Virus tratbho(tri)

De rien fanette280,

Bonne continuation ;-)

Bye`

Ouf ca y est, c'est enfin fini...! Ben merci pour tout parce que sans toi j'aurais jamais pu faire tout ca.

@ ++

--

Le meilleur moyen de faire tourner la tête à une femme, c'est de lui dire qu'elle a un joli profil

ok tres bien fanette,
tiens moi au courrant si jamais tu avait un autre souci...
jusque la porte toi bien ;-)
@+

Voici le rapport de Toolscleaner :

-->- Recherche:

C:\Vundofix backups: trouvé !
C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\Raphaëlle\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\Raphaëlle\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\Raphaëlle\Bureau\vundoFix.exe: trouvé !
C:\Documents and Settings\Raphaëlle\Recent\MSNFix.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\QooBox\Quarantine\C\Combofix: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\Raphaëlle\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\Raphaëlle\Bureau\ComboFix.exe: supprimé !
C:\Documents and Settings\Raphaëlle\Bureau\vundoFix.exe: supprimé !
C:\Documents and Settings\Raphaëlle\Recent\MSNFix.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Vundofix backups: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

ok

fais ceci :

Désactive ta restauration système:
pour cela :
Click droit sur poste de travail, dans l´arborescence sur propriétés;
dans la nouvelle fenettre click sur l´onglet restauration système;
coche la case désactiver la restauration systèm et applique.
puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés;
dans la nouvelle fenettre click sur l´onglet restauration systèm
décoche la case désactiver la restauration systèm et applique.

puis

Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).

@+

Voici le rapport antivir :

AntiVir PersonalEdition Classic
Report file date: lundi 3 mars 2008 12:00

Scanning for 1130387 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: THUMINE-LITZO7X

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:45:58
ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 24/02/2008 22:45:58
ANTIVIR3.VDF : 7.0.2.216 135168 Bytes 02/03/2008 22:41:36
AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 29/02/2008 22:45:59
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 29/02/2008 22:45:59
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Local Hard Disks
Configuration file...............: C:\Program Files\Avira\AntiVir PersonalEdition Classic\alldiscs.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: lundi 3 mars 2008 12:00

Starting search for hidden objects.
'34693' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'notepad.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'emule.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'upgrade_manager.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'oaui.exe' - '0' Module(s) have been scanned
Scan process 'avgas.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '0' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'oasrv.exe' - '0' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
34 processes with 34 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '22' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP533\A0106466.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47fcde0e.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP533\A0106467.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47fcde13.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP533\A0106468.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '4694507c.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP533\A0106506.exe
[DETECTION] Contains detection pattern of the dropper DR/180Solutions.AY.4
[INFO] The file was moved to '47fcde14.qua'!
C:\WINDOWS\system32\kernel32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntdll.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntkrnlpa.exe
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntoskrnl.exe
[WARNING] The file could not be opened!
C:\WINDOWS\system32\user32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\win32k.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\ndisrd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\OADriver.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\OAmon.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'

End of the scan: lundi 3 mars 2008 12:29
Used time: 29:41 min

The scan has been done completely.

3697 Scanning directories
185557 Files were scanned
4 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
4 files were moved to quarantine
0 files were renamed
10 Files cannot be scanned
185553 Files not concerned
1286 Archives were scanned
10 Warnings
19 Notes
34693 Objects were scanned with rootkit scan
0 Hidden objects were found

Salut fanette280,

peux tu poster le rapport d´antivir stp ?

@+

Salut,

J'ai l'impression que mon pc est réparé. En tout cas il marche super bien!
J'ai quand même refaits un scan avec antivir et il m'a trouvé encore des virus et j'ai mis les fichiers en quarantaine.

Je te remercie vraiment pour ton aide et ta patience. C'est super sympa. Merci beaucup!!!

Fanette280,

Comment se porte ton pc?

@+

Voici le rapport de combofix :

ComboFix 08-02-25.3 - Raphaëlle 2008-03-02 11:55:21.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.137 [GMT 1:00]
Endroit: C:\Documents and Settings\Raphaëlle\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Raphaëlle\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-02-02 to 2008-03-02 ))))))))))))))))))))))))))))))))))))
.

