Tazebama Résolu

Question

Bonjour, j'utilise nod32 , c'est trés eficasse mais je suis infecté par tazebama.dll et nod 32 ne peut rien faire ...
aidez moi s.v.p

papyber · Accepted Answer

1/télécharge et installe le logiciel Hijack This 
https://www.pcastuces.com/logitheque/hijackthis.htm
tuto pour l’utiliser
regarde ici c'est parfaitement expliqué en images
 http://perso.orange.fr/rginformatique/section%20virus/demohijack.htm

2/télécharge MalwareByte
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
Installe-le

3/ Télécharge : - Ccleaner
https://www.pcastuces.com/logitheque/ccleaner.htm
("Download Latest Version", sur la droite).
 Ce logiciel va permettre de supprimer tous les fichiers temporaires. Avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires". Ensuite, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.
Un tuto
http://perso.orange.fr/jesses/Docs/Logiciels/CCleaner.htm
 
4/ lance Ccleaner , nettoyeur, et supprime tout ce qu'il trouve
Lance Ccleaner, erreurs, et répare ce qu’il trouve. Accepte les sauvegardes !

5/ lance MalwareByte
Dans l'onglet Recherche, clique sur Exécuter un examen complet puis sur Rechercher.
Sélectionne ton (tes) disques durs.
Lancer l'examen
Clique sur Enregistrer le rapport et choisis ton Bureau

6/ lance Hijack This et poste le rapport

poste les rapports demandés
MalwareByte
Hijack This

HBH · Answer

thank u "papyber" ,you helped me ...

papyber · Answer

plus de soucis?
j'aurais aimé voir les rapports..

Spaaich · Answer

salut 
  jai le meme probleme : infection par tazebama et jai effectué les instructions que ta cité et je poste les rapports de hijackthis et malwarebytes mais lors de la recherche de ce dernier il rencontre un probleme et se ferme donc jai du  abandonner l'operation avant ca fin et voila les rapport  obetenus : 

 Malwarebytes' Anti-Malware 1.18
Version de la base de données: 871

14:42:14 20/06/2008
mbam-log-6-20-2008 (14-42-11).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 6295
Temps écoulé: 32 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 1
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 2

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\System (Rootkit.DNSChanger) -> Data: kdukl.exe -> No action taken.

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.
C:\WINDOWS\System32\kdukl.exe (Rootkit.DNSChanger) -> No action taken.


le rapport de hijackthis :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:45:00, on 20/06/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Filesnamfler
aofsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.exe
C:\Program Filesnamfler
aomf.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Menara\dslmon.exe
c:\program filesnamfleradprcmp.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings	azebama.dl_
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe RVHOST.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb125\SearchSettings.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [wrna3ls] C:\Program Filesnamfler
aomf.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O17 - HKLM\System\CCS\Services\Tcpip\..\{602382D3-4E64-4499-9885-4006E4BE84EC}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\..\{971CE062-CD80-414A-8B89-F99F84904FF1}: NameServer = 85.255.115.115 85.255.112.231
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS1\Services\Tcpip\..\{602382D3-4E64-4499-9885-4006E4BE84EC}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS2\Services\Tcpip\..\{602382D3-4E64-4499-9885-4006E4BE84EC}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NetCom3 Service (Netcom3) - Unknown owner - C:\Program Files\Netcom3 Cleaner\PSCMonitor.exe (file missing)
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Filesnamfler
aofsvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

papyber · Answer

plusieurs infections découvertes...
Télécharge le FixWareout d'un de ces deux sites sur le Bureau:
http://download.bleepingcomputer.com/lonny/Fixwareout.exe

Lance le fix: Clique sur Next, puis Install, puis assure-toi que "Run fixit" est activé puis clique sur Finish.
Le fix va commencer, suis les messages à l'écran. Il te sera demandé de redémarrer ton ordinateur, fais-le.
Ton système mettra un peu plus de temps au démarrage, c'est normal.

Quand ton système aura redémarré, suis les invites des messages. 

A la fin du fix, tu auras peut-être encore besoin de redémarrer le PC.

Au final, poste le contenu du fichier C:\fixwareout\report.txt avec un nouveau rapport Hijack This
Si et seulement s’il y a des difficultés de connexion après cette manip: 
Démarrer---->Paramètres---->Panneau de configuration---->Connexions réseau 
Faire un clic droit sur la connexion par défaut, nommée en général "Connexion au réseau local" ou "Accès à distance" si tu utilises un modem téléphonique, et choisir Propriétés. 
Faire un double clic sur l'élément Protocole Internet (TCP/IP) et choisir le bouton-radio Obtenir les adresses des serveurs DNS automatiquement. 
Clique deux fois sur OK, et redémarre l'ordinateur.

spaaich · Answer

Merci d'avoir repondu a mon message et voila les rapports de Hijck this et de Fixwareout apres avoir effectué le Fix et la modification au niveau de la connexion suite à la difficulté de connexion (3min pour ouvrir cette page) :

Username "Baich" - 21/06/2008 14:35:17 [Fixwareout edited 9/01/2007]

~~~~~ Prerun check
HKLM\SOFTWARE\~\Winlogon\ "System"="kdukl.exe"

HKEY_LOCAL_MACHINE\system\currentcontrolset\services	cpip\parameters\interfaces\{971CE062-CD80-414A-8B89-F99F84904FF1} 
"nameserver"="85.255.115.115" <Value cleared.

Cache de résolution DNS vidé.
System was rebooted successfully. 
 
~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "system"="" 
....
....
~~~~~ Misc files. 
....
~~~~~ Checking for older varients.
....
~~~~~ Other
C:\WINDOWS\Temp\kdukl.ren 60928 28/08/2001 

~~~~~ Current runs (hklm hkcu "run" Keys Only)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"wrna3ls"="C:\Program Files\rnamfler\naomf.exe"
"SoundMan"="SOUNDMAN.EXE"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\ctfmon.exe"
....
Hosts file was reset, If you use a custom hosts file please replace it...
~~~~~ End report ~~~~~



Rapport de Hijack this :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:52:42, on 21/06/2008
Platform: Windows XP  (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Filesnamfler
aofsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\WINDOWS\Explorer.exe
C:\Program Filesnamfler
aomf.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Menara\dslmon.exe
c:\program filesnamfleradprcmp.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\System32\wuauclt.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=55729C844D6A45819CAD368B3E178C9F
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe RVHOST.exe
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [wrna3ls] C:\Program Filesnamfler
aomf.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\webelated.htm
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - https://www.touslesdrivers.com/index.php?v_page=29
O17 - HKLM\System\CCS\Services\Tcpip\..\{602382D3-4E64-4499-9885-4006E4BE84EC}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\..\{971CE062-CD80-414A-8B89-F99F84904FF1}: NameServer = 212.217.1.17 212.217.0.3
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS1\Services\Tcpip\..\{602382D3-4E64-4499-9885-4006E4BE84EC}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CS2\Services\Tcpip\..\{602382D3-4E64-4499-9885-4006E4BE84EC}: NameServer = 208.67.220.220,208.67.222.222 
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222 
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NetCom3 Service (Netcom3) - Unknown owner - C:\Program Files\Netcom3 Cleaner\PSCMonitor.exe (file missing)
O23 - Service: RdnaoFlSvc - Unknown owner - C:\Program Filesnamfler
aofsvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe

papyber · Answer

Télécharge SDFix (créé par AndyManchesta) et sauvegarde le sur ton Bureau.
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
***Si le lien ne fonctionne pas, essaie celui-ci :
 http://download.bleepingcomputer.com/andymanchesta/SDFix.exe ***

Double clique sur SDFix.exe et choisis Install. L'outil sera extrait à la racine du lecteur système (généralement le C:\).
Redémarre ton ordinateur en mode sans échec en suivant la procédure que voici :
·	Redémarre ton ordinateur
·	Après avoir entendu l'ordinateur biper lors du démarrage, mais avant que l'icône Windows apparaisse, tapote la touche F8  (F5 sur certains PC), une pression par seconde.
·	A la place du chargement normal de Windows, un menu avec différentes options devrait apparaître.
·	Choisis la première option, pour exécuter Windows en mode sans échec, puis appuie sur "Entrée".
·	Choisis ton compte.
Déroule la liste des instructions ci-dessous :
·	Ouvre le dossier SDFix qui vient d'être créé dans le répertoire C:\ et double clique sur RunThis.cmd pour lancer le script.
·	Appuie sur Y pour commencer le processus de nettoyage.
·	Il va supprimer les services et les entrées du Registre de certains trojans trouvés puis te demandera d'appuyer sur une touche pour redémarrer.
·	Appuie sur une touche pour redémarrer le PC.
·	Ton système sera plus long pour redémarrer qu'à l'accoutumée car l'outil va continuer à s'exécuter et supprimer des fichiers.
·	Après le chargement du Bureau, l'outil terminera son travail et affichera Finished.
·	Appuie sur une touche pour finir l'exécution du script et charger les icônes de ton Bureau.
·	Les icônes du Bureau affichées, le rapport SDFix s'ouvrira à l'écran et s'enregistrera aussi dans le dossier SDFix sous le nom Report.txt.
·	Enfin, copie/colle le contenu du fichier Report.txt dans ta prochaine réponse sur le forum, avec un nouveau log Hijackthis !

papyber · Answer

une infection qui se propage par les périphériques externes, donc si tu désinfectes ton Pc mais pas tes périphériques - clé USB, DD externe, tout périphérique qui se connecte sur ton PC, etc... cela se relance.. Tu vas faire ceci dans un 1er temps Si tu as une clé USB, disque dur externe, etc., branche-les sans les ouvrir avant de lancer ce FIX Télécharge Rav Antivirus: http://ww25.evosla.com/compteur.php?soft=rav_antivirus · Clique droit sur le fichier .ZIP > Extraire sur > le Bureau · Double clique sur >> RAV.exe << afin de lancer l'outil. · Une fois RAV ANTIVIRUS lancé, laisse-le réagir, il Scanne automatiquement tous les lecteurs (disques fixes et amovibles) · Si infection > un rapport s'établira, sinon s'affichera (très rapide) ==>Votre Ordinateur est sain. · Retire tes disques amovibles et redémarre ton ordinateur. Poste le rapport, si infection! puis ensuite tu vaccines tes clés USB comme cela tu ne te réinfecteras plus de cette façon... à lire et à suivre toute la manip... merci gof https://forum.zebulon.fr/topic/131959-infections-par-supports-amovibles/

Josef · Answer

lé gars voici mon rapport de fixwareout 

Username "Youssef" - 10/07/2008 16:40:55 [Fixwareout edited 9/01/2007] 

~~~~~ Prerun check 

Cache de résolution DNS vidé. 


System was rebooted successfully. 

~~~~~ Postrun check 
HKLM\SOFTWARE\~\Winlogon\ "System"="" 
.... 
.... 
~~~~~ Misc files. 
.... 
~~~~~ Checking for older varients. 
.... 

~~~~~ Current runs (hklm hkcu "run" Keys Only) 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"DAEMON Tools-1033"="\"C:\Program Files\D-Tools\daemon.exe\" -lang 1033" 
"SoundMan"="SOUNDMAN.EXE" 
"IMJPMIG8.1"="\"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" 
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC" 
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC" 
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName" 
"TkBellExe"="\"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe\" -osboot" 
"QuickTime Task"="\"C:\Program Files\QuickTime\qttask.exe\" -atboottime" 
"Adobe Reader Speed Launcher"="\"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe\"" 
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup" 
"ISUSScheduler"="\"C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe\" -start" 

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"MsnMsgr"="\"C:\Program Files\MSN Messenger\MsnMsgr.Exe\" /background" 
"ares"="\"C:\Program Files\Ares\Ares.exe\" -h" 
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe\"" 
"UMService"="C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe" 
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" 
.... 
Hosts file was reset, If you use a custom hosts file please replace it... 
~~~~~ End report ~~~~~

Josef · Answer

é voici celui de hajickthis


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:56:02, on 10/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings	azebama.dl_
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.ma/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [UMService] C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{89E64E7E-2CE3-45D6-AB22-D78689752023}: NameServer = 192.168.50.55 196.12.209.6
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)

papyber · Answer

joseph
télécharge MalwareByte
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
Installe-le mets-le à jour

/ Télécharge : - Ccleaner
https://www.pcastuces.com/logitheque/ccleaner.htm
("Download Latest Version", sur la droite).
 Ce logiciel va permettre de supprimer tous les fichiers temporaires. Avant de cliquer sur le bouton "installer", décoche toutes les "options supplémentaires". Ensuite, Clique sur "Options", "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier Temp de Windows, plus vieux que 48 heures". Par la suite, laisse-le avec ses réglages par défaut. C'est tout.

1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur 

Redémarre en mode sans échec, copie ou imprime ce qui suit car tu n'auras pas accès à Internet 
 
/ lance Ccleaner , nettoyeur, et supprime tout ce qu'il trouve
Lance Ccleaner, erreurs, et répare ce qu’il trouve. Accepte les sauvegardes !

