Trojan Win32:TratBHO[Trj]

crousps -

Bonjour amis de la toile,je suis infecte par le virus Win32:TratBHO[Trj] et je cherche de l'aide pour m'en debarasser.merci d'avance a qui voudra bien m'aider.

Configuration: Windows XP
Internet Explorer 6.0

Afficher la suite

40 réponses

Résumé de la discussion

Infection par le virus Win32:TratBHO[Trj] sur Windows XP avec Internet Explorer 6.0 et une recherche d’aide pour l’éliminer et sécuriser le système, en cas de conseils pratiques. Plusieurs réponses évoquent l’usage d’antivirus comme Avast ou Avira AntiVir et des analyses HijackThis, avec la nécessité de partager des rapports pour identifier les composants malveillants et les entrées de démarrage. Des échanges mentionnent des éléments concrets tels que des rapports de scan et des journaux HijackThis, et recommandent de les partager pour guider le nettoyage sans conclure sur l’avancement du dépannage.

Réponse 1 / 40
g!rly Contributeur
bonjour ?!

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt ''
0
Réponse 2 / 40
myau
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:31:30, on 04/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\00THotkey.exe
C:\Program Files\SigmaTel\Pilotes Audio SigmaTel AC97\stacmon.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0C94B6BD-52F1-4B58-B823-751A1FB5C09E} - C:\Program Files\Internet Explorer\koqe89104.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {2EB38E38-536E-4B72-95D6-5DDD69E54D60} - C:\WINDOWS\system32\fccya.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {D85530E8-D39D-49D0-9F36-300D594556D2} - C:\WINDOWS\system32\khfgdcb.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe
O4 - HKLM\..\Run: [SigmaTel StacMon] C:\Program Files\SigmaTel\Pilotes Audio SigmaTel AC97\stacmon.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdS7_0_0
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {B7D07999-2ADB-4AEB-997E-F61CB7B2E2CD} (TSEasyInstallX Control) - http://www.trendsecure.com/easy_install/_activex/fr/TSEasyInstallX.CAB
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: khfgdcb - khfgdcb.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
0
Réponse 3 / 40
g!rly Contributeur
Bonjour,

Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
Procèdes comme ceci :
http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

A bientôt ''
0
Réponse 4 / 40
yi-yang
bonjour, moi aussi g ce problème de trojan, je suis en train de suivre tes conseil et voici les scan que tu demande:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:49:03, on 28/01/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16575)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\WTablet\Pen_TabletUser.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Common Files\Ulead Systems\AutoDetector\Monitor.exe
C:\WINDOWS\System32\rundll32.exe
C:\WINDOWS\System32\WDBtnMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Program Files\Common Files\Microsoft Shared\Ink\InputPersonalization.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9e.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: World Tv Center Toolbar - {e077da94-6314-41f1-9f08-6607df65952e} - C:\Program Files\World_Tv_Center\tbWor1.dll
O1 - Hosts: ::1 localhost
O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: World Tv Center Toolbar - {e077da94-6314-41f1-9f08-6607df65952e} - C:\Program Files\World_Tv_Center\tbWor1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: World Tv Center Toolbar - {e077da94-6314-41f1-9f08-6607df65952e} - C:\Program Files\World_Tv_Center\tbWor1.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ulead AutoDetector v2] C:\Program Files\Common Files\Ulead Systems\AutoDetector\monitor.exe
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\yi-yang\AppData\Local\Temp\efcab.dll,#1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A742957-CEE7-4F4C-89CF-028CA81F602D}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Retrospect Express HD Launcher (RetroExpLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect Express HD 2.0\retrorun.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
0
Vous n’avez pas trouvé la réponse que vous recherchez ?

La communauté CCM répond en moyenne en moins de 2h.

Posez votre question
Réponse 5 / 40
g!rly Contributeur
Salut croups,

Ce message était destiné a boro qui a postés des rapports grossièrement...

Aucune offence envers toi, ne t´inquiète pas ;-)

bonne continuation.