2008-03-01 19:31 . 2008-03-01 19:31 <REP> d-------- C:\WINDOWS\LastGood
2008-03-01 19:31 . 2008-03-01 20:19 <REP> d-------- C:\WINDOWS\BDOSCAN8
2008-03-01 11:35 . 2008-03-01 11:35 <REP> d-------- C:\Documents and Settings\Raphaëlle\Application Data\Grisoft
2008-03-01 11:33 . 2008-03-01 11:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-01 11:33 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-01 10:58 . 2008-03-01 10:58 <REP> d-------- C:\VundoFix Backups
2008-02-29 23:39 . 2008-02-29 23:39 <REP> d-------- C:\Program Files\Avira
2008-02-29 23:39 . 2008-02-29 23:39 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-02-29 22:54 . 2008-02-29 22:55 250 --a------ C:\WINDOWS\wininit.ini
2008-02-29 22:20 . 2008-02-29 22:55 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-29 22:14 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-02-29 21:28 . 2008-02-29 21:28 <REP> d-------- C:\OnlineArmor
2008-02-29 21:28 . 2008-03-01 15:40 <REP> d-------- C:\Documents and Settings\Raphaëlle\Application Data\OnlineArmor
2008-02-29 21:28 . 2008-02-29 21:28 <REP> d-------- C:\Documents and Settings\All Users\Application Data\OnlineArmor
2008-02-29 21:28 . 2007-11-08 06:37 68,608 --a------ C:\WINDOWS\system32\drivers\OADriver.sys
2008-02-29 21:28 . 2007-09-29 00:06 25,600 --a------ C:\WINDOWS\system32\drivers\OAmon.sys
2008-02-29 21:28 . 2007-09-29 00:06 18,944 --a------ C:\WINDOWS\system32\drivers\ndisrd.sys
2008-02-29 21:20 . 2008-02-29 21:21 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2008-02-29 21:06 . 2008-02-29 21:07 <REP> d-------- C:\WINDOWS\system32\fr-fr
2008-02-29 21:02 . 2008-02-29 21:07 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-02-29 21:01 . 2008-02-29 21:07 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-02-29 21:01 . 2007-12-07 03:08 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-02-29 21:01 . 2007-12-07 03:08 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-02-29 21:00 . 2007-12-07 03:08 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-02-29 21:00 . 2007-07-01 04:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-02-29 21:00 . 2007-07-01 04:36 1,048,576 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-02-29 21:00 . 2007-12-07 03:08 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-02-29 21:00 . 2007-12-07 03:08 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-02-29 21:00 . 2007-12-07 03:08 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-02-29 21:00 . 2007-12-06 12:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-02-29 19:35 . 2008-02-29 19:35 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-29 13:47 . 2008-02-29 13:47 <REP> d-------- C:\Program Files\Trend Micro
2008-02-28 19:10 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-02-27 18:18 . 2008-02-27 18:18 <REP> d-------- C:\Documents and Settings\Raphaëlle\Application Data\Viewpoint
2008-02-26 13:31 . 2008-02-29 20:31 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-26 13:31 . 2008-02-26 13:31 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-26 13:29 . 2008-02-26 13:29 <REP> d-------- C:\Program Files\iPod
2008-02-26 13:28 . 2008-02-26 13:29 <REP> d-------- C:\Program Files\iTunes
2008-02-26 13:16 . 2008-02-26 13:19 <REP> d-------- C:\Program Files\QuickTime
2008-02-20 15:38 . 2008-02-20 15:38 <REP> d-------- C:\Program Files\Yahoo!

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-29 21:54 --------- d-----w C:\Documents and Settings\Raphaëlle\Application Data\WeatherDPA
2008-01-09 17:54 --------- d-----w C:\Program Files\Red Kawa
2008-01-09 17:54 --------- d-----w C:\Program Files\AviSynth 2.5
2008-01-09 14:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
2008-01-09 13:23 --------- d-----w C:\Documents and Settings\Raphaëlle\Application Data\Apple Computer
2008-01-09 13:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-09 13:15 --------- d-----w C:\Program Files\Apple Software Update
2008-01-09 13:13 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-01-09 13:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-12 23:23 315,392 ----a-w C:\WINDOWS\HideWin.exe
2007-12-07 02:08 824,832 ----a-w C:\WINDOWS\system32\wininet.dll
2006-10-18 17:32 17,920 ----a-w C:\Documents and Settings\Raphaëlle\Application Data\GDIPFONTCACHEV1.DAT
.
[color=red] C:\WINDOWS\system32\user32.dll ... is infected !! (additional data below) [/color]
562,176 2001-08-28 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\user32.dll
578,048 2004-08-19 14:09:48 C:\WINDOWS\ServicePackFiles\i386\user32.dll
578,048 2004-08-19 14:09:48 C:\WINDOWS\system32\user32.dll

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\WINDOWS\system32\ini ----

C:\WINDOWS\system32\ini\

---- Directory of C:\WINDOWS\system32\tmp ----

C:\WINDOWS\system32\tmp\

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"L'Assistant DartyBox"="C:\Program Files\Assistant Dartybox\Upgrade_Manager.exe" [2007-06-05 21:15 151552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-30 23:35 7634944]
"nwiz"="nwiz.exe" [2006-10-30 23:35 1622016 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-30 23:35 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 08:03 16125440 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-29 23:45 249896]
"!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
"OnlineArmor GUI"="D:\Program Files\Tall Emu\Online Armor\oaui.exe" [2007-11-16 07:51 5029952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:09 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= D:\PROGRA~1\TALLEM~1\ONLINE~1\oaevent.dll [2007-11-16 07:50 633344]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 NDISRD;NDISRD;C:\WINDOWS\system32\drivers\NDISRD.sys [2007-09-29 00:06]
R1 OADevice;OADriver;C:\WINDOWS\system32\drivers\OADriver.sys [2007-11-08 06:37]
R1 OAmon;OAmon;C:\WINDOWS\system32\drivers\OAmon.sys [2007-09-29 00:06]
R2 SvcOnlineArmor;Online Armor;"D:\Program Files\Tall Emu\Online Armor\oasrv.exe" [2007-11-16 07:51]
S3 fbxusb;FreeBox USB Network Adapter;C:\WINDOWS\system32\DRIVERS\fbxusb.sys [2002-12-11 14:25]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-02-26 11:43:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-02 10:59:09 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 12:12:19
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-03-02 12:18:04
ComboFix-quarantined-files.txt 2008-03-02 11:17:41
ComboFix2.txt 2008-02-29 18:27:01
ComboFix3.txt 2008-02-29 12:41:41