/ lance MalwareByte
Dans l'onglet Recherche, clique sur Exécuter un examen complet puis sur Rechercher.
Sélectionne ton (tes) disques durs.
Lancer l'examen, supprimer tout ce qu’il trouve
Clique sur Enregistrer le rapport et choisis ton Bureau

redémarre normalement
/ lance Hijack This et poste le rapport

poste les rapports demandés
MalwareByte
Hijack This

Josef · Answer

merci pour l'aide voici le rapport mawarebyte's

je n'é analysé ke le dichi" tazebama


Malwarebytes' Anti-Malware 1.12
Version de la base de données: 722

Type de recherche: Examen rapide
Eléments examinés: 1
Temps écoulé: 1 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 1

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
c:\documents and settings	azebama.dll (Worm.Mabezat) -> Unloaded module successfully.

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
c:\documents and settings	azebama.dll (Worm.Mabezat) -> Delete on reboot.

Josef · Answer

voici le rapport hickthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:21:43, on 10/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\D-Tools\daemon.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Hamachi\hamachi.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe
C:\program files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.co.ma/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe"  -lang 1033
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware Reboot] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [UMService] C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user')
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{89E64E7E-2CE3-45D6-AB22-D78689752023}: NameServer = 192.168.50.55 196.12.209.6
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing)

Josef · Answer

en attente de répons merci pour votre aide lé gars

é je sais pa pourkoi kan je fé une analyse a mon pc ça se plante au milieu é l'écran bleu m'apparait

j'en ai essayé plusieur antivirus kasersky(all version)+ mawarebyte's

papyber · Answer

Télécharge ComboFix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Tutoriel officiel de ComboFix, afin de l’utiliser correctement
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Désactive ton antivirus, antispyware, et Spybot-S&D (résident) durant l'utilisation de ComboFix. Merci. Tu le réactiveras ensuite, en fin de désinfection.
Voir ici comment désactiver tes protections
 https://forum.pcastuces.com/default.asp
Double clique sur ComboFix.exe (ComboFix)
Tape 1 puis tape sur Entrée 
A noter: une fois que ComboFix est lancé, il ne faut pas cliquer dans la fenêtre de ComboFix car cela pourrait entraîner un plantage du programme. 
Il est recommandé de laisser l'outil analyser et nettoyer le PC sans utiliser quoi que ce soit d'autre... 
A la fin de l’analyse, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse
Si le rapport n'apparaît pas, tu le trouves ici, à la racine de ton Système, en principe : C:\ComboFix.txt (C:\ComboFix)

Josef · Answer

merci
le rapport sera ds la prochaine participation
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
un nouveau rapport de hijackthis
++
Logfile of Trend Micro HijackThis v2.0.2 
Scan saved at 10:54:26, on 11/07/2008 
Platform: Windows XP SP2 (WinNT 5.01.2600) 
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) 
Boot mode: Normal 

Running processes: 
C:\WINDOWS\System32\smss.exe 
C:\WINDOWS\system32\winlogon.exe 
C:\WINDOWS\system32\services.exe 
C:\WINDOWS\system32\lsass.exe 
C:\WINDOWS\system32\svchost.exe 
C:\WINDOWS\System32\svchost.exe 
C:\WINDOWS\system32\spoolsv.exe 
C:\WINDOWS\Explorer.EXE 
C:\Program Files\D-Tools\daemon.exe 
C:\WINDOWS\SOUNDMAN.EXE 
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe 
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe 
C:\Program Files\MSN Messenger\MsnMsgr.Exe 
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe 
C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe 
C:\Documents and Settings	azebama.dl_ 
C:\WINDOWS\system32\ctfmon.exe 
C:\Program Files\Hamachi\hamachi.exe 
C:\WINDOWS\system32\wuauclt.exe 
C:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe 
C:\program files\internet explorer\iexplore.exe 
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe 

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens 
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) 
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file) 
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll 
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) 
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033 
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE 
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC 
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC 
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName 
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" -osboot 
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" 
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe -startup 
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start 
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background 
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" 
O4 - HKCU\..\Run: [UMService] C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe 
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe 
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-19\..\RunOnce: [nlsf] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL') 
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU') 
O4 - HKUS\S-1-5-18\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SYSTEM') 
O4 - HKUS\.DEFAULT\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'Default user') 
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe 
O17 - HKLM\System\CCS\Services\Tcpip\..\{89E64E7E-2CE3-45D6-AB22-D78689752023}: NameServer = 192.168.50.55 196.12.209.6 
O23 - Service: Ares Chatroom server (AresChatServer) - Unknown owner - C:\Program Files\Ares\chatServer.exe (file missing) 
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
é celui de malwarebytes'
++
Malwarebytes' Anti-Malware 1.20 
Version de la base de données: 938 
Windows 5.1.2600 Service Pack 2 

10:39:09 11/07/2008 
mbam-log-7-11-2008 (10-39-04).txt 

Type de recherche: Examen complet (C:\|D:\|) 
Eléments examinés: 90207 
Temps écoulé: 17 minute(s), 36 second(s) 

Processus mémoire infecté(s): 1 
Module(s) mémoire infecté(s): 1 
Clé(s) du Registre infectée(s): 0 
Valeur(s) du Registre infectée(s): 0 
Elément(s) de données du Registre infecté(s): 0 
Dossier(s) infecté(s): 0 
Fichier(s) infecté(s): 50 

Processus mémoire infecté(s): 
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken. 

Module(s) mémoire infecté(s): 
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken. 

Clé(s) du Registre infectée(s): 
(Aucun élément nuisible détecté) 

Valeur(s) du Registre infectée(s): 
(Aucun élément nuisible détecté) 

Elément(s) de données du Registre infecté(s): 
(Aucun élément nuisible détecté) 

Dossier(s) infecté(s): 
(Aucun élément nuisible détecté) 

Fichier(s) infecté(s): 
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0091349.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0091595.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0092595.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0093595.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094105.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094469.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0094561.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0095561.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0096561.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP24\A0097561.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0098561.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0098605.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0099605.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0100605.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP25\A0100606.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0101550.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0101606.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0102605.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0103605.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP26\A0104605.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104671.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104684.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104798.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP28\A0104858.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0105046.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0106027.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0107027.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0108039.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0109039.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0110078.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0112076.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0112220.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0113220.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0113221.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0114220.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0114221.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0115220.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP29\A0116218.dll (Worm.Mabezat) -> No action taken. 
C:\System Volume Information\_restore{A671FC8A-B8C5-416F-B2C2-03E691B227C4}\RP31\A0116376.dll (Worm.Mabezat) -> No action taken. 
D:\System Volume Information\_restore{5E499CF6-CD1B-406A-BD12-919DA656CFE1}\RP11\A0001044.exe (Trojan.Agent) -> No action taken. 
D:\System Volume Information\_restore{5E499CF6-CD1B-406A-BD12-919DA656CFE1}\RP11\A0001059.exe (Spyware.OnlineGames) -> No action taken. 
D:\System Volume Information\_restore{73B84BEC-9DAE-4C0B-A744-4F6A6484A435}\RP9\A0010300.exe (Trojan.Agent) -> No action taken. 
D:\System Volume Information\_restore{73B84BEC-9DAE-4C0B-A744-4F6A6484A435}\RP9\A0010400.exe (Spyware.OnlineGames) -> No action taken. 
D:\UTILITAIRES\Nero-6.6.0.8a\keygen\keygen.exe (Trojan.Agent) -> No action taken. 
D:\UTILITAIRES\WMPlayer 11\Windows_Media_11_Patch\Patch.exe (Spyware.OnlineGames) -> No action taken. 
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken. 
C:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> No action taken. 
C:\zPharaoh.exe (Worm.Mabezat) -> No action taken. 
C:\Documents and Settings\Youssef\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.

papyber · Answer

je lis "no action taken"
as tu bien tout supprimé?

Josef · Answer

ca ne se suprrime pa é il me demande de redémarré le pc pour le faire au démmarage mais tous va au quarantaine 
é jé tt supprimé du quarantaine

