O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PCCClient.exe"
                          O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\Pop3trap.exe"
                          O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                          O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
                          O4 - HKLM\..\Run: [second] C:\Documents and Settings\Val‚rie\Bureau\l2mfix\second.bat
                          O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
                          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                          O4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe" tray
                          O4 - HKCU\..\Run: [Shell] "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.exe"
                          O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
                          O4 - HKCU\..\RunOnce: [CleanUp!] C:\Program Files\CleanUp!\Cleanup.exe /WindowsRestart
                          O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                          O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                          O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
                          O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
                          O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
                          O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
                          O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
                          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
                          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
                          O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
                          O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://els6.ac-toulouse.fr/qp2.cab
                          O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                          O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
                          O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                          O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
                          O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
                          O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
                          O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                          O16 - DPF: {952F9A71-131A-11D5-8404-00500445A7D0} (ActiveMiniplug Class) - https://intranet.unss.org/plugins/mplugax.cab
                          O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
                          O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                          O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                          O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                          O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                          O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                          O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
                          O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                          O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                          O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
                          O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                          O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
                          O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - C:\Program Files\Trend Micro\PCCPFW.exe
                          O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
                          O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
                          O23 - Service: RTE : Partage TAPI - Unknown - c:\fotowin\RTETPISv.exe
                          O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
                          O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - C:\Program Files\Trend Micro\Tmntsrv.exe
                          O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
                          O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe
                      2. valérie
                        re
                        le bouton "APPLIQUER A TOUS LES DOSSIERS " n'est pas opérationnel, je n'ai que le choix en bas de la fenêtre à droite de APPLIQUER
                        dois-je continuer le reste malgré ça ?

                        A+
                        1. bernie61
                          bonsoir
                          désactiver restauration et vider fais ça après nettouyage quand il n'y aura plus de pbm

                          *Configure ton ordi pour tous scan à exécuter complétement, il faut pouvoir scanner tous les dossiers caché et système donc faire :
                          Démarrer/PanneauConfiguration/OptionsDossiers /ongletAffichage et là cocher les lignes
                          - afficher les fichiers et dossier cachés
                          - afficher contenu dossier système
                          décocher
                          - masquer fichiers protégés du dossier système
                          Puis cliquer APPLIQUER à TOUS les Dossiers

                          1. à vérifier là http://virusscan.jotti.org/ fichier par fichier Parcourir puis SUBMIT lance ce multiple scanneur antivirus)
                          C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe

                          2. Relances Hijackthis et coche (puis FIX)
                          R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
                          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
                          F3 - REG:win.ini: run=C:\WINDOWS\inet20003\services.exe
                          O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
                          O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
                          O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
                          O23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exe

                          3. Effacer ces programmes .EXE et .DLL( et à la fin vider la corbeille)
                          C:\WINDOWS\inet20003\ > le répertoire
                          C:\WINDOWS\system32\paytime.exe

                          puis ccleaner et un nouveau Hijack
                          a+
                          1. valérie
                            La chasse reprend....
                            Voici :

                            1 ) le rapport de Smitfraud option 1

                            SmitFraudFix v2.11

                            Rapport fait à 17:46:07,90 le 06/01/2006
                            Executé à partir de C:\Documents and Settings\Val‚rie\Bureau\SmitfraudFix
                            OS: Microsoft Windows XP [version 5.1.2600]

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\Web

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\WINDOWS\system32\LogFiles

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Documents and Settings\Val‚rie\Application Data

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche Menu Démarrer

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche Bureau

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche C:\Program Files

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche présence de clés corrompues

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche éléments du bureau

                            [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
                            "Source"="About:Home"
                            "SubscribedURL"="About:Home"
                            "FriendlyName"="Ma page d'accueil"

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche Sharedtaskscheduler

                            [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
                            "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Pr‚-chargeur Browseui"
                            "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="D‚mon de cache des cat‚gories de composant"

                            »»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll

                            »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

                            Voici le rapport Smitfraud option 2 en mode sans échec :

                            SmitFraudFix v2.11

                            Rapport fait à 17:50:44,17 le 06/01/2006
                            Executé à partir de C:\Documents and Settings\Val‚rie\Bureau\SmitfraudFix
                            OS: Microsoft Windows XP [version 5.1.2600]

                            »»»»»»»»»»»»»»»»»»»»»»»» Arret des processus

                            »»»»»»»»»»»»»»»»»»»»»»»» Suppression des fichiers infectés

                            »»»»»»»»»»»»»»»»»»»»»»»» Nettoyage du registre

                            Nettoyage terminé.