fanette280

ok pour bitdefender.

fais ceci :

Copie le texte ci-dessous :

DirLook::
C:\WINDOWS\system32\ini
C:\WINDOWS\system32\tmp

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix,

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt

@+

J'ai bien supprimé tout ce que AVG a trouvé et j'ai scané avec bitdefender

Voici le rapport :

BitDefender Online Scanner

Scan report generated at: Sat, Mar 01, 2008 - 20:14:45

Scan path: A:\;C:\;D:\;E:\;

Statistics

Time

00:41:10

Files

148913

Folders

3705

Boot Sectors

3

Archives

1908

Packed Files

12394

Results

Identified Viruses

24

Infected Files

50

Suspect Files

0

Warnings

0

Disinfected

0

Deleted Files

50

Engines Info

Virus Definitions

984760

Engine build

AVCORE v1.0 (build 2422) (i386) (Sep 25 2007 08:26:36)

Scan plugins

16

Archive plugins

41

Unpack plugins

7

E-mail plugins

6

System plugins

5

Scan Settings

First Action

Disinfect

Second Action

Delete

Heuristics

Yes

Enable Warnings

Yes

Scanned Extensions

*;

Exclude Extensions

Scan Emails

Yes

Scan Archives

Yes

Scan Packed

Yes

Scan Files

Yes

Scan Boot

Yes

Scanned File

Status

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\467c2742.qua

Infected with: Trojan.Vundo.DVO

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\467c2742.qua

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\467c2742.qua

Deleted

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\48419327.qua

Infected with: Trojan.Vundo.DVO

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\48419327.qua

Disinfection failed

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\INFECTED\48419327.qua

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\dBenderC.dll.vir

Detected with: Adware.Hotbar.B

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\dBenderC.dll.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HostOE.dll.vir

Detected with: Adware.Zango.AN

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HostOE.dll.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HotbarSADF.exe.vir

Detected with: Adware.Zango.SB

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HotbarSADF.exe.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HotbarSAHook.dll.vir

Detected with: Adware.Zango.AV

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HotbarSAHook.dll.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HotbarUnInstaller.exe.vir=>(NSIS o)=>lzma_solid_nsis0004

Detected with: Adware.Zango.AU

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HotbarUnInstaller.exe.vir=>(NSIS o)=>lzma_solid_nsis0004

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\HotbarUnInstaller.exe.vir=>(NSIS o)

Update failed

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\InstIE.dll.vir

Detected with: Adware.Zango.AG

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\InstIE.dll.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\OEAddOn.exe.vir

Detected with: Adware.Zango.SC

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\OEAddOn.exe.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\Wallpaper.dll.vir

Detected with: Adware.Zango.BB

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\Wallpaper.dll.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\Weather.exe.vir

Detected with: Application.Adware.Savenow.I

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\Weather.exe.vir

Disinfection failed

C:\QooBox\Quarantine\C\Program Files\Hotbar\bin\10.0.356.0\Weather.exe.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL.vir

Detected with: Application.MWS

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL.vir

Disinfection failed

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3CJPEG.DLL.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir

Detected with: Adware.Toolbar.Mywebsearch.AK

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTMLMU.DLL.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir

Detected with: Adware.Mywebsearch.AF

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3HTTPCT.DLL.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir

Detected with: Adware.Msearch.P

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\F3SCHMON.EXE.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir

Detected with: Application.AdTool.MyWebSearch.AT

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir

Disinfection failed

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3HTML.DLL.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL.vir

Detected with: Adware.Mywebsearch.AS

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3PLUGIN.DLL.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE.vir

Detected with: Application.AdTool.MyWebSearch.AU

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE.vir

Disinfection failed

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SLSRCH.EXE.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE.vir

Detected with: Application.Mywebsearch.Toolbar.C

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE.vir

Disinfection failed

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\M3SRCHMN.EXE.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir

Detected with: Adware.Mywebsearch.I

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\MWSOEMON.EXE.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL.vir

Detected with: Adware.Toolbar.MyWebSearch.AC

C:\QooBox\Quarantine\C\Program Files\MyWebSearch\bar\1.bin\NPMYWEBS.DLL.vir

Deleted

C:\QooBox\Quarantine\C\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll.vir