papyber · Answer

continue avec combofix alors

Josef · Answer

ok jvé faire merci pour l'aide

Josef · Answer

ComboFix 08-07-10.1 - Youssef 2008-07-11 16:35:21.2 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.758 [GMT 0:00] Endroit: C:\Documents and Settings\Youssef\Bureau\ComboFix.exe [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf C:\Documents and Settings\hook.dl_ C:\Documents and Settings azebama.dl_ C:\Documents and Settings azebama.dll C:\Documents and Settings\Youssef\Application Data azebama C:\Documents and Settings\Youssef\Application Data azebama azebama.log C:\Documents and Settings\Youssef\Application Data azebama\zPharaoh.dat C:\zPharaoh.exe D:\Autorun.inf D:\RECYCLER\Lock Folder.exe D:\RECYCLER\RECYCLER .exe . ---- Previous Run ------- . C:\autorun.inf C:\Documents and Settings\hook.dl_ C:\Documents and Settings azebama.dl_ C:\Documents and Settings azebama.dll C:\Documents and Settings\Youssef\Application Data azebama C:\Documents and Settings\Youssef\Application Data azebama azebama.log C:\Documents and Settings\Youssef\Application Data azebama\zPharaoh.dat C:\zPharaoh.exe ----- File Replicators ----- C:\WINDOWS\$hf_mig$\KB911280\update\update.exe C:\WINDOWS\$hf_mig$\KB914388\update\update.exe C:\WINDOWS\$hf_mig$\KB914389\update\update.exe C:\WINDOWS\$hf_mig$\KB916595\update\update.exe C:\WINDOWS\$hf_mig$\KB918118\update\update.exe C:\WINDOWS\$hf_mig$\KB918439\update\update.exe C:\WINDOWS\$hf_mig$\KB920213\update\update.exe C:\WINDOWS\$hf_mig$\KB920670\update\update.exe C:\WINDOWS\$hf_mig$\KB920683\update\update.exe C:\WINDOWS\$hf_mig$\KB920685\update\update.exe C:\WINDOWS\$hf_mig$\KB920872\update\update.exe C:\WINDOWS\$hf_mig$\KB922582\update\update.exe C:\WINDOWS\$hf_mig$\KB922819\update\update.exe C:\WINDOWS\$hf_mig$\KB923414\update\update.exe C:\WINDOWS\$hf_mig$\KB923980\update\update.exe C:\WINDOWS\$hf_mig$\KB924270\update\update.exe C:\WINDOWS\$hf_mig$\KB924496\update\update.exe C:\WINDOWS\$hf_mig$\KB925902\update\update.exe C:\WINDOWS\$hf_mig$\KB926255\update\update.exe C:\WINDOWS\$hf_mig$\KB926436\update\update.exe C:\WINDOWS\$hf_mig$\KB927779\update\update.exe C:\WINDOWS\$hf_mig$\KB927802\update\update.exe C:\WINDOWS\$hf_mig$\KB927891\update\update.exe C:\WINDOWS\$hf_mig$\KB928255\update\update.exe C:\WINDOWS\$hf_mig$\KB928843\update\update.exe C:\WINDOWS\$hf_mig$\KB929123\update\update.exe C:\WINDOWS\$hf_mig$\KB930178\update\update.exe C:\WINDOWS\$hf_mig$\KB930916\update\update.exe C:\WINDOWS\$hf_mig$\KB931261\update\update.exe C:\WINDOWS\$hf_mig$\KB931784\update\update.exe C:\WINDOWS\$hf_mig$\KB932168\update\update.exe C:\WINDOWS\$hf_mig$\KB933729\update\update.exe C:\WINDOWS\$hf_mig$\KB935839\update\update.exe C:\WINDOWS\$hf_mig$\KB935840\update\update.exe C:\WINDOWS\$hf_mig$\KB936021\update\update.exe C:\WINDOWS\$hf_mig$\KB936357\update\update.exe C:\WINDOWS\$hf_mig$\KB937894\update\update.exe C:\WINDOWS\$hf_mig$\KB938127\update\update.exe C:\WINDOWS\$hf_mig$\KB938828\update\update.exe C:\WINDOWS\$hf_mig$\KB941202\update\update.exe C:\WINDOWS\$hf_mig$\KB941644\update\update.exe C:\WINDOWS\$hf_mig$\KB941693\update\update.exe C:\WINDOWS\$hf_mig$\KB943055\update\update.exe C:\WINDOWS\$hf_mig$\KB943460\update\update.exe C:\WINDOWS\$hf_mig$\KB943485\update\update.exe C:\WINDOWS\$hf_mig$\KB944338\update\update.exe C:\WINDOWS\$hf_mig$\KB944653\update\update.exe C:\WINDOWS\$hf_mig$\KB945553\update\update.exe C:\WINDOWS\$hf_mig$\KB946026\update\update.exe C:\WINDOWS\$hf_mig$\KB948590\update\update.exe C:\WINDOWS\$hf_mig$\KB950749\update\update.exe . . ((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-06-11 to 2008-07-11 )))))))))))))))))))))))))))))))))))) . 2008-07-11 16:43 . 2008-07-11 16:44 d-------- C:\Documents and Settings\Youssef\Application Data azebama 2008-07-11 16:43 . 2008-07-11 16:44 155,151 -r-hs---- C:\zPharaoh.exe 2008-07-11 11:59 . 2004-08-09 05:04 73,728 --a------ C:\WINDOWS\system32\ISUSPM.cpl 2008-07-11 11:59 . 2007-08-28 15:17 21,632 --a------ C:\WINDOWS\system32\drivers\lgevdomodem.sys 2008-07-11 11:59 . 2007-08-28 15:17 19,840 --a------ C:\WINDOWS\system32\drivers\lgevdodiag.sys 2008-07-11 11:59 . 2007-08-28 15:17 19,840 --a------ C:\WINDOWS\system32\drivers\lgevdoatc.sys 2008-07-11 11:59 . 2007-08-28 15:17 12,800 --a------ C:\WINDOWS\system32\drivers\lgevdobus.sys 2008-07-11 11:44 . 2008-07-11 11:44 d-------- C:\Program Files\Sunbelt Software 2008-07-11 11:44 . 2008-06-21 04:54 269,736 -ra------ C:\WINDOWS\system32\drivers\SbFw.sys 2008-07-11 11:44 . 2008-06-21 04:54 65,576 --a------ C:\WINDOWS\system32\drivers\SbFwIm.sys 2008-07-11 10:43 . 2008-07-11 16:44 154,751 --a------ C:\Documents and Settings\hook.dl_ 2008-07-11 10:09 . 2008-07-11 16:44 154,751 --a------ C:\Documents and Settings azebama.dl_ 2008-07-10 19:24 . 2008-07-11 16:44 32,768 --a------ C:\Documents and Settings azebama.dll 2008-07-10 17:03 . 2008-07-10 17:03 d-------- C:\SDFix 2008-07-10 16:55 . 2008-07-10 16:55 d-------- C:\Program Files\Trend Micro 2008-07-10 16:40 . 2008-07-10 19:34 d-------- C:\fixwareout 2008-07-10 16:17 . 2008-07-11 09:32 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-10 16:17 . 2008-07-10 16:17 d-------- C:\Documents and Settings\Youssef\Application Data\Malwarebytes 2008-07-10 16:17 . 2008-07-10 16:17 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-10 16:17 . 2008-07-07 17:35 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys 2008-07-10 16:17 . 2008-07-07 17:35 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-07-09 18:20 . 2008-07-09 18:20 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files 2008-07-08 23:46 . 2008-07-11 16:44 126 -r-hs---- C:\autorun.inf 2008-07-07 16:10 . 2008-07-07 16:10 d-------- C:\Documents and Settings\Youssef\Application Data eamspeak2 2008-07-07 16:10 . 2008-07-07 16:10 34,064 --a------ C:\WINDOWS\system32\lhacm.acm 2008-07-04 16:47 . 2008-07-04 16:47 d-------- C:\Program Files\Fichiers communs\Adobe AIR 2008-07-04 16:47 . 2008-07-04 16:47 d-------- C:\Program Files\Fichiers communs\Adobe 2008-07-01 19:42 . 2008-07-01 19:47 d-------- C:\Yu-Gi-Oh 2008-06-28 21:05 . 2008-07-09 18:24 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-28 19:48 . 2003-09-05 00:17 917,504 --a------ C:\WINDOWS\system32\Flash.ocx 2008-06-28 19:48 . 2004-02-05 14:53 389,120 --a------ C:\WINDOWS\system32\actskn43.ocx 2008-06-28 19:48 . 2004-01-09 04:54 188,416 --a------ C:\WINDOWS\system32\actsplash.ocx 2008-06-28 19:48 . 2000-07-14 23:00 101,888 --a------ C:\WINDOWS\system32\VB6STKIT.DLL 2008-06-26 10:28 . 2008-07-11 10:18 d-------- C:\Program Files\Microsoft Games 2008-06-25 10:44 . 2008-06-25 10:44 d-------- C:\Program Files\Hamachi 2008-06-25 10:44 . 2008-07-11 16:22 d-------- C:\Documents and Settings\Youssef\Application Data\Hamachi 2008-06-25 10:44 . 2008-06-25 10:44 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys 2008-06-23 22:52 . 2008-06-23 22:52 d-------- C:\Program Files\CCleaner 2008-06-22 10:48 . 2008-06-22 10:48 d-------- C:\Documents and Settings\Youssef\Application Data\AdobeUM 2008-06-21 04:54 . 2008-06-21 04:54 66,600 -ra------ C:\WINDOWS\system32\drivers\sbhips.sys 2008-06-15 08:47 . 2007-03-17 13:44 293,376 -----c--- C:\WINDOWS\system32\dllcache\winsrv.dll 2008-06-15 08:42 . 2007-03-08 15:37 578,560 -----c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-06-15 08:41 . 2007-05-16 15:13 1,314,816 -----c--- C:\WINDOWS\system32\dllcache\msoe.dll 2008-06-15 08:41 . 2007-05-16 15:13 510,976 -----c--- C:\WINDOWS\system32\dllcache\wab32.dll 2008-06-15 08:41 . 2007-05-16 15:13 85,504 -----c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2008-06-15 08:41 . 2006-07-21 08:27 72,704 -----c--- C:\WINDOWS\system32\dllcache\hlink.dll 2008-06-15 08:40 . 2006-05-05 09:41 453,120 -----c--- C:\WINDOWS\system32\dllcache\mrxsmb.sys 2008-06-15 08:40 . 2006-05-05 09:47 174,592 -----c--- C:\WINDOWS\system32\dllcache dbss.sys 2008-06-15 08:38 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-06-14 14:25 . 2007-08-21 06:17 683,520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2008-06-14 14:24 . 2008-02-20 06:51 282,624 -----c--- C:\WINDOWS\system32\dllcache\gdi32.dll 2008-06-14 14:20 . 2007-10-25 16:56 8,510,976 -----c--- C:\WINDOWS\system32\dllcache\shell32.dll 2008-06-14 14:20 . 2007-01-23 19:31 546,304 -----c--- C:\WINDOWS\system32\dllcache\hhctrl.ocx 2008-06-14 14:13 . 2006-08-14 10:34 332,928 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-06-14 14:11 . 2007-02-28 16:02 2,182,400 -----c--- C:\WINDOWS\system32\dllcache toskrnl.exe 2008-06-14 14:11 . 2007-02-28 16:02 2,138,112 -----c--- C:\WINDOWS\system32\dllcache tkrnlmp.exe 2008-06-14 14:11 . 2007-02-28 16:02 2,059,648 -----c--- C:\WINDOWS\system32\dllcache tkrnlpa.exe 2008-06-14 14:11 . 2007-02-28 16:02 2,017,792 -----c--- C:\WINDOWS\system32\dllcache tkrpamp.exe 2008-06-14 14:07 . 2006-10-13 12:36 65,536 -----c--- C:\WINDOWS\system32\dllcache wwks.dll 2008-06-14 14:05 . 2006-08-17 12:29 332,288 -----c--- C:\WINDOWS\system32\dllcache etapi32.dll 2008-06-14 14:02 . 2008-06-20 10:45 360,320 --a--c--- C:\WINDOWS\system32\dllcache cpip.sys 2008-06-14 14:01 . 2007-04-23 10:32 364,160 -----c--- C:\WINDOWS\system32\dllcache\update.sys 2008-06-14 14:00 . 2008-03-20 08:09 1,845,376 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-06-14 13:58 . 2006-06-01 18:48 163,840 -----c--- C:\WINDOWS\system32\dllcache\jgdw400.dll 2008-06-14 13:58 . 2006-06-01 18:48 27,648 -----c--- C:\WINDOWS\system32\dllcache\jgpl400.dll 2008-06-14 13:54 . 2008-07-09 14:16 d--h----- C:\WINDOWS\$hf_mig$ 2008-06-14 13:53 . 2006-12-07 05:29 2,374,472 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll 2008-06-14 13:46 . 2007-03-09 13:48 57,344 --a--c--- C:\WINDOWS\system32\dllcache\agentdpv.dll 2008-06-14 13:45 . 2007-11-07 09:28 728,576 -----c--- C:\WINDOWS\system32\dllcache\lsasrv.dll 2008-06-14 13:43 . 2008-03-25 04:50 838,432 -----c--- C:\WINDOWS\system32\dllcache\mswdat10.dll 2008-06-14 13:43 . 2008-03-25 04:51 621,344 -----c--- C:\WINDOWS\system32\dllcache\mswstr10.dll 2008-06-14 13:43 . 2008-06-14 17:59 272,768 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-06-14 13:43 . 2008-06-14 17:59 272,768 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-14 12:50 . 2007-07-09 13:11 584,192 -----c--- C:\WINDOWS\system32\dllcache pcrt4.dll 2008-06-14 12:46 . 2008-06-14 12:46 d-------- C:\Documents and Settings\Youssef\Application Data\Talkback 2008-06-14 12:45 . 2008-06-14 12:45 0 --a------ C:\WINDOWS sreg.dat 2008-06-13 19:16 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-06-13 19:16 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-06-13 19:16 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-06-13 19:16 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-06-13 17:08 . 2008-06-13 17:08 d-------- C:\Documents and Settings\Youssef\Application Data\vlc 2008-06-13 11:22 . 2008-06-13 11:22 d-------- C:\Documents and Settings\Youssef\Application Data\Apple Computer 2008-06-13 11:21 . 2008-06-13 11:21 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-06-13 11:09 . 2008-06-13 11:09 d-------- C:\Program Files\Real 2008-06-13 11:09 . 2008-06-13 11:09 d-------- C:\Program Files\Fichiers communs\xing shared 2008-06-13 11:09 . 2008-06-13 11:09 d-------- C:\Program Files\Fichiers communs\Real 2008-06-13 11:09 . 2008-06-13 11:09 25 --a------ C:\WINDOWS\cdplayer.ini 2008-06-11 12:47 . 2008-07-10 10:59 d-------- C:\Documents and Settings\Youssef\Application Data\IDM 2008-06-11 12:47 . 2008-07-10 10:56 d-------- C:\Documents and Settings\Youssef\Application Data\DMCache 2008-06-11 12:26 . 2008-06-11 12:26 d---s---- C:\Documents and Settings\Youssef\UserData . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-11 16:43 925,039 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\helpctr.exe 2008-07-11 11:59 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-11 11:59 --------- d-----w C:\Program Files\LG Electronics 2008-07-10 15:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-07-09 17:10 557,423 ----a-w C:\WINDOWS\system32\cmd.exe 2008-07-09 17:10 373,103 ----a-w C:\WINDOWS\system32\osk.exe 2008-07-09 17:10 300,911 ----a-w C:\WINDOWS\system32\mobsync.exe 2008-07-09 17:10 237,423 ----a-w C:\WINDOWS\system32\charmap.exe 2008-07-09 17:10 229,743 ----a-w C:\WINDOWS\system32\magnify.exe 2008-07-09 17:10 227,183 ----a-w C:\WINDOWS\system32 otepad.exe 2008-07-09 17:10 189,295 ----a-w C:\WINDOWS\system32\odbcad32.exe 2008-07-08 23:46 329,071 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe 2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers cpip.sys 2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers cpip6.sys 2008-06-09 20:56 --------- d-----w C:\Program Files\Fichiers communs\InstallShield 2008-06-09 20:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\InstallShield 2008-06-04 17:38 --------- d-----w C:\Documents and Settings\Youssef\Application Data\U3 2008-06-02 19:15 --------- d-----w C:\Program Files\Fichiers communs\DirectX 2008-06-01 17:45 --------- d-----w C:\Program Files\MSN Messenger 2008-06-01 12:41 --------- d-----w C:\Program Files\Realtek AC97 2008-06-01 12:41 --------- d-----w C:\Program Files\AvRack 2008-06-01 12:40 --------- d-----w C:\Program Files\DivX 2008-06-01 12:40 --------- d-----w C:\Program Files\D-Tools 2008-06-01 12:39 --------- d-----w C:\Program Files\Realtek Sound Manager 2008-06-01 12:34 --------- d-----w C:\Program Files\Nero 2008-06-01 12:34 --------- d-----w C:\Program Files\Fichiers communs\Ahead 2008-06-01 07:49 --------- d-----w C:\Program Files\microsoft frontpage 2008-06-01 07:48 --------- d-----w C:\Program Files\Services en ligne 2008-05-07 05:15 1,293,824 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-21 07:02 663,552 ----a-w C:\WINDOWS\system32\wininet.dll . [code]

----a-w           155,001 2008-07-11 16:39:04  C:\QooBox\Qoobox                                                                                               .exe