Bye`
0
Réponse 6 / 40
crousps
salut g!rly.
j'ai recu un drole de message me demandant de reformuler mon pb et de dire bonjour,merci...or il me semble que j'ai ete extremement poli avec toi et je me repete mais je tiens encore a te remercier pour tout ce que tu as fait alors,comme c'etait la 1ere fois que je me connectais a ce site,je n'ai pas du en saisir totalement le fonctionnement et la meilleure maniere de l'utiliser.si je t'ai froisse je m'en excuse encore et renouvelle mes remerciements.
a bientot dans de meilleures conditions.
0
Réponse 7 / 40
g!rly Contributeur
Pourriez-vous, s'il vous plait, reformuler votre problème avec des phrases complètes; bonjour et merci sont aussi des mots bien appréciés ici, puisque notre seul salaire.
http://www.technicland.com/malpolitus.swf
@+
0
Réponse 8 / 40
boro
ComboFix 08-01-20.1 - moussa 2008-01-20 14:55:43.1 - NTFSx86
Microsoft Windows XP Édition familiale 5.1.2600.2.1252.1.1036.18.567 [GMT 1:00]
Running from: H:\Documents and Settings\moussa\Bureau\ComboFix.exe
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

H:\Autorun.inf
H:\Documents and Settings\bouba\Application Data\Hotbar_Icons
H:\Documents and Settings\bouba\Application Data\Hotbar_Icons\meetic.ico
H:\Documents and Settings\bouba\Application Data\Hotbar_Icons\Registryrepair.ico
H:\Documents and Settings\bouba\Application Data\Hotbar_Icons\wallpapere1.ico
H:\Documents and Settings\bouba\Bureau\Free PC Wallpapers.lnk
H:\Documents and Settings\moussa\Application Data\FunWebProducts
H:\Documents and Settings\moussa\Application Data\ShoppingReport
H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\Config.xml
H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\db\Aliases.dbs
H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\db\Sites.dbs
H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\dwld\WhiteList.xip
H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\report\aggr_storage.xml
H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\report\send_storage.xml
H:\Documents and Settings\moussa\Application Data\ShoppingReport\cs\res2\WhiteList.dbs
H:\Documents and Settings\moussa\ravmonlog
H:\Program Files\FunWebProducts
H:\Program Files\FunWebProducts\Shared\Cache\AvatarSmallBtn.html
H:\Program Files\FunWebProducts\Shared\Cache\CursorManiaBtn.html
H:\Program Files\FunWebProducts\Shared\Cache\FunBuddyIconBtn.html
H:\Program Files\FunWebProducts\Shared\Cache\MailStampBtn.html
H:\Program Files\FunWebProducts\Shared\Cache\MyFunCardsIMBtn.html
H:\Program Files\FunWebProducts\Shared\Cache\MyStationeryBtn.html
H:\Program Files\FunWebProducts\Shared\Cache\SmileyCentralBtn.html
H:\Program Files\internet explorer\msimg32.dll
H:\Program Files\MyWebSearch
H:\Program Files\MyWebSearch\bar\1.bin\F3BKGERR.JPG
H:\Program Files\MyWebSearch\bar\1.bin\F3BROVLY.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3DTACTL.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3HISTSW.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3IMSTUB.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3POPSWT.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3PSSAVR.SCR
H:\Program Files\MyWebSearch\bar\1.bin\F3REPROX.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3RESTUB.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE
H:\Program Files\MyWebSearch\bar\1.bin\F3SCRCTR.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3SHLLVW.DLL
H:\Program Files\MyWebSearch\bar\1.bin\F3SPACER.WMV
H:\Program Files\MyWebSearch\bar\1.bin\F3WALLPP.DAT
H:\Program Files\MyWebSearch\bar\1.bin\F3WPHOOK.DLL
H:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.JAR
H:\Program Files\MyWebSearch\bar\1.bin\M3FFXTBR.MANIFEST