Detected with: Adware.Smartshopper.B

C:\QooBox\Quarantine\C\Program Files\ShoppingReport\Bin\2.0.26\ShoppingReport.dll.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0005

Detected with: Adware.NaviPromo.BYC

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0005

Deleted

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)

Update failed

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0013=>(NSIS g)=>lzma_solid_nsis0002

Detected with: Adware.NaviPromo.BYC

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0013=>(NSIS g)=>lzma_solid_nsis0002

Deleted

C:\QooBox\Quarantine\C\WINDOWS\pack.epk.vir=>(NSIS 2g)=>lzma_solid_nsis0013=>(NSIS g)

Update failed

C:\QooBox\Quarantine\C\WINDOWS\system32\edeeg.bak1.vir

Infected with: Trojan.Vundo.DVS

C:\QooBox\Quarantine\C\WINDOWS\system32\edeeg.bak1.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\edeeg.bak1.vir

Deleted

C:\QooBox\Quarantine\C\WINDOWS\system32\fhhkj.bak1.vir

Infected with: Trojan.Vundo.DVS

C:\QooBox\Quarantine\C\WINDOWS\system32\fhhkj.bak1.vir

Disinfection failed

C:\QooBox\Quarantine\C\WINDOWS\system32\fhhkj.bak1.vir

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103640.dll

Infected with: Trojan.Vundo.DYE

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103640.dll

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103644.dll

Infected with: Trojan.Vundo.DYE

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103644.dll

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104674.dll

Detected with: Adware.Hotbar.B

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104674.dll

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104675.dll

Detected with: Adware.Zango.AN

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104675.dll

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104678.exe

Detected with: Adware.Zango.SB

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104678.exe

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104679.dll

Detected with: Adware.Zango.AV

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104679.dll

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104680.exe=>(NSIS o)=>lzma_solid_nsis0004

Detected with: Adware.Zango.AU

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104680.exe=>(NSIS o)=>lzma_solid_nsis0004

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104680.exe=>(NSIS o)

Update failed

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104681.dll

Detected with: Adware.Zango.AG

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104681.dll

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104683.exe

Detected with: Adware.Zango.SC

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104683.exe

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104686.dll

Detected with: Adware.Zango.BB

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104686.dll

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104687.exe

Detected with: Application.Adware.Savenow.I

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104687.exe

Disinfection failed

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104687.exe

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104691.DLL

Detected with: Application.MWS

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104691.DLL

Disinfection failed

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104691.DLL

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104694.DLL

Detected with: Adware.Toolbar.Mywebsearch.AK

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104694.DLL

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104695.DLL

Detected with: Adware.Mywebsearch.AF

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104695.DLL

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104701.EXE

Detected with: Adware.Msearch.P

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104701.EXE

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104706.DLL

Detected with: Application.AdTool.MyWebSearch.AT

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104706.DLL

Disinfection failed

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104706.DLL

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104710.DLL

Detected with: Adware.Mywebsearch.AS

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104710.DLL

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104713.EXE

Detected with: Application.AdTool.MyWebSearch.AU

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104713.EXE

Disinfection failed

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104713.EXE

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104714.EXE

Detected with: Application.Mywebsearch.Toolbar.C

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104714.EXE

Disinfection failed

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104714.EXE

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104716.EXE

Detected with: Adware.Mywebsearch.I

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104716.EXE

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104719.DLL

Detected with: Adware.Toolbar.MyWebSearch.AC

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104719.DLL

Deleted

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104723.dll

Detected with: Adware.Smartshopper.B

C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104723.dll

Deleted

C:\WINDOWS\system32\edeeg.tmp

Infected with: Trojan.Vundo.DVS

C:\WINDOWS\system32\edeeg.tmp

Disinfection failed

C:\WINDOWS\system32\edeeg.tmp

Deleted

C:\WINDOWS\system32\fhhkj.ini

Infected with: Trojan.Vundo.DVS

C:\WINDOWS\system32\fhhkj.ini

Disinfection failed

C:\WINDOWS\system32\fhhkj.ini

Deleted

Salut fanette280,

tu as supprimé tout ce que avg a trouvé?

ok pour vundofix ;-)

pour verifier refais un scan ici :

Scan en ligne bitdefender :

https://www.bitdefender.com/toolbox/

Clicker sur " I agree " et suivre les indications

A faire imperativement sous internet explorer, en acceptant l´activ x

tutoriel en image en image

http://pageperso.aol.fr/rginformatique/mapage/defender.htm

Post le rapport obtenu stp

@+

Re,

J'ai quand même fait le scan de AVG anti-spyware en mode sans échec et voici le rapport :

AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

+ Créé à: 15:17:46 01/03/2008

+ Résultat de l'analyse:

C:\WINDOWS\system32\fivciduw.exe -> Not-A-Virus.Adware.180Solutions : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Bureau\EvID4226Patch.exe -> Not-A-Virus.Hacktool.EvID : Aucune action entreprise.
:mozilla.237:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.96:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Adbrite : Aucune action entreprise.
:mozilla.97:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Adbrite : Aucune action entreprise.
:mozilla.105:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Cookies\raphaëlle@adtech[1].txt -> TrackingCookie.Adtech : Aucune action entreprise.
:mozilla.106:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.107:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.108:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.109:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.116:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Cookies\raphaëlle@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
:mozilla.452:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Burstbeacon : Aucune action entreprise.
:mozilla.454:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
:mozilla.455:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Cookies\raphaëlle@casinotropez[1].txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
:mozilla.410:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.411:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.412:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.100:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Euroclick : Aucune action entreprise.
:mozilla.101:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Euroclick : Aucune action entreprise.
:mozilla.102:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Euroclick : Aucune action entreprise.
:mozilla.103:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Euroclick : Aucune action entreprise.
:mozilla.465:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Googleadservices : Aucune action entreprise.
:mozilla.249:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Overture : Aucune action entreprise.
:mozilla.278:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Questionmarket : Aucune action entreprise.
:mozilla.279:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Questionmarket : Aucune action entreprise.
:mozilla.285:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Revsci : Aucune action entreprise.
:mozilla.286:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Revsci : Aucune action entreprise.
:mozilla.287:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Revsci : Aucune action entreprise.
:mozilla.288:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Revsci : Aucune action entreprise.
:mozilla.289:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Revsci : Aucune action entreprise.
:mozilla.120:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.298:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.299:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.300:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.301:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.302:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.303:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Cookies\raphaëlle@bs.serving-sys[2].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Cookies\raphaëlle@serving-sys[1].txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.304:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.305:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.306:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.307:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.317:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
:mozilla.318:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
:mozilla.319:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
:mozilla.320:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
:mozilla.321:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Cookies\raphaëlle@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Aucune action entreprise.
:mozilla.10:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.11:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.413:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Webtrends : Aucune action entreprise.
:mozilla.42:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.43:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.44:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.45:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.46:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.47:C:\Documents and Settings\Raphaëlle\Application Data\Mozilla\Firefox\Profiles\4x1i7kur.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
C:\Documents and Settings\Raphaëlle\Cookies\raphaëlle@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.

Fin du rapport

salut,

J'ai lancé le scan voundofix et il n'a rien trouvé... Je sais aps trop si c'est normal.

Re,

oui il restait des trojans vundo...

fais ceci :

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
http://www.atribune.org/ccount/click.php?id=4
* Double-clique VundoFix.exe afin de le lancer
* Clique sur le bouton Scan for Vundo
* Lorsque le scan est complété, clique sur le bouton Remove Vundo
* Une invite te demandera si tu veux supprimer les fichiers, clique YES
* Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
* Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
* Copie/colle le contenu du rapport situé dans C:\vundofix.txt

puis

A.V.G :

-> Télécharger AVG Anti-Spyware (ewido)

http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

-> L´installer.

-> lancer AVG Anti-Spyware et clicker sur le bouton Mise à jour. Patienter...

p.s : si les mises a jours ne se font pas, elles sont telechargable ici :

http://downloads.ewido.net/avgas-signatures-full-current.exe

-> Sur la page "analyse":

choisir d´abord l'onglet "paramètres".

sous « Comment réagir » clicker sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer ».

redemarre le pc en mode sans echec :

Comment redémarrer en mode sans echec?

Tu redemarre le pc et tapote la touche F8 des le début de l allumage sans t´arrêter.
Une fenêtre sur fond noir va s’ouvrir, tu te déplaces avec les flèches du clavier sur démarrer en mode sans échec puis tape entrée.
Une fois sur le bureau si il n y a pas toutes les couleurs et autres c´est normal!
Ps : si F8 ne marche pas utilise la touche F5.

-> Tuto : http://forum.telecharger.01net.com/forum/high-tech/SECURITE/Securite/redemarrer-mode-echec-sujet_1526_1.htm

-> Lancer le scan, (c´est long...).

-> A la fin du scan copier Et coller le rapport ici.

-> Une aide en image au cas ou :

Tutoriel d´installation et de parametrages :

http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html

@+

Ca y est, j'ai tout suivi à la lettre et tout installé.

Voici le rapport d'Antivir :

AntiVir PersonalEdition Classic
Report file date: samedi 1 mars 2008 00:03

Scanning for 1129035 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: THUMINE-LITZO7X

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 22:45:58
ANTIVIR2.VDF : 7.0.2.181 1993728 Bytes 24/02/2008 22:45:58
ANTIVIR3.VDF : 7.0.2.215 117248 Bytes 29/02/2008 22:45:58
AVEWIN32.DLL : 7.6.0.73 3334656 Bytes 29/02/2008 22:45:59
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.6.0.3 360488 Bytes 29/02/2008 22:45:59
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: high