[/code] ------- Sigcheck ------- 2006-03-09 08:25 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2006-01-24 20:24 7094272] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe" [2005-11-24 20:38 94208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09 15360] "UMService"="C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe" [2007-09-04 21:22 20992] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" [2006-03-09 09:50 208952] "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 21:31 59392] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 21:32 455168] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 21:32 455168] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB ealsched.exe" [2008-06-13 11:09 180269] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672] "ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\isuspm.exe" [2008-07-11 12:03 377711] "ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-08-09 05:03 81920] "SoundMan"="SOUNDMAN.EXE" [2005-09-22 16:42 90112 C:\WINDOWS\soundman.exe] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoDesktopCleanupWizard"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) "NoStrCmpLogical"= 0 (0x0) "NoInstrumentation"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "MemCheckBoxInRunDlg"= 1 (0x1) "NoSMBalloonTip"= 1 (0x1) "NoDesktopCleanupWizard"= 1 (0x1) "NoWelcomeScreen"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "DisablePagingExecutive"=dword:00000001 "SecondLevelDataCache"=dword:00000200 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe"= "C:\Program Files\MSN Messenger\msnmsgr.exe"= R1 SbFw;SbFw;C:\WINDOWS\system32\drivers\SbFw.sys [2008-06-21 04:54] R1 sbhips;Sunbelt HIPS Driver;C:\WINDOWS\system32\drivers\sbhips.sys [2008-06-21 04:54] R2 SbPF.Launcher;SbPF.Launcher;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFLnch.exe [2008-07-11 11:47] R3 SBFWIMCL;Sunbelt Software Firewall NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\sbfwim.sys [2008-06-21 04:54] R3 UsbEvdoAtc;LGE EVDO USB Serial Port;C:\WINDOWS\system32\DRIVERS\lgevdoatc.sys [2007-08-28 15:17] R3 usbevdobus;LGE EVDO Composite USB Device;C:\WINDOWS\system32\DRIVERS\lgevdobus.sys [2007-08-28 15:17] R3 UsbEvdoDiag;LGE EVDO USB Serial DM Port;C:\WINDOWS\system32\DRIVERS\lgevdodiag.sys [2007-08-28 15:17] R3 USBEVDOModem;LGE EVDO USB Modem;C:\WINDOWS\system32\DRIVERS\lgevdomodem.sys [2007-08-28 15:17] S2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\SbPFSvc.exe [2008-07-01 10:51] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3efdfa59-4a8f-11dd-a143-8ef5f7b56a5f}] \Shell\explore\command - G:\zPharaoh.exe \Shell\open\command - G:\zPharaoh.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6c02ce6-3234-11dd-a09a-91cec2c61983}] \Shell\AutoRun\command - G:\LaunchU3.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b6c02ce7-3234-11dd-a09a-91cec2c61983}] \Shell\AutoRun\command - RavMon.exe . - - - - ORPHANS REMOVED - - - - Notify-WgaLogon - (no file) ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-07-11 16:44:26 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cach‚s ... C:\Documents and Settings azebama.dl_ [1300] 0x857655C0 Balayage cach‚ autostart entries ... Balayage des fichiers cach‚s ... C:\ComboFix emp00 Scan termin‚ avec succŠs Les fichiers cach‚s: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Qoobox\Quarantine\C\Documents and Settings azebama.dl_.vir C:\PROGRA~1\SUNBEL~1\PERSON~1\SbPFLnch.exe . ************************************************************************** . ComboFix-quarantined-files.txt 2008-07-11 16:46:26 Pre-Run: 31,131,631,616 octets libres Post-Run: 31,119,175,680 octets libres 305 --- E O F --- 2008-07-11 10:59:04

papyber · Answer

vu!! il y a aussi ravmon, c'est une infection qui se propage par les périphériques externes, donc si tu désinfectes ton Pc mais pas tes périphériques - clé USB, DD externe, tout périphérique qui se connecte sur ton PC, etc... cela se relance.. Tu vas faire ceci dans un 1er temps Si tu as une clé USB, disque dur externe, etc., branche-les sans les ouvrir avant de lancer ce FIX Télécharge Rav Antivirus: http://ww25.evosla.com/compteur.php?soft=rav_antivirus · Clique droit sur le fichier .ZIP > Extraire sur > le Bureau · Double clique sur >> RAV.exe << afin de lancer l'outil. · Une fois RAV ANTIVIRUS lancé, laisse-le réagir, il Scanne automatiquement tous les lecteurs (disques fixes et amovibles) · Si infection > un rapport s'établira, sinon s'affichera (très rapide) ==>Votre Ordinateur est sain. · Retire tes disques amovibles et redémarre ton ordinateur. Poste le rapport, si infection! ensuite tu passes à nouveau combofix et tu postes le rapport obtneu

Josef · Answer

le scan é tjrs la il suprrime lé virus mais tazebama reste mé c pa encore fini ça fait une demi heure ke jlé lancé

Josef · Answer

ça fait une heure é tazebama n'é pa encore supprimé é l'analyse ne fé rien

donc jé kitté l'analyse // svt si il ya une silution mon pC é devnu plus fous ke moi

papyber · Answer

si c'est l'outil d'evosla, il doit avoir terminé, son scan ne dure que quelques minutes
passe cet outil là alors, toujours avec tes périphériques externes branchés
Téléchargez ce tool de sUBs : http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe 
 Double-cliquez dessus et laissez-vous guider.

Josef · Answer

merci pour l'aide jé formaté la partitition C:/ é le virus é tjr présent dans D:/ 

donc je vé te filé lé nouveau rapport é merci pour ton aide précieuse

papyber · Answer

je t'ai expliqué plus haut que se virus se propage avec tes périphériques externes cles usb, dd externes, appareils photo numériques, ils sont infectés et dès que tu les branches ils relancent l'infection.
surtout passe flash desinfector il devrait déjà pas mal nettoyer et poste le rapport combofix tous périphériques branchés ensuite avec un rapport hijack this

Josef · Answer

mé jé aucun péréférique éxterne

Josef · Answer

merde le virus é tjrs la ça veut pas ce supprimé j'é tt utilisé

Josef · Answer

Malwarebytes' Anti-Malware 1.20
Version de la base de données: 944
Windows 5.1.2600 Service Pack 2

14:37:23 13/07/2008
mbam-log-7-13-2008 (14-37-23).txt

Type de recherche: Examen complet (C:\|D:\|)
Eléments examinés: 41155
Temps écoulé: 2 minute(s), 21 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 6

Processus mémoire infecté(s):
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> Unloaded process successfully.

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{23323B8F-C986-4205-A9B1-E9A3A7E3FB30}\RP2\A0000300.dll (Worm.Mabezat) -> Quarantined and deleted successfully.
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> Quarantined and deleted successfully.
C:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> Quarantined and deleted successfully.
C:\zPharaoh.exe (Worm.Mabezat) -> Quarantined and deleted successfully.
C:\Documents and Settings\SNAP\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> Quarantined and deleted successfully.

Josef · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:38:59, on 13/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
C:\Program Files\LG Electronics\Modem USB LG Electronics\IEUM.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.inwi.ma/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.inwi.ma/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UMService] C:\Program Files\LG Electronics\Modem USB LG Electronics\UMAService.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3158E956-334D-435D-B1A0-A04FE956C8C8}: NameServer = 192.168.50.55 196.12.209.6

papyber · Answer

je ne vois pas d'antivirus???
si tu n'en as pas télécharge antivir
https://www.pcastuces.com/logitheque/antivir.htm
 et scanne ton Pc avec en mode sans échec 
scanne avec ComboFix en mode sans échec 
puis poste les rapports obtenus

Comment aller en Mode sans échec
1) Redémarre ton ordi 
2) Tapote la touche F8 immédiatement, (F5 sur certains PC) juste après le "Bip" 
3) Tu verras un écran avec options de démarrage apparaître 
4) Choisis la première option : Sans Échec, et valide avec "Entrée" 
5) Choisis ton compte habituel, et non Administrateur

Josef · Answer

si je formate le Pc tte lé partitition ça ira mieux ou nn 
packe le virus tazebama mabezat ne se supprime pa

papyber · Answer

à toi de voir...parfois c'est la seule solution

NK2 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:19:49, on 10/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ATKKBService.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Eset
od32krn.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\ASUS WiFi-AP Solo\AWWFSPU.exe
C:\Program Files\Eset
od32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AWWFSPU] "C:\Program Files\ASUS WiFi-AP Solo\AWWFSPU.exe" -nogui
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset
od32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{5A44D322-E576-451C-A1D3-E067330BFA0B}: NameServer = 212.217.1.17 212.217.0.3
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - C:\Program Files\Eset
od32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

papyber · Answer

télécharge GenProc de Lazzzy et Narco4 sur ton Bureau
 http://www.alt-shift-return.org/Info/Fichiers/GenProc.zip 

dé zippe le dossier, double-clique sur GenProc.bat et poste le contenu du rapport qui s'ouvre

Aide en images : http://www.alt-shift-return.org/Info/GenProc-HowTo.html

neptune · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:10:11, on 12/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\csrss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\system32\RunDll32.exe
F:\Program Files\SlySoft\CloneCD\CloneCDTray.exe
F:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
F:\WINDOWS\713xRMT.exe
F:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
F:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
F:\Program Files\Winamp\winampa.exe
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\HHVcdV7Sys\VC7Play.exe
F:\Program Files\USB Disk Security\USBGuard.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\SuperCopier2\SuperCopier2.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
F:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
F:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
F:\Program Files\WIDCOMM\Logiciel Bluetooth\BTTray.exe
F:\Program Files\honestech\honestech TVR\scheduleTV.exe
F:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
F:\Program Files\Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter\WLANUTL.exe
F:\WINDOWS\system32\IcoSauve.exe
F:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
F:\Program Files\HHVcdV7Sys\VC7SecS.exe
F:\PROGRA~1\WIDCOMM\LOGICI~1\BTSTAC~1.EXE
F:\WINDOWS\System32\alg.exe
F:\Program Files\SlySoft\CloneCD\CloneCD.exe
F:\Program Files\Mozilla Firefox\firefox.exe
F:\Documents and Settings	azebama.dl_
F:\WINDOWS\Explorer.exe
F:\Program Files\Nero\Nero Core
ero.exe
F:\Documents and Settings
eptune\Bureau\HiJackThis.exe
F:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.fr/toolbar/ie8/sidebar.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.fr/search?q=%s
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: Shell=Explorer.exe 
F2 - REG:system.ini: UserInit=userinit.exe 
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - F:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [CloneCDTray] "F:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [VirtualCloneDrive] "F:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
O4 - HKLM\..\Run: [PCI TV Card Remote Control Applet] F:\WINDOWS\713xRMT.exe
O4 - HKLM\..\Run: [HP Software Update] "F:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] F:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
O4 - HKLM\..\Run: [DeviceDiscovery] F:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
O4 - HKLM\..\Run: [WinampAgent] F:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] F:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [UVS11 Preload] F:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [VC7Player] F:\Program Files\HHVcdV7Sys\VC7Play.exe
O4 - HKLM\..\Run: [PCSuiteTrayApplication] F:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [USB Antivirus] F:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [chiCkie] F:\WINDOWS\inf\chiCkie.exe
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SuperCopier2.exe] F:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKCU\..\Run: [PcSync] F:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - HKCU\..\Run: [amva] F:\WINDOWS\system32\amvo.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide2] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,L,,4,N (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide1] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICE RÉSEAU')
O4 - Startup: IcoSauve.lnk = F:\WINDOWS\system32\IcoSauve.exe
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: ScheduleTV.lnk = F:\Program Files\honestech\honestech TVR\scheduleTV.exe
O4 - Global Startup: Utilitaire réseau pour SAGEM Wi-Fi 11g USB adapter.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - F:\Program Files\AVG\AVG8\avgpp.dll (file missing)
O23 - Service: BlueSoleil Hid Service - Unknown owner - F:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - F:\Program Files\WIDCOMM\Logiciel Bluetooth\bin\btwdins.exe
O23 - Service: Capture Device Service - InterVideo Inc. - F:\Program Files\Fichiers communs\InterVideo\DeviceService\DevSvc.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - F:\Program Files\Fichiers communs\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Fichiers communs\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: Virtual CD v7 Management Service (VC7SecS) - H+H Software GmbH - F:\Program Files\HHVcdV7Sys\VC7SecS.exe

papyber · Answer

Télécharge ComboFix.exe (par sUBs) sur ton Bureau
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Tutoriel officiel de ComboFix, afin de l’utiliser correctement
https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix
Désactive ton antivirus, antispyware, et Spybot-S&D (résident) durant l'utilisation de ComboFix. Merci. Tu le réactiveras ensuite, en fin de désinfection.
Voir ici comment désactiver tes protections
 https://forum.pcastuces.com/default.asp
Double clique sur ComboFix.exe (ComboFix)
Tape 1 puis tape sur Entrée 
A noter: une fois que ComboFix est lancé, il ne faut pas cliquer dans la fenêtre de ComboFix car cela pourrait entraîner un plantage du programme. 
Il est recommandé de laisser l'outil analyser et nettoyer le PC sans utiliser quoi que ce soit d'autre... 
A la fin de l’analyse, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse
Si le rapport n'apparaît pas, tu le trouves ici, à la racine de ton Système, en principe : C:\ComboFix.txt (C:\ComboFix)

osm2 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:55:08, on 26/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32	askswitch.exe
C:\Program Files\Ares\Ares.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32	askswitch.exe
O4 - HKLM\..\Run: [RegRun WinBait] C:\WINDOWS\winbait.exe
O4 - HKLM\..\Run: [@RegRunOnSecure] C:\PROGRA~1\Greatis\REGRUN~1\OnSecure.exe
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [Regrun2] C:\PROGRA~1\Greatis\REGRUN~1\WatchDog.exe
O4 - HKCU\..\Run: [Registry] "C:\Program Files\Greatis\RegRunSuite\lsoon.exe" -1 30 "C:\Program Files\Greatis\RegRunSuiteescue.exe" /a "c:\backregstore.ini"
O4 - Global Startup: DSLMON.lnk = ?
O14 - IERESET.INF: START_PAGE_URL=http://www.google.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{0AF8258C-20E9-4BBB-948C-F091B60B98C1}: NameServer = 196.217.246.210 212.217.0.13
O17 - HKLM\System\CS1\Services\Tcpip\..\{0AF8258C-20E9-4BBB-948C-F091B60B98C1}: NameServer = 196.217.246.210 212.217.0.13
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

osm2 · Answer

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1087
Windows 5.1.2600 Service Pack 2

13:28:01 26/08/2008
mbam-log-08-26-2008 (13-27-48).txt

Type de recherche: Examen rapide
Eléments examinés: 38429
Temps écoulé: 12 minute(s), 39 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 2
Clé(s) du Registre infectée(s): 2
Valeur(s) du Registre infectée(s): 5
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 10

Processus mémoire infecté(s):
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.