                            »»»»»»»»»»»»»»»»»»»»»»»» Fin du rapport

                            et enfin l'HJT :

                            Logfile of HijackThis v1.99.0
                            Scan saved at 17:54:30, on 06/01/2006
                            Platform: Windows XP SP2 (WinNT 5.01.2600)
                            MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

                            Running processes:
                            C:\WINDOWS\System32\smss.exe
                            C:\WINDOWS\system32\winlogon.exe
                            C:\WINDOWS\system32\services.exe
                            C:\WINDOWS\system32\lsass.exe
                            C:\WINDOWS\system32\svchost.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\Explorer.EXE
                            C:\WINDOWS\system32\spoolsv.exe
                            C:\WINDOWS\inet20003\services.exe
                            C:\Program Files\Winamp\winampa.exe
                            C:\WINDOWS\htpatch.exe
                            C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE
                            C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
                            C:\Program Files\iTunes\iTunesHelper.exe
                            C:\Program Files\QuickTime\qttask.exe
                            C:\Program Files\Trend Micro\pccguide.exe
                            C:\Program Files\Trend Micro\PCCClient.exe
                            C:\Program Files\Trend Micro\Pop3trap.exe
                            C:\Program Files\MessengerPlus! 3\MsgPlus.exe
                            C:\Program Files\Java\jre1.5.0\bin\jusched.exe
                            C:\WINDOWS\system32\ctfmon.exe
                            C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe
                            C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                            C:\WINDOWS\inet20003\mm4.exe
                            C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                            C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                            C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
                            c:\fotowin\RTETPISv.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\Program Files\Trend Micro\Tmntsrv.exe
                            C:\Program Files\Trend Micro\PCCPFW.exe
                            C:\Program Files\iPod\bin\iPodService.exe
                            C:\WINDOWS\System32\svchost.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\ServicePackFiles\i386\IExplore.exe
                            C:\WINDOWS\system32\wuauclt.exe
                            C:\Documents and Settings\Valérie\Mes documents\utilitaires\HijackThis.exe