Start of the scan: samedi 1 mars 2008 00:03

Starting search for hidden objects.
'34028' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'upgrade_manager.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'oaui.exe' - '0' Module(s) have been scanned
Scan process 'RTHDCPL.exe' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'oasrv.exe' - '0' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
31 processes with 31 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[NOTE] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '26' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\QooBox\Quarantine\catchme2008-02-29_133957.67.zip
[0] Archive type: ZIP
--> xxyyawx.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483c9273.qua'!
C:\QooBox\Quarantine\C\Program Files\ShoppingReport\Uninst.exe.vir
[DETECTION] Contains detection pattern of the dropper DR/MartShop.2
[INFO] The file was moved to '483192a0.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\aosxgeet.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483b92ab.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\awvtu.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483e92c1.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\bovirkmo.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483e92be.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\cbnadrco.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483692bd.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\cqdunhpw.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482c92cf.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\dogfbult.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482f92d1.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\edosgjut.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483792c9.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\fchryesu.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483092cb.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\gebca.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482a92d0.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\gebcc.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482a92d3.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\gucirnns.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482b92e6.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\hcdmokib.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482c92d7.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\jeefrxcj.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482d92dc.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\jutpvkvd.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483c92f0.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\lomuawen.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483592ec.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\mljjj.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483292ec.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\mllmn.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483492ee.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\ohfeunru.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482e92ed.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\ohgovjdc.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482f92f0.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\osmdsobv.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483592fd.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\pejwqioy.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483292f3.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\pmkji.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483392ff.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\rmkugnaa.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '48339303.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\rxtdeqxe.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483c9312.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\sdygjfmc.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '48419300.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\sqwtviha.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483f9310.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\tiwwckem.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483f930a.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\vollovrr.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '48349313.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\vtutq.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483d931a.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\wbwtdifm.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483f930b.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\xskcdkjf.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '4833931e.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\xxyyawx.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '48419327.qua'!
C:\QooBox\Quarantine\C\WINDOWS\system32\yeetlqjd.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482d9316.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP517\A0099072.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f892e3.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP517\A0099073.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f892e9.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP517\A0099074.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f892f0.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP517\A0099075.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f892f4.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP517\A0099076.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f892f7.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP519\A0100533.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9930b.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP521\A0101620.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99312.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP521\A0102630.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99316.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103637.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9931f.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103638.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99321.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103639.dll
[DETECTION] Is the Trojan horse TR/Vundo.DME
[INFO] The file was moved to '47f99324.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103641.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99326.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP522\A0103643.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99328.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104722.exe
[DETECTION] Contains detection pattern of the dropper DR/MartShop.2
[INFO] The file was moved to '47f9932d.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104729.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9932f.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104730.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99332.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104731.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99335.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104732.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99339.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104733.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9933d.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104734.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99340.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104735.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99343.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104736.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9934e.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104737.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9934f.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104738.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c2748.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104739.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99351.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104740.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c274a.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104741.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99350.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104742.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c2749.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104743.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99352.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104744.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c274b.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104745.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99353.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104746.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c274c.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104747.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99355.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104748.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c274e.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104749.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99354.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104750.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c274d.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104751.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99356.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104752.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c274f.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104753.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99357.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104754.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c2740.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104755.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99359.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104756.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f99348.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104757.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c2751.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104758.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9934a.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104759.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '467c2753.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP523\A0104793.dll
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '467c2742.qua'!
C:\System Volume Information\_restore{A078F1AA-5476-462C-AF05-2CC1CB0FD20C}\RP524\A0104906.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '47f9935b.qua'!
C:\WINDOWS\system32\fivciduw.exe
[WARNING] 'Contains detection pattern of the dropper DR/180Solutions.AY.4'. This detection is probably an error. Please send us this file immediately for further analysis.
C:\WINDOWS\system32\geedc.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '482d9595.qua'!
C:\WINDOWS\system32\kernel32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\mllmj.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483495a6.qua'!
C:\WINDOWS\system32\ntdll.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntkrnlpa.exe
[WARNING] The file could not be opened!
C:\WINDOWS\system32\ntoskrnl.exe
[WARNING] The file could not be opened!
C:\WINDOWS\system32\user32.dll
[WARNING] The file could not be opened!
C:\WINDOWS\system32\vturo.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '483d95cb.qua'!
C:\WINDOWS\system32\win32k.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\ndisrd.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\OADriver.sys
[WARNING] The file could not be opened!
C:\WINDOWS\system32\drivers\OAmon.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'

End of the scan: samedi 1 mars 2008 00:34
Used time: 31:18 min

The scan has been done completely.