H:\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL
H:\Program Files\MyWebSearch\bar\1.bin\M3IDLE.DLL
H:\Program Files\MyWebSearch\bar\1.bin\M3IMPIPE.EXE
H:\Program Files\MyWebSearch\bar\1.bin\M3MSG.DLL
H:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.JAR
H:\Program Files\MyWebSearch\bar\1.bin\M3NTSTBR.MANIFEST
H:\Program Files\MyWebSearch\bar\1.bin\M3OUTLCN.DLL
H:\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL
H:\Program Files\MyWebSearch\bar\1.bin\M3SKIN.DLL
H:\Program Files\MyWebSearch\bar\1.bin\M3SKPLAY.EXE
H:\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE
H:\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE
H:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
H:\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE
H:\Program Files\MyWebSearch\bar\1.bin\MWSOEPLG.DLL
H:\Program Files\MyWebSearch\bar\1.bin\MWSOESTB.DLL
H:\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL
H:\Program Files\MyWebSearch\bar\Avatar\COMMON.F3S
H:\Program Files\MyWebSearch\bar\Cache\[u]0[/u]2FD1F75
H:\Program Files\MyWebSearch\bar\Cache\145AA73F.bin
H:\Program Files\MyWebSearch\bar\Cache\145AA952.bin
H:\Program Files\MyWebSearch\bar\Cache\145AAB27.bin
H:\Program Files\MyWebSearch\bar\Cache\145AEACF
H:\Program Files\MyWebSearch\bar\Cache\14B31752
H:\Program Files\MyWebSearch\bar\Cache\16585749.bin
H:\Program Files\MyWebSearch\bar\Cache\16585A37.bin
H:\Program Files\MyWebSearch\bar\Cache\16585BED.bin
H:\Program Files\MyWebSearch\bar\Cache\16585DF0.bin
H:\Program Files\MyWebSearch\bar\Cache\165B58F0.bin
H:\Program Files\MyWebSearch\bar\Cache\165B5A96.bin
H:\Program Files\MyWebSearch\bar\Cache\165B5C3C.bin
H:\Program Files\MyWebSearch\bar\Cache\165B5DA4.bin
H:\Program Files\MyWebSearch\bar\Cache\165B5EFB.bin
H:\Program Files\MyWebSearch\bar\Cache\165B6034
H:\Program Files\MyWebSearch\bar\Cache\files.ini
H:\Program Files\MyWebSearch\bar\Game\CHECKERS.F3S
H:\Program Files\MyWebSearch\bar\Game\CHESS.F3S
H:\Program Files\MyWebSearch\bar\Game\REVERSI.F3S
H:\Program Files\MyWebSearch\bar\History\search2
H:\Program Files\MyWebSearch\bar\icons\CM.ICO
H:\Program Files\MyWebSearch\bar\icons\MFC.ICO
H:\Program Files\MyWebSearch\bar\icons\PSS.ICO
H:\Program Files\MyWebSearch\bar\icons\SMILEY.ICO
H:\Program Files\MyWebSearch\bar\icons\WB.ICO
H:\Program Files\MyWebSearch\bar\icons\ZWINKY.ICO
H:\Program Files\MyWebSearch\bar\Message\COMMON.F3S
H:\Program Files\MyWebSearch\bar\Notifier\COMMON.F3S
H:\Program Files\MyWebSearch\bar\Notifier\DOG.F3S
H:\Program Files\MyWebSearch\bar\Notifier\FISH.F3S
H:\Program Files\MyWebSearch\bar\Notifier\KUNGFU.F3S
H:\Program Files\MyWebSearch\bar\Notifier\LIFEGARD.F3S
H:\Program Files\MyWebSearch\bar\Notifier\MAID.F3S
H:\Program Files\MyWebSearch\bar\Notifier\MAILBOX.F3S
H:\Program Files\MyWebSearch\bar\Notifier\OPERA.F3S
H:\Program Files\MyWebSearch\bar\Notifier\ROBOT.F3S
H:\Program Files\MyWebSearch\bar\Notifier\SEDUCT.F3S
H:\Program Files\MyWebSearch\bar\Notifier\SURFER.F3S
H:\Program Files\MyWebSearch\bar\Settings\prevcfg2.htm
H:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
H:\Program Files\ShoppingReport
H:\Program Files\ShoppingReport\Uninst.exe
H:\WINDOWS\system32\awvtq.dll
H:\WINDOWS\system32\ddcyw.dll
H:\WINDOWS\system32\f3PSSavr.scr
H:\WINDOWS\system32\jkkjj.dll
H:\WINDOWS\system32\jkklj.dll
H:\WINDOWS\system32\jkklm.dll
H:\WINDOWS\system32\mlljg.dll
H:\WINDOWS\system32\mllji.dll
H:\WINDOWS\system32\oqtwa.ini
H:\WINDOWS\system32\oqtwa.ini2
H:\WINDOWS\system32\pmkhi.dll
H:\WINDOWS\system32\pmnll.dll
H:\WINDOWS\system32\sstqq.dll
H:\WINDOWS\system32\ssttr.dll
H:\WINDOWS\system32\urqopol.dll
H:\WINDOWS\system32\vtstq.dll
H:\WINDOWS\system32\vtstr.dll