                            R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = c:\secure32.html
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = c:\secure32.html
                            R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                            F3 - REG:win.ini: run=C:\WINDOWS\inet20003\services.exe
                            O2 - BHO: (no name) - {5321E378-FFAD-4999-8C62-03CA8155F0B3} - (no file)
                            O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
                            O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
                            O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
                            O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                            O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
                            O4 - HKLM\..\Run: [HTpatch] C:\WINDOWS\htpatch.exe
                            O4 - HKLM\..\Run: [EPSON Stylus CX3200] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S10IC2.EXE /P19 "EPSON Stylus CX3200" /O6 "USB001" /M "Stylus CX3200"
                            O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
                            O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
                            O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                            O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\pccguide.exe"
                            O4 - HKLM\..\Run: [PCCClient.exe] "C:\Program Files\Trend Micro\PCCClient.exe"
                            O4 - HKLM\..\Run: [Pop3trap.exe] "C:\Program Files\Trend Micro\Pop3trap.exe"
                            O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
                            O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe"
                            O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0\bin\jusched.exe
                            O4 - HKLM\..\Run: [second] C:\Documents and Settings\Val‚rie\Bureau\l2mfix\second.bat
                            O4 - HKLM\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
                            O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                            O4 - HKCU\..\Run: [RTEGPRS] "C:\Program Files\Fichiers communs\RTE\RTEGPRS.exe" tray
                            O4 - HKCU\..\Run: [Shell] "C:\Program Files\Fichiers communs\Microsoft Shared\Web Folders\ibm00001.exe"
                            O4 - HKCU\..\Run: [PayTime] C:\WINDOWS\system32\paytime.exe
                            O4 - HKCU\..\Run: [xp_system] C:\WINDOWS\inet20003\services.exe
                            O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
                            O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
                            O8 - Extra context menu item: &Traduire à partir de l'anglais - res://c:\program files\google\GoogleToolbar1.dll/cmwordtrans.html
                            O8 - Extra context menu item: Pages liées - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
                            O8 - Extra context menu item: Pages similaires - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html
                            O8 - Extra context menu item: Recherche &Google - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html
                            O8 - Extra context menu item: Version de la page actuelle disponible dans le cache Google - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html
                            O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
                            O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
                            O16 - DPF: fdjeux - https://www.fdjeux.net/classes/fdjeux.cab
                            O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://els6.ac-toulouse.fr/qp2.cab
                            O16 - DPF: {14B87622-7E19-4EA8-93B3-97215F77A6BC} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab31267.cab
                            O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
                            O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab
                            O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
                            O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2005111401/housecall.trendmicro.com/housecall/xscan53.cab
                            O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
                            O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - https://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
                            O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
                            O16 - DPF: {952F9A71-131A-11D5-8404-00500445A7D0} (ActiveMiniplug Class) - https://intranet.unss.org/plugins/mplugax.cab
                            O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab
                            O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
                            O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://messenger.zone.msn.com/binary/ZIntro.cab32846.cab
                            O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/SolitaireShowdown.cab31267.cab
                            O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
                            O23 - Service: Adobe LM Service - Unknown - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
                            O23 - Service: Service d'administration du Gestionnaire de disque logique - Unknown - C:\WINDOWS\System32\dmadmin.exe
                            O23 - Service: EpsonBidirectionalService - Unknown - C:\Program Files\Fichiers communs\EPSON\EBAPI\eEBSVC.exe
                            O23 - Service: EPSON Printer Status Agent2 - SEIKO EPSON CORPORATION - C:\Program Files\Fichiers communs\EPSON\EBAPI\SAgent2.exe
                            O23 - Service: Journal des événements - Unknown - C:\WINDOWS\system32\services.exe
                            O23 - Service: Service COM de gravage de CD IMAPI - Unknown - C:\WINDOWS\System32\imapi.exe
                            O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
                            O23 - Service: Partage de Bureau à distance NetMeeting - Unknown - C:\WINDOWS\System32\mnmsrvc.exe
                            O23 - Service: PC-cillin PersonalFirewall - Trend Micro Inc. - C:\Program Files\Trend Micro\PCCPFW.exe
                            O23 - Service: Plug-and-Play - Unknown - C:\WINDOWS\system32\services.exe
                            O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance - Unknown - C:\WINDOWS\system32\sessmgr.exe
                            O23 - Service: RTE : Partage TAPI - Unknown - c:\fotowin\RTETPISv.exe
                            O23 - Service: Carte à puce - Unknown - C:\WINDOWS\System32\SCardSvr.exe
                            O23 - Service: Trend NT Realtime Service - Trend Micro Inc. - C:\Program Files\Trend Micro\Tmntsrv.exe
                            O23 - Service: Cliché instantané de volume - Unknown - C:\WINDOWS\System32\vssvc.exe
                            O23 - Service: Carte de performance WMI - Unknown - C:\WINDOWS\System32\wbem\wmiapsrv.exe

                            Je l'avais déjà fait hier soir ....

                            Faut-il désactiver la restauration du système avt de faire ttes ces manip ?

                            Encore merci
                            • 1
                            • 2

                            Discussions similaires

                            Aide pour un virus
                            cerise92700

                            41 réponses
                            Trojan impossible à supprimer!
                            Gridouu

                            12 réponses
                            Comment supprimer le virus Trojan
                            vitsou

                            18 réponses
                            Cheval de Troie- e.tre456.worm.windows
                            Ninou037

                            13 réponses
                            trojan-spy.win32@mx
                            caramel79

                            3 réponses