3677 Scanning directories
185030 Files were scanned
85 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
85 files were moved to quarantine
0 files were renamed
10 Files cannot be scanned
184945 Files not concerned
1235 Archives were scanned
11 Warnings
19 Notes
34028 Objects were scanned with rootkit scan
0 Hidden objects were found

Et maintenant le rapport di hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:35:41, on 01/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
D:\Program Files\Tall Emu\Online Armor\oasrv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
D:\Program Files\Tall Emu\Online Armor\oaui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Assistant Dartybox\Upgrade_Manager.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [OnlineArmor GUI] "D:\Program Files\Tall Emu\Online Armor\oaui.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [L'Assistant DartyBox] C:\Program Files\Assistant Dartybox\Upgrade_Manager.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?64c526adcc044d8c8d5377be5cfc0e22
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?64c526adcc044d8c8d5377be5cfc0e22
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Online Armor (SvcOnlineArmor) - Tall Emu - D:\Program Files\Tall Emu\Online Armor\oasrv.exe

De rien fanette ;-)

A l´aide de hijack this coche et fix les lignes suivantes :

O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxdm119YYFR
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/

comment fixer :

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol

/balltrap34/demohijack.htm

puis

tu surf avec internet explorer 6.0 = failles de securitées importantes

alors fais les mises a jour windows : tu veux la version 7.0

https://support.microsoft.com/en-US/topic/internet-explorer-downloads-d49e1f0d-571c-9a7b-d97e-be248806ca70

et pourquoi ne pas surfer avec firefox? = plus sur, tout en gardant ie 7.0 pour les mises a jour windows car impossible a effectuer sous firefox

http://www.firefox.fr/

ta version de acrobat reader n´est pas a jour, tu veux la version 8.1 derniere en date alors desinstale ta version par le panneau de configuration / ajoue et suppression de programme

et instale la derniere :

https://get2.adobe.com/reader/otherversions/

ou foxit plus léger :

https://www.clubic.com/telecharger-fiche13808-foxit-reader.html

installes un par feu:

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

https://kerio.probb.fr/f2-sunbelt-kerio-personal-firewall

Comodo 3 pro :

http://www.commentcamarche.net/telecharger/telecharger 34055041 comodo firewall pro

Online armor :

http://www.commentcamarche.net/telecharger/telecharger 34055356 online armor personal firewall

tuto : https://forum.pcastuces.com/sujet.asp?f=25&s=35606

ou zone alarm plus facil a configurer mais moins performant

https://www.malekal.com/tutoriel-zonealarm-firewall/

anti spyware :

spywareblaster :

http://www.brightfort.com/spywareblaster.html

c´est un resident, il suffit de le mettre a jour de temps en temps car la version gratuite ne le fait pas toute seul , une fois installé et mis a jour tu mets toutes les protections sur "enable"

tuto : http://forum.telecharger.01net.com/forum/high-tech/PRODUITS/Questions-techniques/question-spywareblaser-sujet_174747_1.htm

*Spybot (gratuit) :
Téléchargement :
http://www.commentcamarche.net/telecharger/telecharger 122 spybot
voir demo d utilisation (merci Balltrap)
http://perso.orange.fr/rginformatique/section%20virus/demo%20spybot.htm

fais un scan a l´aide de spybot et suppriome tout ce qu´il va te trouver...

puis

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instales l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes :
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

Je te dis tous ca car j´aimerais que tu performes un scan entier de ta machine a l´aide d´antivir avec les reglages stipulés ci dessus et que tu post le rapport généré ici stp

post un nouveau hijack this ainsi que le scan d´antivir si tu veux tu peux poster celui de spybot ou seulement me dire ce qu´il a trouvé ou pas ?!

Bon courrage`

@+

Ca y est, j'ai fait comme tu m'as dit et tout a fonctionné.

Voici le rapport combofix :

ComboFix 08-02-25.3 - Raphaëlle 2008-02-29 19:22:46.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.196 [GMT 1:00]
Endroit: C:\Documents and Settings\Raphaëlle\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Raphaëlle\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]

FILE ::
C:\WINDOWS\BM277fbc20.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\edeeg.bak1
C:\WINDOWS\system32\fhhkj.bak1
C:\WINDOWS\system32\llkkj.bak2
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\mpqss.bak2
C:\WINDOWS\system32\vollovrr.dll
E:\INSTALL4\INS3DT.EXE
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\config.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\1C9263C30139E3B5D456CFE1B697D8255AB23823.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\1DC35D5766C037FEBEF69DA43E8C12BEF1868DFC.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\37BA46E231178725849DD2F23FEE3FB777068149.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\44EA01069E17599C43FFB0E96AD5897F2D212A20.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\5D77D966848120E827ECF25D743E9AEA6B68CC1D.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\7A60D8A8B86B66FDF9419ABA6C7CADDEB8D0C1C3.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\83BE3FF3EF121B99E742D7342C4777CC8709F1F7.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\879457297094C7B2106FA805ED506C1B6FBDF1A8.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\A078D9C6D085F17EEE21516F2C144C87612EE7DF.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\ABC07195DCB319746979EEA7A58115855B2B5E60.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\BD5CF92BE4D7340C29538355642446ADC4BAA63C.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\cache.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\CEE2B669CCA7F4BDF05CE3CCEB1FBFC7FD818F0A.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\Downloads\Cache\F9EE4E09B5AE80CE31EF8082CF8DBBF71CA48DDD.dat
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\history.ini
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\locate-akamai.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\locate.mtz
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\policy-akamai.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\ServicesRegistry.xml
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\updates-akamai.mtx
C:\Documents and Settings\All Users\Application Data\Viewpoint\Viewpoint Manager\vdt.dat
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Common\VistaBoot.sdll
C:\Program Files\Viewpoint\Viewpoint Manager\CPtask.xml
C:\Program Files\Viewpoint\Viewpoint Manager\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCP.cpl
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\s.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_av.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_cp.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_up.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bottom.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vwpt_logo.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\options.ini
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\viewpoint.ico
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\vmctrl.html
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPexe.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrCore.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentMgr.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\ExtremeShot.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\Components\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Media Player\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Media Player\MTSDownloadSites.txt
C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
C:\Program Files\Viewpoint\Viewpoint Media Player\npViewpoint.xpt
C:\WINDOWS\BM277fbc20.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\edeeg.bak1
C:\WINDOWS\system32\fhhkj.bak1
C:\WINDOWS\system32\llkkj.bak2
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\mpqss.bak2
C:\WINDOWS\system32\vollovrr.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_VIEWPOINT_MANAGER_SERVICE
-------\Viewpoint Manager Service