Module(s) mémoire infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.
C:\WINDOWS\Temp\IcnOvrly.dll (Trojan.FakeAlert) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\CLSID\{ea3775f2-28be-11d3-9c8d-00105a24ed29} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{ea3775f2-28be-11d3-9c8d-00105a24ed29} (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.
C:\WINDOWS\Temp\IcnOvrly.dll (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\FACEBACK1001186.del (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\drivers\NNRRNVZR.SYS.del (Rootkit.Agent) -> No action taken.
C:\WINDOWS\system32\drivers\NUQQOVTR.SYS.del (Rootkit.Agent) -> No action taken.
C:\Documents and Settings\mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm;mmmmmmmmmmmmmmmmmmmmmmmmmmmmm;mmmmmmmmmmmmmmmmmmmmmmmmmmmmmm (Worm.Mabezat) -> No action taken.
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\Administrateur\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
C:\zPharaoh.exe (Worm.Mabezat) -> No action taken.

HaytheM · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:27:50, on 05/09/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.crawler.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=60220
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.crawler.com/search/ie.aspx?tb_id=60220
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://dnl.crawler.com/support/sa_customize.aspx?TbId=60220
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie	bsecu.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Web Accelerator Helper - {69A87B7D-DE56-4136-9655-716BA50C19C7} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie	bsecu.dll (file missing)
O3 - Toolbar: Google Web Accelerator - {DB87BFA2-A2E3-451E-8E5A-C89982D87CBF} - C:\Program Files\Google\Web Accelerator\GoogleWebAccToolbar.dll
O3 - Toolbar: securedie Toolbar - {cd36797a-70f3-4acd-8825-623d3b896881} - C:\Program Files\securedie	bsecu.dll (file missing)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [poke mp3 cdrom meta] C:\Documents and Settings\All Users.WINDOWS\Application Data\Jump Poll Poke Mp3\View Idol.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [filmchin] C:\DOCUME~1\MAHBOOLR.R\APPLIC~1\ANTEBI~1\file army plan.exe
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nLite] %systemroot%\inf
lite.cmd (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'Default user')
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Global Startup: Run Google Web Accelerator.lnk = C:\Program Files\Google\Web Accelerator\GoogleWebAccWarden.exe
O4 - Global Startup: SATARAID5.lnk = C:\Program Files\Silicon Image\3114 SATARAID5\sam.jar
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/...
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe

papyber · Answer

sujet clos
créer un topic en cliquant sur "nouvelle discussion"

hic · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:23:29, on 8/01/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\Ati2evxx.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
D:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
D:\Program Files\Windows Defender\MSASCui.exe
D:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
D:\Program Files\Java\jre6\bin\jusched.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\WINDOWS\system32\helper.exe
D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
D:\Documents and Settings\hic\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\HPQ\Shared\hpqwmi.exe
C:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\Fichiers communs\Real\Update_OB\RealOneMessageCenter.exe
D:\Program Files\Internet Explorer\iexplore.exe
D:\Program Files\CCleaner\CCleaner.exe
D:\Documents and Settings	azebama.dl_
D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
D:\WINDOWS\system32\wuauclt.exe
D:\Program Files\Real\RealPlayer\RecordingManager.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - D:\Program Files\Real\RealPlayerpbrowserrecordplugin.dll
O2 - BHO: EoBho - {64F56FC1-1272-44CD-BA6E-39723696E350} - D:\Program Files\EoRezo\EoAdv\EoRezoBHO.dll (file missing)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - d:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - D:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - D:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - d:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Barre d'outils - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - D:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] D:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ATIPTA] "D:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [Cpqset] D:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] D:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [TkBellExe] "D:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "D:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "D:\Program Files\Logitech\QuickCam10\QuickCam10.exe" /hide
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SVCHOST] D:\WINDOWS\MDM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Program Files\Java\jre6\bin\jusched.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] D:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Windows] D:\WINDOWS\system32\helper.exe
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\hic\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [RemoveIT Pro v7Ent] D:\Program Files\InCode Solutions\RemoveIT Pro v7 Enterpriseemoveit.exe
O4 - HKCU\..\Run: [Shareaza] "D:\Program Files\Shareaza\Shareaza.exe" -tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WUAppSetup] D:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] D:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WUAppSetup] D:\Program Files\Fichiers communs\logishrd\WUApp32.exe -v 0x046d -p 0x08b2 -f video -m logitech -d 10.5.1.2023 (User 'Default user')
O4 - S-1-5-18 Startup: Démarrage .exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: RadioTV.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Démarrage .exe (User 'Default user')
O4 - .DEFAULT Startup: RadioTV.exe (User 'Default user')
O4 - .DEFAULT User Startup: Démarrage .exe (User 'Default user')
O4 - .DEFAULT User Startup: FloppyDiskPartion.exe (User 'Default user')
O4 - Global Startup: Démarrage .exe
O4 - Global Startup: Lock Folder.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - D:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - D:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - D:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LVSrvLauncher - Unknown owner - D:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe (file missing)

hic · Answer

VOICI LE RAPPORT merci
Malwarebytes' Anti-Malware 1.32
Version de la base de données: 1616
Windows 5.1.2600 Service Pack 2

8/01/2009 2:18:00
mbam-log-2009-01-08 (02-17-45).txt

Type de recherche: Examen complet (D:\|)
Eléments examinés: 116156
Temps écoulé: 1 hour(s), 21 minute(s), 47 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 2
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 1
Fichier(s) infecté(s): 133

Processus mémoire infecté(s):
D:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.

Module(s) mémoire infecté(s):
D:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\WakeNet (Trojan.Adware) -> No action taken.

Valeur(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost (Backdoor.Bot) -> No action taken.

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
D:\Program Files\3wPlayer (Trojan.Downloader) -> No action taken.

Fichier(s) infecté(s):
D:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP204\A0119557.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP204\A0119716.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP204\A0119747.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP205\A0120129.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP205\A0120218.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP205\A0120187.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP206\A0120276.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP206\A0120313.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP207\A0121228.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP208\A0121235.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP209\A0122009.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP209\A0122047.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP210\A0122237.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP210\A0123009.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP210\A0123039.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP211\A0123513.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP211\A0123549.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0129514.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0129580.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0131513.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0130513.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0130522.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0131556.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0131566.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0131662.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0132661.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0132670.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP212\A0133670.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP214\A0135670.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP214\A0135798.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP214\A0135817.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP214\A0135797.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP214\A0135818.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP215\A0136894.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP215\A0136895.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP215\A0137894.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP215\A0137895.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP215\A0135897.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP215\A0138894.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP215\A0138895.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP216\A0139909.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP216\A0138909.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP216\A0138910.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP216\A0139910.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP216\A0139923.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP216\A0139931.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP216\A0139932.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP217\A0139945.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP217\A0139946.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP218\A0140945.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP218\A0140946.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP220\A0140964.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP220\A0140965.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP220\A0141964.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP221\A0142964.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP221\A0142965.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP184\A0077701.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP185\A0082830.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP185\A0083830.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP185\A0085830.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP185\A0086830.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP185\A0087891.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP186\A0090805.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP186\A0090868.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP186\A0091805.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP186\A0091846.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP187\A0093638.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP187\A0094348.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP187\A0094400.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP188\A0094430.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP188\A0094534.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP188\A0094585.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP189\A0099340.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP189\A0101534.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP189\A0101578.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP190\A0107590.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP191\A0109189.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP191\A0109194.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP191\A0109240.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP191\A0110398.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP191\A0110419.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP191\A0111108.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP191\A0111160.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP192\A0115235.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP193\A0115249.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115434.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115455.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115507.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115605.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115662.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115797.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115818.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0115829.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0116829.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0116873.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0117829.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0117884.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0118404.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP194\A0118433.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP195\A0118557.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP196\A0118688.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP197\A0118717.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP198\A0118967.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP199\A0118972.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP200\A0119184.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP201\A0119376.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP201\A0119435.dll (Worm.Mabezat) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP201\A0119469.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP202\A0119522.EXE (Trojan.Downloader) -> No action taken.
D:\System Volume Information\_restore{8AD25502-D2BF-4376-8619-1B0984CBE12A}\RP203\A0119536.EXE (Trojan.Downloader) -> No action taken.
D:\WINDOWS\system32\helper.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\All Users\Application Data\Application Data .exe (Trojan.Lop.H) -> No action taken.
D:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\Dr Watson .exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\All Users\Application Data\Microsoft\Dr Watson\NokiaN73Tools.exe (Trojan.Agent) -> No action taken.
D:\WINDOWS\MDM.EXE (Backdoor.Bot) -> No action taken.
D:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.
D:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> No action taken.
D:\autorun.inf (Worm.Mabezat) -> No action taken.
D:\zPharaoh.exe (Worm.Mabezat) -> No action taken.
D:\Documents and Settings\All Users\Application Data\Google\Google .exe (Trojan.FakeAlert) -> No action taken.
D:\Documents and Settings\All Users\Application Data\Google\MakeUrOwnFamilyTree.exe (Trojan.FakeAlert) -> No action taken.
D:\Documents and Settings\hic\Application Data\Application Data .exe (Trojan.Lop.H) -> No action taken.
D:\Documents and Settings\Default User\Application Data\Application Data .exe (Trojan.Lop.H) -> No action taken.
D:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Temporary Internet Files .exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\Default User\Local Settings\Temporary Internet Files\Win98compatibleXP.exe (Trojan.Agent) -> No action taken.
D:\Documents and Settings\SYSTEM\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
D:\Documents and Settings\hic\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
D:\Documents and Settings\Default User\Cookies\Cookies .exe (Fake.Dropped.Malware) -> No action taken.
D:\Documents and Settings\Default User\Cookies\WinrRarSerialInstall.exe (Fake.Dropped.Malware) -> No action taken.
D:\Documents and Settings\hic\Application Data\Google\Google .exe (Trojan.FakeAlert) -> No action taken.
D:\Documents and Settings\hic\Application Data\Google\KasperSky6.0 Key.doc.exe (Trojan.FakeAlert) -> No action taken.
D:\WINDOWS\SVCHOST.INI (Heuristics.Reserved.Word.Exploit) -> No action taken.

antihack · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:21:35, on 17/03/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Menara\dslmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32	askmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.ma/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Menara
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{1598242F-FD71-4E20-9E35-0D0E33EFC60B}: NameServer = 62.251.231.242 212.217.1.17
O17 - HKLM\System\CS1\Services\Tcpip\..\{1598242F-FD71-4E20-9E35-0D0E33EFC60B}: NameServer = 62.251.231.242 212.217.1.17

rabah anis · Answer

Malwarebytes' Anti-Malware 1.36
Version de la base de données: 2135
Windows 5.1.2600 Service Pack 2

16/05/2009 11:29:59
mbam-log-2009-05-16 (11-29-54).txt

Type de recherche: Examen complet (C:\|D:\|E:\|)
Eléments examinés: 89483
Temps écoulé: 6 minute(s), 33 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.

Module(s) mémoire infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.
C:\Documents and Settings	azebama.dll.ren (Worm.Mabezat) -> No action taken.
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\Administrateur\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
C:\autorun.inf (Worm.Mabezat) -> No action taken.
C:\zPharaoh.exe (Worm.Mabezat) -> No action taken.





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:45:32, on 16/05/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\system32
vsvc32.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Crawler\Toolbar\CToolbar.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Trend Micro\HijackThis\hjt.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.fr/toolbar/ie8/sidebar.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=%s
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: DefaultSearchHook Class - {C94E154B-1459-4A47-966B-4B843BEFC7DB} - C:\Program Files\AskSearch\bin\DefaultSearch.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: Barre d'outils &Crawler - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [GBB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\Microsoft Office\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\Microsoft Office\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{DA1E1A84-586C-4F0E-B849-728FA25C7535}: NameServer = 4.2.2.6 4.2.2.5
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

jOxic · Answer

Malwarebytes' Anti-Malware 1.38
Version de la base de données: 2297
Windows 5.1.2600 Service Pack 2

26/06/2009 18:52:17
mbam-log-2009-06-26 (18-52-14).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 117616
Temps écoulé: 19 minute(s), 51 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 5
Dossier(s) infecté(s): 3
Fichier(s) infecté(s): 7

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CURRENT_USER\SOFTWARE\PC-Cleaner (Rogue.PC-Cleaner) -> No action taken.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Dossier(s) infecté(s):
C:\Program Files\PC-Cleaner (Rogue.PC-Cleaner) -> No action taken.
c:\program files\pc-cleaner\Backup (Rogue.PC-Cleaner) -> No action taken.
c:\program files\pc-cleaner\Log (Rogue.PC-Cleaner) -> No action taken.

Fichier(s) infecté(s):
c:\program files\pc-cleaner\PCCleaner.exe (Rogue.PC-Cleaner) -> No action taken.
c:\program files\pc-cleaner\unins000.dat (Rogue.PC-Cleaner) -> No action taken.
c:\program files\pc-cleaner\unins000.exe (Rogue.PC-Cleaner) -> No action taken.
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.
C:\autorun.inf (Worm.Mabezat) -> No action taken.
C:\zPharaoh.exe (Worm.Mabezat) -> No action taken.
c:\documents and settings\sidi mohammed\Bureau\PC-Cleaner_1.0.Patch.bagie.tPORt.zip (Rogue.PC-Cleaner) -> No action taken.

athomforce · Answer

bonjour,
 
j'ai un probleme d'ouverture de regedit.exe et taskmgr.exe et je ne sais pas si tazemba qui le responsable de cette catastrophe ou d'autre virus
donc j'ai analyse mon pc par Hijackthis comme vous l'avez demande et voilà le rapport que j'ai eu:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 16:13:54, on 13/08/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\hvey.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\fhbdv.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\winxuued.exe
E:\Ahead\Néro\Nero ControlCenter 4
cc.exe
C:\WINDOWS\system32\mmc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
F:\Multi-Boot Recovery and boot cd\multi boot\BOOTCD\WINTOOLS\AUTORUN.EXE
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HIJACK.EXE
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\TEMP\VRTAC.tmp
C:\WINDOWS\TEMP\VRTAD.tmp
C:\WINDOWS\system32\svchost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://E:\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\MICROS~1\OFFICE11\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{2700C1B9-1A61-4ACA-9BF0-BA7A0F95C4CC}: NameServer = 62.251.229.237 62.251.229.223
O17 - HKLM\System\CS1\Services\Tcpip\..\{2700C1B9-1A61-4ACA-9BF0-BA7A0F95C4CC}: NameServer = 62.251.229.237 62.251.229.223
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
O23 - Service: Service Partage réseau du Lecteur Windows Media (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe

A LAIDE · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 03:50:26, on 04/09/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\RegCure\RegCure.exe
C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
C:\Documents and Settings\Administrateur\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\mfevtps.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
c:\f5e130584527e4a78dce0e643217\update\update.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Uniblue\RegistryBooster 2009\RegistryBooster.exe
C:\Program Files	rend micro\HijackThis\HijackThis.exe
C:\Program Files\Skype\Toolbars\Shared\SkypeNames.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com/spresults.aspx
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?fdr=lc&toHttps=1&redig=FA6AD360E0BE4C719380F8C470A3D3A8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {00A6FAF6-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: MyWebSearch Search Assistant BHO - {00A6FAF1-072E-44cf-8957-5838F569A31D} - C:\Program Files\MyWebSearch\bar\1.bin\MWSSRCAS.DLL
O2 - BHO: mwsBar BHO - {07B18EA1-A523-4961-B6BB-170DE4475CCA} - C:\Program Files\MyWebSearch\bar\1.bin\MWSBAR.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptsn.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [MyWebSearch Plugin] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\M3PLUGIN.DLL,UPF
O4 - HKLM\..\Run: [My Web Search Bar] rundll32 C:\PROGRA~1\MYWEBS~1\bar\1.bin\MWSBAR.DLL,S
O4 - HKLM\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKLM\..\Run: [SoftwareHelper] C:\Documents and Settings\Administrateur\Application Data\eoRezo\SoftwareUpdate\SoftwareUpdateHP.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [UniblueRegistryBooster] C:\Program Files\Uniblue\RegistryBooster 2009\RegistryBooster.exe -minimize
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\herss.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\EngineServer.exe
O23 - Service: Service McAfee Framework (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: My Web Search Service (MyWebSearchService) - MyWebSearch.com - C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwssvc.exe

kamel · Answer

salut tt le monde voila le rapport alors dis moi c que je dois faire mnt papyber ^^ é merci d'avance :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:29:50, on 19/09/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\kamelovishe\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\SuperCopier2\SuperCopier2.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?cc=fr&toHttps=1&redig=D4322FEE7CF74A348CB9CE970F098EF5
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://fr.yahoo.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_6_0_1.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [SuperCopier2.exe] C:\Program Files\SuperCopier2\SuperCopier2.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Notification de cadeaux MSN.lnk = C:\Documents and Settings\kamelovishe\Application Data\Microsoft\Notification de cadeaux MSN\lsnfier.exe
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{C83174CB-C13B-425A-B935-2C996FA339E1}: NameServer = 208.67.222.222 193.55.10.102
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

atlantis21 · Answer

Malwarebytes' Anti-Malware 1.44
Version de la base de données: 3703
Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

13/02/2010 18:36:27
mbam-log-2010-02-13 (18-36-20).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 153893
Temps écoulé: 1 hour(s), 8 minute(s), 47 second(s)

Processus mémoire infecté(s): 1
Module(s) mémoire infecté(s): 1
Clé(s) du Registre infectée(s): 0
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 0
Fichier(s) infecté(s): 31

Processus mémoire infecté(s):
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.

Module(s) mémoire infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.

Clé(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
(Aucun élément nuisible détecté)

Fichier(s) infecté(s):
C:\Documents and Settings	azebama.dll (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\mohamed\Bureau\Super Fast Shutdown\shutdown.exe (HackTool.Shutdown) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP46\A0009777.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP47\A0009945.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP47\A0010453.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP47\A0011453.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP48\A0011650.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP48\A0012650.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP48\A0013262.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP49\A0014262.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP49\A0014579.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP49\A0014808.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP50\A0015805.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP50\A0016095.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP51\A0016804.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP51\A0017803.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP52\A0017948.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP52\A0017944.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP52\A0020898.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP56\A0021197.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP56\A0021581.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP58\A0022589.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP59\A0022809.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP59\A0022912.dll (Worm.Mabezat) -> No action taken.
C:\System Volume Information\_restore{A4BBF58B-DA7E-439A-A12C-0BFEC0C7165A}\RP59\A0023912.dll (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\mohamed\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\SYSTEM\Application Data	azebama\zPharaoh.dat (Worm.Mabezat) -> No action taken.
C:\Documents and Settings\hook.dl_ (Worm.Mabezat) -> No action taken.
C:\Documents and Settings	azebama.dl_ (Worm.Mabezat) -> No action taken.
C:\autorun.inf (Worm.Mabezat) -> No action taken.
C:\zPharaoh.exe (Worm.Mabezat) -> No action taken.

atlantis21 · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:50:10, on 13/02/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\USB Disk Security\USBGuard.exe
C:\WINDOWS\system32undll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\FixCamera.exe
C:\WINDOWS	snpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Menara\dslmon.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.menara.ma/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [USB Antivirus] C:\Program Files\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [FixCamera] C:\WINDOWS\FixCamera.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS	snpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10d.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Anti-Autorun-inf.lnk = C:\Program Files\Prg Chris\Anti-Autorun.inf\Anti-Autorun.inf.exe
O4 - Startup: _uninstall_setup_9.0.0.722_10.01.2010_15-21.bat
O4 - Global Startup: DSLMON.lnk = C:\Program Files\Menara\dslmon.exe
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger le contenu de video FLV avec IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (Ma-Config control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_0_2_0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{37F398C8-0B0E-4AD3-A231-3892785B6457}: NameServer = 62.251.229.223 62.251.229.237
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Service de l’iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Ma-Config Service (maconfservice) - CybelSoft - C:\Program Files\ma-config.com\maconfservice.exe

atlantis21 · Answer

pour moi j'ai essyer un scan avec avg 9.0 et tout est disparu

maddd · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:23:35, on 17/04/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Unlocker\Unlocker.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\glalel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\winver.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "%ProgramFiles%\DAEMON Tools\daemon.exe\" -lang 1033
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin
pjpi160_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin
pjpi160_01.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E1D1490-F29F-4572-9075-FFD35AAEEB30}: NameServer = 62.251.229.223 62.251.229.237

maddd · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:35:14, on 17/04/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.20583)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Unlocker\Unlocker.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\glalel.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\system32\winver.exe
C:\Documents and Settings	azebama.dl_
C:\Program Files\CCleaner\CCleaner.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "%ProgramFiles%\DAEMON Tools\daemon.exe\" -lang 1033
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: DSLMON.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin
pjpi160_01.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin
pjpi160_01.dll
O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E1D1490-F29F-4572-9075-FFD35AAEEB30}: NameServer = 62.251.229.223 62.251.229.237

skitiwi · Answer

salut tt le monde, g un TAZEBAMA et un HOOK sur mon PC. j'ai effectué un scan avec COMBOFIX mais il n'arrive pas à les supprimer. Voici le RApport de scan. HELP!!!:


ComboFix 10-04-18.04 - skitiwi 19/04/2010  23:59:05.4.2 - x86
Microsoft Windows XP Professionnel  5.1.2600.2.1252.33.1036.18.1022.535 [GMT 0:00]
Lancé depuis: d:\documents and settings\skitiwi\Mes documents\Téléchargements\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
C:\zPharaoh.exe
D:\autorun.inf
d:\documents and settings.\hook.dl_
d:\documents and settings.	azebama.dl_
d:\documents and settings.	azebama.dll
d:\documents and settings\skitiwi\Application Data\msn.exe
d:\documents and settings\skitiwi\Application Data	azebama
d:\documents and settings\skitiwi\Application Data	azebama	azebama.log
d:\documents and settings\skitiwi\Application Data	azebama\zPharaoh.dat
d:\windows\system32\winxp.exe
D:\zPharaoh.exe
d:\documents and settings.\hook.dl_ . . . . impossible à supprimer
d:\documents and settings.	azebama.dl_ . . . . impossible à supprimer
d:\documents and settings.	azebama.dll . . . . impossible à supprimer

.
(((((((((((((((((((((((((((((   Fichiers créés du 2010-03-20 au 2010-04-20  ))))))))))))))))))))))))))))))))))))
.

2010-04-20 00:16 . 2010-04-20 00:18	155531	--sh--r-	D:\zPharaoh.exe
2010-04-20 00:16 . 2010-04-20 00:18	--------	d-----w-	d:\documents and settings\skitiwi\Application Data	azebama
2010-04-19 17:09 . 2010-04-19 17:09	--------	d-----w-	d:\windows\Sun
2010-04-19 17:06 . 2010-04-19 17:06	--------	d-----w-	d:\program files\Fichiers communs\Java
2010-04-19 17:06 . 2010-04-19 17:06	503808	----a-w-	d:\documents and settings\skitiwi\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-46c81c77-n\msvcp71.dll
2010-04-19 17:06 . 2010-04-19 17:06	499712	----a-w-	d:\documents and settings\skitiwi\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-46c81c77-n\jmc.dll
2010-04-19 17:06 . 2010-04-19 17:06	348160	----a-w-	d:\documents and settings\skitiwi\Application Data\Sun\Java\Deployment\SystemCache\6.0\54\1a209876-46c81c77-n\msvcr71.dll
2010-04-19 17:06 . 2010-04-19 17:06	61440	----a-w-	d:\documents and settings\skitiwi\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6801415c-n\decora-sse.dll
2010-04-19 17:06 . 2010-04-19 17:06	12800	----a-w-	d:\documents and settings\skitiwi\Application Data\Sun\Java\Deployment\SystemCache\6.0\17\6d0ad391-6801415c-n\decora-d3d.dll
2010-04-19 17:05 . 2010-04-19 17:05	411368	----a-w-	d:\windows\system32\deployJava1.dll
2010-04-19 17:05 . 2010-04-19 17:05	--------	d-----w-	d:\program files\Java
2010-04-19 16:50 . 2010-04-20 00:16	32768	----a-w-	d:\documents and settings	azebama.dll
2010-04-19 15:14 . 2008-09-26 18:01	621056	----a-w-	d:\windows\system32\drivers\mod7700.sys
2010-04-19 15:14 . 2008-09-26 18:01	113664	----a-w-	d:\windows\system32\drivers\ewusbnet.sys
2010-04-19 15:14 . 2008-09-26 18:01	101376	----a-w-	d:\windows\system32\drivers\ewusbmdm.sys
2010-04-19 15:14 . 2008-09-26 18:00	24448	----a-w-	d:\windows\system32\drivers\ewdcsc.sys
2010-04-19 14:38 . 2004-08-05 12:00	46592	-c--a-w-	d:\windows\system32\dllcache\svcext51.dll
2010-04-19 14:37 . 2004-08-05 12:00	229439	-c--a-w-	d:\windows\system32\dllcache\multibox.dll
2010-04-19 14:36 . 2004-08-05 12:00	10129408	-c--a-w-	d:\windows\system32\dllcache\hwxkor.dll
2010-04-19 14:35 . 2004-08-05 12:00	24064	-c--a-w-	d:\windows\system32\dllcache\compfilt.dll
2010-04-19 14:34 . 2004-08-05 12:00	68608	-c--a-w-	d:\windows\system32\dllcache\isatq.dll
2010-04-19 14:31 . 2004-08-05 12:00	16384	-c--a-w-	d:\windows\system32\dllcache\isignup.exe
2010-04-19 13:45 . 2004-08-05 12:00	24661	-c--a-w-	d:\windows\system32\dllcache\spxcoins.dll
2010-04-19 13:45 . 2004-08-05 12:00	24661	----a-w-	d:\windows\system32\spxcoins.dll
2010-04-19 13:45 . 2004-08-05 12:00	13312	-c--a-w-	d:\windows\system32\dllcache\irclass.dll
2010-04-19 13:45 . 2004-08-05 12:00	13312	----a-w-	d:\windows\system32\irclass.dll
2010-04-17 21:44 . 2010-04-17 21:44	--------	d-----w-	d:\program files\SuperCopier
2010-04-16 18:44 . 2008-11-26 17:21	1236208	----a-w-	d:\windows\system32\aswBoot.exe
2010-04-06 20:53 . 2010-04-16 17:40	--------	d-----w-	d:\documents and settings\All Users\Application Data\Alwil Software
2010-04-06 17:16 . 2010-04-19 21:56	664	----a-w-	d:\windows\system32\d3d9caps.dat
2010-04-06 16:11 . 2010-04-19 15:14	--------	d-----w-	d:\program files\Internet Mobile+
2010-04-05 20:15 . 2010-04-09 14:04	--------	d-----w-	d:\documents and settings\skitiwi\Local Settings\Application Data\Temp
2010-04-05 20:14 . 2010-04-09 14:02	--------	d-----w-	d:\documents and settings\skitiwi\Local Settings\Application Data\Google
2010-04-05 12:07 . 2010-04-05 12:07	--------	d-----w-	d:\program files\MSECache
2010-04-03 22:23 . 2010-04-19 16:55	--------	d-----w-	d:\documents and settings\skitiwi\Application Data\vlc
2010-04-03 21:39 . 2010-04-19 16:51	2081503	----a-w-	d:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\install_flash_player.exe
2010-04-03 21:15 . 2010-04-03 21:15	--------	d-----w-	d:\documents and settings\All Users\Application Data\McAfee Security Scan
2010-04-03 21:15 . 2010-04-03 21:15	--------	d-----w-	d:\documents and settings\All Users\Application Data\McAfee
2010-04-03 21:15 . 2010-04-06 21:47	--------	d-----w-	d:\program files\McAfee Security Scan
2010-04-03 21:14 . 2010-04-19 16:51	1182519	----a-w-	d:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\SecurityScan_Release.exe
2010-04-03 21:14 . 2010-04-04 12:20	--------	d-----w-	d:\documents and settings\All Users\Application Data\NOS
2010-04-03 16:48 . 2010-04-03 16:48	--------	d-----w-	d:\program files\Microsoft
2010-04-03 16:47 . 2010-04-03 16:48	--------	d-----w-	d:\program files\Windows Live
2010-04-03 16:09 . 2006-10-26 19:56	33104	----a-w-	d:\windows\system32\Spool\prtprocs\w32x86\msonpppr.dll
2010-04-03 16:09 . 2006-10-26 19:56	32592	----a-w-	d:\windows\system32\msonpmon.dll
2010-04-03 16:08 . 2010-04-03 16:08	--------	d-----w-	d:\program files\Microsoft Works
2010-04-03 16:07 . 2010-04-03 16:07	--------	d-----w-	d:\program files\MSBuild
2010-04-03 16:03 . 2010-04-03 16:07	--------	d--h--w-	d:\windows\ShellNew
2010-04-03 16:02 . 2010-04-03 16:02	--------	d-----w-	d:\documents and settings\skitiwi\Local Settings\Application Data\Microsoft Help
2010-04-03 16:02 . 2010-04-05 12:06	--------	d-----w-	d:\documents and settings\All Users\Application Data\Microsoft Help
2010-04-03 16:02 . 2010-04-03 16:02	--------	d-----r-	D:\MSOCache
2010-04-03 15:31 . 2010-04-20 00:16	--------	d-----w-	d:\documents and settings\skitiwi\Tracing
2010-04-03 15:30 . 2010-04-03 15:30	--------	d-----w-	d:\program files\Windows Live SkyDrive
2010-04-03 15:18 . 2010-04-03 15:18	--------	d-----w-	d:\program files\MagicISO
2010-04-03 15:17 . 2010-04-07 11:29	--------	d-----w-	d:\documents and settings\skitiwi\Local Settings\Application Data\Adobe
2010-04-03 14:49 . 2010-04-03 14:49	--------	d-----w-	d:\program files\Fichiers communs\Adobe
2010-04-03 14:48 . 2010-04-03 14:48	--------	d-----w-	d:\program files\VideoLAN
2010-04-03 14:22 . 2010-04-03 14:22	--------	d-----w-	d:\program files\Fichiers communs\Windows Live
2010-04-03 13:44 . 2010-04-03 13:44	--------	d-----w-	d:\program files\ltmoh
2010-04-03 13:44 . 2005-05-03 13:10	68096	----a-w-	d:\windows\agrsmdel.exe
2010-04-03 13:44 . 2010-04-03 13:44	--------	d-----w-	d:\windows\Options
2010-04-03 13:42 . 2010-04-19 16:51	267119	----a-w-	d:\windows\system32\cselect.exe
2010-04-03 13:42 . 2005-10-15 15:29	88203	----a-w-	d:\windows\agrsmmsg.exe
2010-04-03 13:42 . 2003-12-05 01:48	77824	----a-w-	d:\windows\system32	osmreg.exe
2010-04-03 13:42 . 2003-10-31 19:59	45056	----a-w-	d:\windows\system32\csellang.dll
2010-04-03 13:42 . 2005-11-15 18:00	1122656	----a-w-	d:\windows\system32\drivers\AGRSM.sys
2010-04-03 13:34 . 2010-04-19 23:31	--------	d--h--w-	d:\windows\$hf_mig$
2010-04-03 13:33 . 2010-04-03 13:33	81920	----a-w-	d:\windows\ALCFDRTM.EXE
2010-04-03 13:14 . 2010-04-19 15:03	68464	----a-w-	d:\documents and settings\skitiwi\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-04-03 13:06 . 2010-04-03 13:06	--------	d-----w-	d:\windows\system32\Lang

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-19 14:50 . 2004-08-05 12:00	71686	----a-w-	d:\windows\system32\perfc00C.dat
2010-04-19 14:50 . 2004-08-05 12:00	458886	----a-w-	d:\windows\system32\perfh00C.dat
2010-04-19 14:30 . 2010-04-03 12:18	23032	----a-w-	d:\windows\system32\emptyregdb.dat
2010-04-16 18:44 . 2010-04-06 20:53	--------	d-----w-	d:\program files\Alwil Software
2010-04-13 21:06 . 2010-04-03 12:56	--------	d--h--w-	d:\program files\InstallShield Installation Information
2010-04-13 21:04 . 2010-04-13 21:04	--------	d-----w-	d:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2010-04-09 18:46 . 2010-04-09 14:07	--------	d-----w-	d:\program files\MetaTrader - Alpari UK
2010-04-06 21:47 . 2010-04-06 21:47	--------	d-----w-	d:\documents and settings\LocalService\Application Data\McAfee
2010-04-04 14:11 . 2010-04-03 12:21	86331	----a-w-	d:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-04-03 15:17 . 2010-04-03 12:56	--------	d-----w-	d:\program files\Fichiers communs\InstallShield
2010-04-03 12:58 . 2010-04-03 12:58	663552	----a-w-	d:\windows\system32\NETw5c32.dll
2010-04-03 12:58 . 2010-04-03 12:58	4202496	----a-w-	d:\windows\system32\drivers\NETw5x32.sys
2010-04-03 12:58 . 2010-04-03 12:58	2756608	----a-w-	d:\windows\system32\NETw5r32.dll
2010-04-03 12:58 . 2010-04-03 12:58	0	----a-w-	d:\windows
sreg.dat
2010-04-03 12:56 . 2010-04-03 12:56	--------	d-----w-	d:\program files\Realtek
2010-04-03 12:55 . 2010-04-03 12:56	86016	----a-w-	d:\windows\SoundMan.exe
2010-04-03 12:55 . 2010-04-03 12:56	364544	----a-w-	d:\windows\RtlUpd.exe
2010-04-03 12:55 . 2010-04-03 12:56	9709568	----a-w-	d:\windows\RTLCPL.exe
2010-04-03 12:55 . 2010-04-03 12:56	4271616	----a-w-	d:\windows\system32\drivers\RtkHDAud.sys
2010-04-03 12:55 . 2010-04-03 12:56	16206848	----a-w-	d:\windows\RTHDCPL.exe
2010-04-03 12:55 . 2010-04-03 12:56	69632	----a-w-	d:\windows\Alcmtr.exe
2010-04-03 12:55 . 2010-04-03 12:56	2808832	----a-w-	d:\windows\alcwzrd.exe
2010-04-03 12:55 . 2010-04-03 12:56	2158592	----a-w-	d:\windows\MicCal.exe
2010-04-03 12:55 . 2010-04-03 12:57	176	----a-w-	d:\windows\system32\drivers\RTHDAEQ1.dat
2010-04-03 12:55 . 2010-04-03 12:57	176	----a-w-	d:\windows\system32\drivers\RTHDAEQ0.dat
2010-04-03 12:55 . 2010-04-03 12:57	40960	----a-w-	d:\windows\system32\ChCfg.exe
2010-04-03 12:31 . 2010-04-03 12:31	--------	d-----w-	d:\program files\HSDPA USB MODEM
2010-04-03 12:22 . 2010-04-03 12:22	--------	d-----w-	d:\program files\microsoft frontpage
2010-04-03 12:20 . 2010-04-03 12:20	--------	d-----w-	d:\program files\Services en ligne
.

(((((((((((((((((((((((((((((((((   Points de chargement Reg   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="d:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-19 4040383]
"Google Update"="d:\documents and settings\skitiwi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-04-19 292703]
"SuperCopier.exe"="d:\program files\SuperCopier\SuperCopier.exe" [2003-04-24 683520]
"ctfmon.exe"="d:\windows\system32\ctfmon.exe" [2004-08-05 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LtMoh"="d:\program files\ltmoh\Ltmoh.exe" [2004-08-18 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 88203]
"Adobe Reader Speed Launcher"="d:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-22 35760]
"Adobe ARM"="d:\program files\Fichiers communs\Adobe\ARM\1.0\AdobeARM.exe" [2010-04-19 1109295]
"GrooveMonitor"="d:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"RTHDCPL"="RTHDCPL.EXE" [2010-04-03 16206848]
"SunJavaUpdateSched"="d:\program files\Fichiers communs\Java\Java Update\jusched.exe" [2010-04-19 404567]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2004-08-05 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="d:\windows\system32	scupgrd.exe" [2004-08-05 44544]

d:\documents and settings\All Users\Menu D'marrer\Programmes\D'marrage\
McAfee Security Scan Plus.lnk - d:\program files\McAfee Security Scan\2.0.181\SSScheduler.exe [2010-1-15 255536]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe"=
"d:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"=
"d:\Program Files\Microsoft Office\Office12\GROOVE.EXE"=
"d:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"=
"d:\Program Files\Windows Live\Messenger\wlcsdk.exe"=
"d:\Program Files\Windows Live\Messenger\msnmsgr.exe"=
"d:\Program Files\VideoLAN\VLC\vlc.exe"=

S3 McComponentHostService;McAfee Security Scan Component Host Service;d:\program files\McAfee Security Scan\2.0.181\McCHSvc.exe [15/01/2010 12:49 227232]
S3 qcusbser;Mobile Connector USB Device for Legacy Serial Communication;d:\windows\system32\drivers\cmusbser.sys [03/04/2010 12:31 97408]
.
Contenu du dossier 'Tâches planifiées'

2010-04-18 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1202660629-115176313-725345543-1003Core.job
- d:\documents and settings\skitiwi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-09 16:56]

2010-04-19 d:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1202660629-115176313-725345543-1003UA.job
- d:\documents and settings\skitiwi\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-04-09 16:56]
.
.
------- Examen supplémentaire -------
.
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {BD73D52F-2C8D-498A-9E90-EC8C55648D81} = 154.15.199.142 8.8.8.8
FF - ProfilePath - d:\documents and settings\skitiwi\Application Data\Mozilla\Firefox\Profiles\vgimt42x.default\
FF - plugin: d:\documents and settings\skitiwi\Local Settings\Application Data\Google\Update\1.2.183.23
pGoogleOneClick8.dll
FF - plugin: d:\program files\Java\jre6\bin
ew_plugin
pdeployJava1.dll

---- PARAMETRES FIREFOX ----
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
d:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
d:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
d:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
d:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
d:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "https://www.mozilla.org/en-US/firefox/new/?redirect_source=firefox-com");
d:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
d:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHELINS SUPPRIMES - - - -

HKCU-Run-explo - d:\documents and settings\skitiwi\Application Data\msn.exe
HKLM-Run-regdiit - d:\windows\system32\winxp.exe
ActiveSetup-{14DY8H0U-61A8-2HPH-7865-156WH8P06461} - d:\documents and settings\skitiwi\Application Data\msn.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-20 00:17
Windows 5.1.2600 Service Pack 2 NTFS

Recherche de processus cachés ... 

Recherche d'éléments en démarrage automatique cachés ... 

Recherche de fichiers cachés ... 

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'explorer.exe'(2860)
d:\windows\system32\msi.dll
.
------------------------ Autres processus actifs ------------------------
.
d:\program files\Java\jre6\bin\jqs.exe
d:\windows\system32\wbem\wmiapsrv.exe
d:\windows\AGRSMMSG.exe
d:\windows\RTHDCPL.EXE
d:\documents and settings	azebama.dl_
.
**************************************************************************
.
Heure de fin: 2010-04-20  00:23:18 - La machine a redémarré
ComboFix-quarantined-files.txt  2010-04-20 00:23
ComboFix2.txt  2010-04-03 15:13

Avant-CF: 31 798 509 568 octets libres
Après-CF: 32 699 805 696 octets libres

- - End Of File - - 3F94FE516A05188C0676989D8DEB7B5A

mordjana · Answer

je t'es suivi et voici le rapport que j'ai trouvé:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:24:04, on 26/05/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\cmd.exe
C:\Documents and Settings\bendellali\Mes documents\Spycheck\Spycheck AntiSpyware\spycheck.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\bendellali\Mes documents\Téléchargements\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://fr.gdark.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.fr/?gws_rd=ssl
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.gdark.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.gdark.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.files-ftp.com/~unicorni/phpBB2/index.php
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://fr.gdark.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.gdark.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://fr.gdark.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://fr.gdark.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://fr.gdark.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O4 - HKLM\..\Run: [SRFirstRun] rundll32 srclient.dll,CreateFirstRunRp
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O14 - IERESET.INF: START_PAGE_URL=http://www.files-ftp.com/~unicorni/phpBB2/index.php
O17 - HKLM\System\CCS\Services\Tcpip\..\{B80800C6-7EA6-416A-95A2-0AAC2DDC75D8}: NameServer = 208.67.222.222 194.2.0.50

babounedadi · Answer

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 08:39:06, on 04/07/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
C:\Program Files\Internet Mobile+\Internet Mobile+.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?FORM=TOOLBR&cc=fr&toHttps=1&redig=4527FFF1C12746FC9EDB535C75E80ECC
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - Default URLSearchHook is missing
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - C:\PROGRA~1\FlashGet\jccatch.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O8 - Extra context menu item: Tout télécharger avec BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Tout télécharger avec FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm
O8 - Extra context menu item: Télécharger avec BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: Télécharger avec FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm
O8 - Extra context menu item: Télécharger toutes les vidéos avec BitComet - res://E:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin
pjpi142_05.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_05\bin
pjpi142_05.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} ("Ma-Config.com control) - http://fichiers.touslesdrivers.com/maconfig/MaConfig_4_1_0_3.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8E6A6FF8-5ECD-4E45-80E4-BD60899DF78F}: NameServer = 154.15.199.142 8.8.8.8
O22 - SharedTaskScheduler: Pré-chargeur Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Démon de cache des catégories de composant - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe
O23 - Service: Journal des événements (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Service COM de gravage de CD IMAPI (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe
O23 - Service: Ma-Config Service (maconfservice) - Unknown owner - C:\Program Files\ma-config.com\maconfservice.exe
O23 - Service: Partage de Bureau à distance NetMeeting (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe
O23 - Service: Plug-and-Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe
O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
O23 - Service: Carte à puce (SCardSvr) - Unknown owner - C:\WINDOWS\System32\SCardSvr.exe
O23 - Service: Journaux et alertes de performance (SysmonLog) - Unknown owner - C:\WINDOWS\system32\smlogsvc.exe
O23 - Service: Cliché instantané de volume (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe
O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe

dedo · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:42:26, on 07/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS.0\System32\smss.exe
C:\WINDOWS.0\system32\winlogon.exe
C:\WINDOWS.0\system32\services.exe
C:\WINDOWS.0\system32\lsass.exe
C:\WINDOWS.0\system32\svchost.exe
C:\WINDOWS.0\System32\svchost.exe
C:\WINDOWS.0\system32\spoolsv.exe
C:\WINDOWS.0\Explorer.EXE
C:\Program Files\Panda USB Vaccine\USBVaccine.exe
C:\Program Files\IObit\Advanced SystemCare 3\AutoSweep.exe
C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE
C:\Program Files\HSPA USB MODEM\ModemListener.exe
C:\WINDOWS.0\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\DeviceHelper\DeviceManager.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS.0\system32\wuauclt.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\windxbgua.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS.0\system32	askmgr.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings	azebama.dl_
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS.0\system32
tvdm.exe
C:\WINDOWS.0\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrateur\Mes documents\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.01net.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer fourni par 01net.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {7757CBCC-0975-4b79-A519-90B142CA3A23} - C:\Program Files\IObitBar	oolbar\1.bin\i0SrcAs.dll
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll (file missing)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Toolbar BHO - {EFA17361-CDC0-4927-9AFC-BAAD1F96B2AE} - C:\Program Files\IObitBar	oolbar\1.bin\i0bar.dll
O3 - Toolbar: IObit Toolbar - {EFA17369-CDC0-4927-9AFC-BAAD1F96B2AE} - C:\Program Files\IObitBar	oolbar\1.bin\i0bar.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start
O4 - HKLM\..\Run: [ModemListener] C:\Program Files\HSPA USB MODEM\ModemListener.exe start
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS.0\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS.0\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Rechercher - http://edits.myway.com/...
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.0\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: DeviceManager - Unknown owner - C:\Program Files\Fichiers communs\DeviceHelper\DeviceManager.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: IObit Toolbar Service (IObitBarService) - IObit - C:\PROGRA~1\IObitBar	oolbar\1.bin\i0barsvc.exe

athomforce · Answer

bonsoir à tous;

téléchqrger panda cloud antivirus en cliquant sur le lien si-dessous : 
https://www.winportal.fr/ pour supprimer tazebama.dll

mehdi · Answer

Salut j'ai aussi été infecté par le maudit tazebama alors svp je vous demande s'il est obligatoire de vous donner les raports sinon

fadelox · Answer

moi aussi je suis infecté mais jai suprommer le virus avec virus remover for Win32/mabezat http://download.avgfree.com/filedir/util/avg_rem_sup.dir/rmmabez/rmmabez.exe

zikass bogana · Answer

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:58:29, on 29/03/2013
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16470)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32	askhost.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Users\auto-run bogana\AppData\Roaming\uTorrent\uTorrent.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Windows\system32	askhost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\SyncServer.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.b1.org/?bsrc=hmior&chid=c167991
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.b1.org/?bsrc=hmior&chid=c167991
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O1 - Hosts: 74.208.10.249 gs.apple.com
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [uTorrent] "C:\Users\auto-run bogana\AppData\Roaming\uTorrent\uTorrent.exe"  /MINIMIZED
O4 - HKCU\..\Run: [PC Performer43885.exe] "C:\Users\AUTO-R~1\AppData\Local\Temp\PC Performer43885.exe" /XML="C:\Users\AUTO-R~1\AppData\Local\Temp\9F3B.tmp" /STP=0:1
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'SERVICE RÉSEAU')
O8 - Extra context menu item: Télécharger avec IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: Télécharger tous les liens avec IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\aelupsvc.dll,-1 (AeLookupSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe
O23 - Service: @%systemroot%\system32\appidsvc.dll,-100 (AppIDSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\appinfo.dll,-100 (Appinfo) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: @appmgmts.dll,-3250 (AppMgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-204 (AudioEndpointBuilder) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\audiosrv.dll,-200 (Audiosrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\AxInstSV.dll,-103 (AxInstSV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bdesvc.dll,-100 (BDESVC) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\bfe.dll,-1001 (BFE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qmgr.dll,-1000 (BITS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%systemroot%\system32\browser.dll,-100 (Browser) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\bthserv.dll,-101 (bthserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-11 (CertPropSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\cryptsvc.dll,-1001 (CryptSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\cscsvc.dll,-200 (CscService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @oleres.dll,-5012 (DcomLaunch) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\defragsvc.dll,-101 (defragsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dhcpcore.dll,-100 (Dhcp) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\dnsapi.dll,-101 (Dnscache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dot3svc.dll,-1102 (dot3svc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\dps.dll,-500 (DPS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\eapsvc.dll,-1 (EapHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\ehome\ehrecvr.exe,-101 (ehRecvr) - Unknown owner - C:\Windows\ehome\ehRecvr.exe
O23 - Service: @%SystemRoot%\ehome\ehsched.exe,-101 (ehSched) - Unknown owner - C:\Windows\ehome\ehsched.exe
O23 - Service: @%SystemRoot%\system32\wevtsvc.dll,-200 (eventlog) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @comres.dll,-2450 (EventSystem) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdPHost.dll,-100 (fdPHost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\fdrespub.dll,-100 (FDResPub) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\FntCache.dll,-100 (FontCache) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @gpapi.dll,-112 (gpsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: Service Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Service Google Update (gupdatem) (gupdatem) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: @%SystemRoot%\System32\hidserv.dll,-101 (hidserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\kmsvc.dll,-6 (hkmsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\ListSvc.dll,-100 (HomeGroupListener) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\provsvc.dll,-100 (HomeGroupProvider) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\ikeext.dll,-501 (IKEEXT) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\IPBusEnum.dll,-102 (IPBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\iphlpsvc.dll,-500 (iphlpsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @comres.dll,-2946 (KtmRm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\srvsvc.dll,-100 (LanmanServer) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wkssvc.dll,-100 (LanmanWorkstation) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lltdres.dll,-1 (lltdsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\lmhsvc.dll,-101 (lmhosts) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-100 (MMCSS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\FirewallAPI.dll,-23090 (MpsSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe
O23 - Service: @%SystemRoot%\system32\iscsidsc.dll,-5000 (MSiSCSI) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\msimsg.dll,-27 (msiserver) - Unknown owner - C:\Windows\system32\msiexec.exe
O23 - Service: @%SystemRoot%\system32\qagentrt.dll,-6 (napagent) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
etman.dll,-109 (Netman) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
etprofm.dll,-202 (netprofm) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32
lasvc.dll,-1 (NlaSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32
sisvc.dll,-200 (nsi) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8004 (p2pimsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\p2psvc.dll,-8006 (p2psvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pcasvc.dll,-1 (PcaSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\peerdistsvc.dll,-9000 (PeerDistSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\pla.dll,-500 (pla) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpnpmgr.dll,-100 (PlugPlay) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpauto.dll,-8002 (PNRPAutoReg) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\pnrpsvc.dll,-8000 (PNRPsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\polstore.dll,-5010 (PolicyAgent) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\umpo.dll,-100 (Power) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\profsvc.dll,-300 (ProfSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32asauto.dll,-200 (RasAuto) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%Systemroot%\system32asmans.dll,-200 (RasMan) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @regsvc.dll,-1 (RemoteRegistry) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%windir%\system32\RpcEpMap.dll,-1001 (RpcEptMapper) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe
O23 - Service: @oleres.dll,-5010 (RpcSs) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SCardSvr.dll,-1 (SCardSvr) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\schedsvc.dll,-100 (Schedule) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\certprop.dll,-13 (SCPolicySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sdrsvc.dll,-107 (SDRSVC) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\Sens.dll,-200 (SENS) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\sensrsvc.dll,-1000 (SensrSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\SessEnv.dll,-1026 (SessionEnv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\shsvcs.dll,-12288 (ShellHWDetection) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe
O23 - Service: @%SystemRoot%\system32\sppuinotify.dll,-103 (sppuinotify) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\ssdpsrv.dll,-100 (SSDPSRV) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sstpsvc.dll,-200 (SstpSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wiaservc.dll,-9 (StiSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\swprv.dll,-103 (swprv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\sysmain.dll,-1000 (SysMain) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\TabSvc.dll,-100 (TabletInputService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	apisrv.dll,-10100 (TapiSrv) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32	bssvc.dll,-100 (TBS) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32	ermsrv.dll,-268 (TermService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32	hemeservice.dll,-8192 (Themes) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\mmcss.dll,-102 (THREADORDER) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32	rkwks.dll,-1 (TrkWks) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\servicing\TrustedInstaller.exe,-100 (TrustedInstaller) - Unknown owner - C:\Windows\servicing\TrustedInstaller.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe
O23 - Service: @%SystemRoot%\system32\umrdp.dll,-1000 (UmRdpService) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\upnphost.dll,-213 (upnphost) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\dwm.exe,-2000 (UxSms) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe
O23 - Service: @%SystemRoot%\system32\w32time.dll,-200 (W32Time) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe
O23 - Service: @%systemroot%\system32\wbiosrvc.dll,-100 (WbioSrvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wcncsvc.dll,-3 (wcncsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\WcsPlugInService.dll,-200 (WcsPlugInService) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-502 (WdiServiceHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\wdi.dll,-500 (WdiSystemHost) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\webclnt.dll,-100 (WebClient) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wecsvc.dll,-200 (Wecsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wercplsupport.dll,-101 (wercplsupport) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wersvc.dll,-100 (WerSvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%ProgramFiles%\Windows Defender\MsMpRes.dll,-103 (WinDefend) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\system32\winhttp.dll,-100 (WinHttpAutoProxySvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmisvc.dll,-205 (Winmgmt) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wsmsvc.dll,-101 (WinRM) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wlansvc.dll,-257 (Wlansvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\wmpnetwk.exe
O23 - Service: @%SystemRoot%\system32\wpcsvc.dll,-100 (WPCSvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wpdbusenum.dll,-100 (WPDBusEnum) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wscsvc.dll,-200 (wscsvc) - Unknown owner - C:\Windows\System32\svchost.exe
O23 - Service: @%systemroot%\system32\SearchIndexer.exe,-103 (WSearch) - Unknown owner - C:\Windows\system32\SearchIndexer.exe
O23 - Service: @%systemroot%\system32\wuaueng.dll,-105 (wuauserv) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\system32\wudfsvc.dll,-1000 (wudfsvc) - Unknown owner - C:\Windows\system32\svchost.exe
O23 - Service: @%SystemRoot%\System32\wwansvc.dll,-257 (WwanSvc) - Unknown owner - C:\Windows\system32\svchost.exe

Tazebama

63 réponses

Newsletters