.
((((((((((((((((((((((((((((( Fichiers créés 2007-12-20 to 2008-01-20 ))))))))))))))))))))))))))))))))))))
.

2008-01-20 14:50 . 2000-08-31 08:00 51,200 --a------ H:\WINDOWS\NirCmd.exe
2008-01-20 14:33 . 2008-01-20 14:33 <REP> d-------- H:\Program Files\Trend Micro
2008-01-17 14:53 . 2008-01-17 14:53 <REP> d-------- H:\Documents and Settings\bouba\Contacts
2008-01-16 18:00 . 2008-01-16 18:00 <REP> d-------- H:\Documents and Settings\bouba\Application Data\Yahoo!
2008-01-16 09:17 . 2008-01-16 09:17 57 --a------ H:\WINDOWS\DcmLtbox-WS.ini
2008-01-05 20:12 . 2008-01-05 20:12 <REP> d-------- H:\Program Files\KONAMI
2008-01-05 08:30 . 2007-10-11 00:49 6,065,664 -----c--- H:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-05 08:30 . 2007-07-01 04:31 2,455,488 -----c--- H:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-05 08:30 . 2007-07-01 04:36 1,048,576 -----c--- H:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-05 08:30 . 2007-10-11 00:49 459,264 -----c--- H:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-05 08:30 . 2007-10-11 00:49 383,488 -----c--- H:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-05 08:30 . 2007-10-11 00:49 267,776 -----c--- H:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-05 08:30 . 2007-10-11 00:49 63,488 -----c--- H:\WINDOWS\system32\dllcache\icardie.dll
2008-01-05 08:30 . 2007-10-11 00:49 52,224 -----c--- H:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-05 08:30 . 2007-10-10 11:59 13,824 -----c--- H:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-05 08:24 . 2008-01-05 08:31 <REP> d-------- H:\WINDOWS\system32\fr-fr
2007-12-28 20:55 . 2007-12-28 20:55 <REP> d-------- H:\Program Files\Neuf
2007-12-23 18:14 . 2007-12-23 18:14 268 --ah----- H:\sqmdata19.sqm
2007-12-23 18:14 . 2007-12-23 18:14 244 --ah----- H:\sqmnoopt19.sqm

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-20 14:02 --------- d-----w H:\Program Files\MSN Messenger
2008-01-18 18:57 12,772 ----a-w H:\Documents and Settings\moussa\Application Data\wklnhst.dat
2008-01-17 15:54 --------- d-----w H:\Documents and Settings\bouba\Application Data\Ahead
2008-01-17 07:05 --------- d-----w H:\Program Files\eMule
2008-01-16 08:22 --------- d-----w H:\Program Files\Jewel Quest
2008-01-11 18:12 --------- d-----w H:\Program Files\Yahoo!
2008-01-11 18:11 --------- d-----w H:\Program Files\Windows Live Toolbar
2008-01-11 18:09 --------- d-----w H:\Program Files\Google
2008-01-05 09:13 --------- d-----w H:\Program Files\Java
2008-01-05 07:44 --------- d-----w H:\Program Files\PowerArchiver
2007-12-28 16:51 --------- d-----w H:\Program Files\Luxor Amun Rising
2007-12-13 16:38 --------- d-----w H:\Documents and Settings\moussa\Application Data\OpenOffice.org2
2007-12-04 14:56 93,264 -c--a-w H:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w H:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w H:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w H:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w H:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-01 15:52 --------- d-----w H:\Program Files\1964
2007-12-01 02:01 --------- d-----w H:\Program Files\Windows Live Favorites
2007-11-24 14:43 --------- d--h--w H:\Program Files\InstallShield Installation Information
2007-04-15 20:15 36 -c--a-w H:\Program Files\config.2mt
2007-04-07 07:12 4,048 -c--a-w H:\Program Files\hs_err_pid3528.log
2007-04-07 07:12 4,048 -c--a-w H:\Program Files\hs_err_pid3468.log
2007-04-06 09:03 4,125 -c--a-w H:\Program Files\hs_err_pid3896.log
2007-04-05 12:53 4,048 -c--a-w H:\Program Files\hs_err_pid3964.log
2007-04-05 12:53 4,048 -c--a-w H:\Program Files\hs_err_pid3272.log
2007-04-05 12:53 4,047 -c--a-w H:\Program Files\hs_err_pid2224.log
2007-04-04 10:57 120 -c--a-w H:\Program Files\scores8.2mt
2007-03-16 17:59 3,979 -c--a-w H:\Program Files\hs_err_pid3752.log
2007-03-16 17:59 3,921 -c--a-w H:\Program Files\hs_err_pid3664.log
2007-03-15 16:37 3,921 -c--a-w H:\Program Files\hs_err_pid3616.log
2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid3700.log
2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid3676.log
2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid2440.log
2007-03-15 16:37 3,920 -c--a-w H:\Program Files\hs_err_pid2388.log
2007-03-15 16:34 3,980 -c--a-w H:\Program Files\hs_err_pid2188.log
2007-03-15 16:34 3,921 -c--a-w H:\Program Files\hs_err_pid1136.log
2007-03-15 12:09 3,980 -c--a-w H:\Program Files\hs_err_pid4028.log
2007-03-14 12:47 119 -c--a-w H:\Program Files\scores0.2mt
2007-01-25 18:09 15,853 -c-ha-w H:\Program Files\install.log
2005-12-21 16:57 5,572,404 ----a-w H:\Program Files\protect.dll
2005-12-21 16:53 805,888 ----a-w H:\Program Files\Sudoku.exe
2005-12-19 09:05 0 -c--a-w H:\Program Files\log.txt
2005-12-19 09:02 5,055 -c--a-w H:\Program Files\emme.loc
2005-12-16 09:53 161,936 -c--a-w H:\Program Files\Manuel.pdf
2005-12-16 09:24 67 -c--a-w H:\Program Files\Kakuro.url
2005-12-13 15:56 278 -c--a-w H:\Program Files\settings.txt
2005-12-06 11:23 7 -c--a-w H:\Program Files\box dimensions.txt
2005-09-14 12:55 67 -c--a-w H:\Program Files\emme.url
2005-09-09 12:21 11,811,416 -c--a-w H:\Program Files\rp505fra.exe
1999-06-18 11:24 168,207 -c--a-w H:\Program Files\Unstall.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="H:\WINDOWS\system32\ctfmon.exe" [2006-03-02 13:00 15360]
"SuperCopier2.exe"="H:\Program Files\SuperCopier2\SuperCopier2.exe" [2005-03-14 00:37 1057280]
"PowerArchiver Tray"="H:\Program Files\PowerArchiver\PASTARTER.EXE" [2007-03-20 21:39 141352]
"msnmsgr"="H:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352]
"Yahoo! Pager"="H:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2006-11-17 05:42 577536 H:\WINDOWS\soundman.exe]
"avast!"="H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"HPDJ Taskbar Utility"="H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe" [2004-12-14 18:06 176128]
"HP Software Update"="H:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 15:49 49152]
"DAEMON Tools"="H:\Program Files\DAEMON Tools\daemon.exe" [2006-09-14 21:09 157592]
"FLMOFFICE4DMOUSE"="H:\Program Files\Labtec\Desktop\V5.1\moffice.exe" [2007-04-05 20:35 958464]
"SunJavaUpdateSched"="H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Adobe Reader Speed Launcher"="H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"NeroFilterCheck"="H:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"Nero DriveSpeed"="H:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE" [2004-04-14 05:16 561152]
"Adobe Photo Downloader"="H:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="H:\WINDOWS\System32\CTFMON.EXE" [2006-03-02 13:00 15360]

R2 MarxDev1;MarxDev1;H:\WINDOWS\system32\drivers\MarxDev1.sys [2001-05-28 15:30]
R2 MarxDev2;MarxDev2;H:\WINDOWS\system32\drivers\MarxDev2.sys [2001-05-28 15:30]
R2 MarxDev3;MarxDev3;H:\WINDOWS\system32\drivers\MarxDev3.sys [2001-05-28 15:30]
R3 Tetris;Tetris driver;H:\WINDOWS\system32\Drivers\Tetris.sys [2007-03-30 21:00]
S1 hidfltr;HID Filter Driver;H:\WINDOWS\system32\drivers\MWhid.sys [2004-11-03 11:20]
S3 OLITEC(OLITEC);Stick USB 802.11g OLITEC Driver(OLITEC);H:\WINDOWS\system32\DRIVERS\zd1211u.sys [2004-09-29 11:00]
S3 PAC207;CamMaestro 3.01 DU PC Camera;H:\WINDOWS\system32\DRIVERS\pfc027.sys [2005-05-27 13:57]
S3 W700bus;Sony Ericsson W700 Driver driver (WDM);H:\WINDOWS\system32\DRIVERS\W700bus.sys [2006-02-19 16:47]
S3 W700mgmt;Sony Ericsson W700 USB WMC Device Management Drivers (WDM);H:\WINDOWS\system32\DRIVERS\W700mgmt.sys [2006-02-19 16:48]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 15:08:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-20 15:09:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-20 14:09:44
.
2008-01-10 02:02:54 --- E O F ---
0
Réponse 9 / 40
boro
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:13, on 20/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\csrss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\System32\Ati2evxx.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
H:\Program Files\Alwil Software\Avast4\ashServ.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
H:\WINDOWS\system32\svchost.exe
H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
H:\WINDOWS\System32\alg.exe
H:\WINDOWS\system32\Ati2evxx.exe
H:\WINDOWS\Explorer.EXE
H:\WINDOWS\SOUNDMAN.EXE
H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
H:\Program Files\HP\HP Software Update\HPWuSchd2.exe
H:\Program Files\DAEMON Tools\daemon.exe
H:\Program Files\Labtec\Desktop\V5.1\moffice.exe
H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
H:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE
H:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
H:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\SuperCopier2\SuperCopier2.exe
H:\Program Files\PowerArchiver\PASTARTER.EXE
H:\Program Files\Labtec\Desktop\V5.1\MOUSE32A.EXE
H:\Program Files\MSN Messenger\msnmsgr.exe
H:\Program Files\OLITEC - Moniteur réseau 802.11g\WlanUtil.exe
H:\WINDOWS\System32\PAStiSvc.exe
H:\Program Files\MSN Messenger\usnsvc.exe
H:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
H:\PROGRA~1\MOZILL~1\FIREFOX.EXE
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe
H:\WINDOWS\system32\wbem\wmiprvse.exe
H:\WINDOWS\system32\NOTEPAD.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://home.neuf.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://actus.sfr.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = John Sina
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - H:\Program Files\Multi_Media_France\tbMul1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - H:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - H:\WINDOWS\system32\urqopol.dll
O2 - BHO: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - H:\Program Files\Multi_Media_France\tbMul1.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {CFC8A0ED-00A7-4554-B810-A2F6CEE9F5A4} - (no file)
O3 - Toolbar: Multi Media France Toolbar - {7009fcd4-05be-44f4-9583-93fe419ab7b0} - H:\Program Files\Multi_Media_France\tbMul1.dll
O3 - Toolbar: My Web Search - {07B18EA9-A523-4961-B6BB-170DE4475CCA} - H:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avast!] H:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] H:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb12.exe
O4 - HKLM\..\Run: [HP Software Update] "H:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "H:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [FLMOFFICE4DMOUSE] H:\Program Files\Labtec\Desktop\V5.1\moffice.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] H:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Nero DriveSpeed] H:\PROGRA~1\Ahead\NEROTO~1\DRIVES~1.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "H:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [My Web Search Bar Search Scope Monitor] "H:\PROGRA~1\MYWEBS~1\bar\1.bin\m3SrchMn.exe" /m=2 /w
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] H:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [PowerArchiver Tray] H:\Program Files\PowerArchiver\PASTARTER.EXE
O4 - HKCU\..\Run: [msnmsgr] "H:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "H:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancer l'utilitaire Olitec.lnk = ?
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNfox000
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://H:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: urqopol - H:\WINDOWS\SYSTEM32\urqopol.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - H:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - H:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Pml Driver HPZ12 - HP - H:\WINDOWS\system32\HPZipm12.exe
O23 - Service: STI Simulator - Unknown owner - H:\WINDOWS\System32\PAStiSvc.exe
0
Réponse 10 / 40
seyaba
http://www.commentcamarche.net/forum/affich 4697782 trojan win32 tratbho trj
0
Réponse 11 / 40
crousps Auteur
ecoute ca marche plutot bien. je n'ai plus d'alerte et j'essaie de suivre tes conseils a la lettre.donc a priori R.A.S
0
Réponse 12 / 40
g!rly Contributeur
ok, c´est plutot positif ;-)
comment va ton pc?
@+
0
Réponse 13 / 40
crousps Auteur
voila.

AntiVir PersonalEdition Classic
Report file date: samedi 19 janvier 2008 17:03

Scanning for 1056958 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (plain) [5.1.2600]
Username: jean-michel
Computer name: LOLO-NF9R3QWUIE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:14:01
ANTIVIR2.VDF : 7.0.2.0 948736 Bytes 15/01/2008 22:14:01
ANTIVIR3.VDF : 7.0.2.20 225792 Bytes 18/01/2008 22:14:01
AVEWIN32.DLL : 7.6.0.48 3080704 Bytes 18/01/2008 22:14:01
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 18/01/2008 22:14:01
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Rootkit search
Configuration file...............: I:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\rootkit.avp
Logging..........................: high
Primary action...................: interactive
Secondary action.................: delete
Scan master boot sector..........: off
Scan boot sector.................: on
Scan memory......................: off
Process scan.....................: off
Scan registry....................: off
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Expanded search settings.........: 0x00300922

Start of the scan: samedi 19 janvier 2008 17:03

Starting search for hidden objects.
'272559' objects were checked, '0' hidden objects were found.

End of the scan: samedi 19 janvier 2008 17:27
Used time: 23:56 min

The scan has been done completely.

0 Scanning directories
0 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
0 Files cannot be scanned
0 Files not concerned
0 Archives were scanned
0 Warnings
0 Notes
272559 Objects were scanned with rootkit scan
0 Hidden objects were found
0
Réponse 14 / 40
g!rly Contributeur
oui post celui d´antivir stp
0
Réponse 15 / 40
crousps Auteur
voila le rapport de sdfix et de hijackthis en attendant celui d'antivir.
SDFix: Version 1.129

Run by jean-michel on 19/01/2008 at 13:43

Microsoft Windows XP [version 5.1.2600]

Running From: I:\DOCUME~1\JEAN-M~1\Bureau\SDFix\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Service mp32 - Deleted after Reboot

Normal Mode:
Checking Files:

Trojan Files Found:

I:\Program Files\Helper\superfindout.dll - Deleted
I:\WINDOWS\system32\dxdss.sys - Deleted

Folder I:\Program Files\Helper - Removed

Removing Temp Files...

ADS Check:

I:\WINDOWS
No streams found.

I:\WINDOWS\system32
No streams found.

I:\WINDOWS\system32\svchost.exe
No streams found.

I:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-19 13:49:40
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"DhcpNameServer"="192.168.1.1 0.0.0.0"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{FA32F2E9-42FD-4682-9B73-510ADAAF424B}]
"DhcpNameServer"="192.168.1.1 0.0.0.0"
"DhcpDefaultGateway"=str(7):"192.168.1.1\0"
"DhcpSubnetMaskOpt"=str(7):"255.255.255.0\0"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{FA32F2E9-42FD-4682-9B73-510ADAAF424B}\Parameters\Tcpip]
"DhcpDefaultGateway"=str(7):"192.168.1.1\0"
"DhcpSubnetMaskOpt"=str(7):"255.255.255.0\0"

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - I:\DOCUME~1\JEAN-M~1\Bureau\SDFix\SDFix\backups\backups.zip

Files with Hidden Attributes:

Fri 21 Dec 2007 4,348 ..SH. --- "I:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 13 Jan 2008 31,232 ...H. --- "I:\Documents and Settings\jean-michel\Mes documents\~WRL0995.tmp"
Mon 13 Nov 2006 319,456 A..H. --- "I:\Program Files\Fichiers communs\Motorola Shared\MotPCSDrivers\difxapi.dll"
Sun 13 Jan 2008 19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0003.tmp"
Sun 13 Jan 2008 19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0005.tmp"
Sun 13 Jan 2008 36,864 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0343.tmp"
Sun 13 Jan 2008 33,792 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL0891.tmp"
Sun 13 Jan 2008 19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1058.tmp"
Sun 13 Jan 2008 19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1963.tmp"
Sun 13 Jan 2008 19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1973.tmp"
Sun 13 Jan 2008 33,280 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL1981.tmp"
Sun 13 Jan 2008 19,456 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL2082.tmp"
Sun 13 Jan 2008 31,232 ...H. --- "I:\Documents and Settings\jean-michel\Application Data\Microsoft\Word\~WRL2769.tmp"

Finished!
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:59:04, on 19/01/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
I:\WINDOWS\System32\smss.exe
I:\WINDOWS\system32\winlogon.exe
I:\WINDOWS\system32\services.exe
I:\WINDOWS\system32\lsass.exe
I:\WINDOWS\system32\svchost.exe
I:\WINDOWS\System32\svchost.exe
I:\WINDOWS\system32\spoolsv.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
I:\WINDOWS\Explorer.EXE
I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
I:\WINDOWS\system32\notepad.exe
C:\Program Files\qttask.exe
I:\PROGRA~1\Wanadoo\TaskBarIcon.exe
I:\WINDOWS\Mixer.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
I:\WINDOWS\System32\ctfmon.exe
E:\Program Files\PeerGuardian2\pg2.exe
I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
I:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
I:\Program Files\MSN Messenger\MsnMsgr.Exe
I:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
I:\Program Files\SAGEM Wi-Fi USB 802.11g\WLANUTL.exe
I:\PROGRA~1\Wanadoo\ComComp.exe
I:\PROGRA~1\Wanadoo\Toaster.exe
I:\PROGRA~1\Wanadoo\Inactivity.exe
I:\PROGRA~1\Wanadoo\PollingModule.exe
I:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
I:\PROGRA~1\Wanadoo\Watch.exe
D:\PeerGuardian pr14\PeerGuardian_1.99b_pr14.exe
I:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
i:\program files\avira\antivir personaledition classic\avscan.exe
I:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.orange.fr/portail
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - I:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - I:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - I:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - i:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - I:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - I:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - i:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WOOWATCH] I:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] I:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NeroFilterCheck] I:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "I:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\Run: [avgnt] "I:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] E:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [WOOKIT] I:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|DEFAULT=cnx|PARAM=
O4 - HKCU\..\Run: [swg] I:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MsnMsgr] "I:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] I:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = I:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - I:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - I:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
0
Réponse 16 / 40
g!rly Contributeur
ok ;-)
0
Réponse 17 / 40
crousps Auteur
ok quand j'aurais fait tout ca je referais un scan avec antivir et je te posterais le rapport.
0
Réponse 18 / 40
g!rly Contributeur
celui d´antivir
0
Réponse 19 / 40
crousps Auteur
oui mais lequel?
0
Réponse 20 / 40
g!rly Contributeur
oui supprime les...

peux tu me poster un rapport si tu as moyen?

@+
0
- 1
- 2
Suivant

Trojan Win32:TratBHO[Trj]

40 réponses

Discussions similaires

Newsletters