((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-01-28 to 2008-02-29 ))))))))))))))))))))))))))))))))))))
.

2008-02-29 13:47 . 2008-02-29 13:47 <REP> d-------- C:\Program Files\Trend Micro
2008-02-29 13:41 . 2008-02-29 13:41 <REP> d-------- C:\WINDOWS\LastGood.Tmp
2008-02-28 19:10 . 2003-03-18 21:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-02-28 19:10 . 2007-12-04 14:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-02-28 19:10 . 2004-01-09 10:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-02-28 19:10 . 2007-12-04 13:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-02-28 19:10 . 2007-12-04 15:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-02-28 19:10 . 2007-12-04 15:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-02-28 19:10 . 2007-12-04 15:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-02-28 19:10 . 2007-12-04 15:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-02-28 19:10 . 2007-12-04 15:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-02-26 13:31 . 2008-02-29 19:25 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-02-26 13:31 . 2008-02-26 13:31 1,409 --a------ C:\WINDOWS\QTFont.for
2008-02-26 13:29 . 2008-02-26 13:29 <REP> d-------- C:\Program Files\iPod
2008-02-26 13:28 . 2008-02-26 13:29 <REP> d-------- C:\Program Files\iTunes
2008-02-26 13:16 . 2008-02-26 13:19 <REP> d-------- C:\Program Files\QuickTime
2008-02-20 15:38 . 2008-02-20 15:38 <REP> d-------- C:\Program Files\Yahoo!
2008-01-31 23:13 . 2008-01-31 23:13 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-31 23:13 . 2008-01-31 23:13 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 17:54 --------- d-----w C:\Program Files\Red Kawa
2008-01-09 17:54 --------- d-----w C:\Program Files\AviSynth 2.5
2008-01-09 13:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-01-09 13:15 --------- d-----w C:\Program Files\Apple Software Update
2008-01-09 13:13 --------- d-----w C:\Program Files\Fichiers communs\Apple
2008-01-09 13:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-12-12 23:23 315,392 ----a-w C:\WINDOWS\HideWin.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\WINDOWS\system32\bak ----

C:\WINDOWS\system32\bak\

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55 5674352]
"L'Assistant DartyBox"="C:\Program Files\Assistant Dartybox\Upgrade_Manager.exe" [2007-06-05 21:15 151552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-30 23:35 7634944]
"nwiz"="nwiz.exe" [2006-10-30 23:35 1622016 C:\WINDOWS\system32\nwiz.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-30 23:35 86016]
"RTHDCPL"="RTHDCPL.EXE" [2007-02-26 08:03 16125440 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 11:04 2879488 C:\WINDOWS\SkyTel.exe]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"avast!"="D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-19 15:09 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\eMule\\emule.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

S3 fbxusb;FreeBox USB Network Adapter;C:\WINDOWS\system32\DRIVERS\fbxusb.sys [2002-12-11 14:25]
S3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys []
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2008-02-26 11:43:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-29 17:59:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-29 19:25:30
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-02-29 19:27:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-29 18:26:51
ComboFix2.txt 2008-02-29 12:41:41

et maintenant le rapport hijackthis :

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:29:44, on 29/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
D:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Assistant Dartybox\Upgrade_Manager.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\imapi.exe
C:\WINDOWS\system32\wscntfy.exe
D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: (no name) - {07AA283A-43D7-4CBE-A064-32A21112D94D} - (no file)
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avast!] D:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [L'Assistant DartyBox] C:\Program Files\Assistant Dartybox\Upgrade_Manager.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZNxdm119YYFR
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Ouvrir dans un nouvel onglet d'arrière-plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/229?64c526adcc044d8c8d5377be5cfc0e22
O8 - Extra context menu item: Ouvrir dans un nouvel onglet de premier plan - res://C:\Program Files\Windows Live Toolbar\Components\fr-fr\msntabres.dll.mui/230?64c526adcc044d8c8d5377be5cfc0e22
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/SmileyCentralFWBInitialSetup1.0.0.15.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - D:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - D:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe