Antivirus 2009

Bonsoir DIID

Voilà tout semble OK
fenêtre intempestive n'apparait plus, heureusement car avec toutes les manips...ouf!!!
Merci pour tes conseils et le suivi.
C nickel !!!!
Bonne continuuuaaaaation à toi comme on dit.
RC

-->- Recherche:

C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Bureau\HJTInstall.exe: trouvé !
C:\Documents and Settings\HP_Administrateur\Recent\HijackThis.lnk: trouvé !
C:\Program Files\Navilog1: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !

---------------------------------
-->- Suppression:

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\HijackThis.lnk: supprimé !
C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe: Erreur de suppression !
C:\Documents and Settings\HP_Administrateur\Bureau\HJTInstall.exe: supprimé !
C:\Documents and Settings\HP_Administrateur\Recent\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Navilog1: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

Corbeille vidée!

Bonjour,
parfait.
Très bien.
Et comment vas le PC ?

Si tout va bien alors on termine (sinon dis moi et laisse ce poste en suspend) :

> Peux-tu vérifier ta console JAVA ici : https://www.java.com/fr/download/uninstalltool.jsp, et installer la nouvelle version si besoin est (dans ce cas désinstalle avant l'ancienne version). Dis moi ce qu'il en est stp.
Pour info. ou en cas de problème : http://assiste.com.free.fr/p/abc/c/anti_java.html

> Mets à jour Acrobat si ce n'est pas le cas (désinstalle avant la version antérieure) : https://get2.adobe.com/reader/otherversions/

> Télécharge ToolsCleaner : https://www.commentcamarche.net/telecharger/securite/22061-toolscleaner/ sur ton bureau pour supprimer les boîtes de Pandore.
- Clique sur Recherche et laisse le scan agir ...
- Clique sur Suppression pour finaliser (tu peux, si tu le souhaites, te servir des Options facultatives)
- Clique sur Quitter pour obtenir le rapport et poste le dans ta réponse (TCleaner.txt se trouve à la racine de ton disque dur (C:\)).
- Supprime ToolsCleaner ensuite.

> Télécharge et installe Easy Cleaner stp : https://www.01net.com/telecharger/windows/Utilitaire/registre/fiches/8351.html
(lien miroir : https://www.clubic.com/telecharger-fiche11170-easycleaner.html )
- Lance le programme puis clique sur <Registre> puis sur <Trouver>.
- A la fin du scan clique sur <Supprime tout> puis confirme par <Oui> puis quitte le programme.
Si besoin tuto ici : https://www.pcparadise.fr
et http://www.6ma.fr/tuto/easycleaner-nettoyer-windows-des-elements-obsoletes/

> Tu peux aussi vider ta corbeille.

> Désactive et réactive la restauration de système, pour cela : suis les instructions de ce lien : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/fr_docid/20020830101856924
PS : Si tu est sous Vista c'est ce lien : http://service1.symantec.com/SUPPORT/INTER/tsgeninfointl.nsf/4f60eedf1156c8068525695b005ca288/c066b2e9a50cc948802572870032b170?OpenDocument

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Quelques conseils et recommandations pour l'avenir :

> Passe un coup d'AGV et/ou de MalwareByte's Anti-Malware et de Ccleaner de temps en temps (1 fois par semaine à 1 fois par mois, suivant l'utilisation que tu fais de ton PC. Tu peux aussi décocher la casse dans l’onglet "Options" puis clique sur "Avancé" et décoche la case "Effacer uniquement les fichiers, du dossier temp de Windows, plus vieux que 48 heures").
- Utilise aussi tes autres logiciels de protection (scannes antivirus, antispywares...). N'oublie pas de faire les mises à jour avant de les utiliser.
- Pense aussi à faire une défragmentation de tes disques durs de temps en temps (garde suffisamment d'espace sur C:\ (1/3 de libre pour être à l'aise))

> Pour bien protéger ton PC :
[1 seul Antivirus] + [1 seul Pare feu] + [Quelques Antispywares] + [Mises à Jour récentes Windows et Logiciels de Protection] + [Utilisation de Firefox -ou autres- (Internet Explorer présente des failles de sécurité qui mettent longtemps avant d'être corrigées mais il faut absolument le conserver pour les mises à jour Windows)] + [Utilisation du PC en mode Invité (= limité). Lors d'une infection en mode administrateur le PC est beaucoup plus vulnérable. Voir ICI]
PS : En fait la meilleure des protections c'est toi même : ce que tu fais avec ton PC : où tu surfes, télécharges...ect....
Les virus utilisent les failles de ton PC pour infecter un système. Info : http://assiste.com.free.fr/p/abc/a/zombies_et_botnets.html

> Quelques liens utiles :
- http://www.commentcamarche.net/faq/sujet 2432 securite proteger un ordinateur contre les malwares d internet
- https://sebsauvage.net/safehex.html
- https://www.zebulon.fr/telechargements/securite/protection-donnees-personnelles/spywareblaster.html (= petit logiciel qui bloque l'installation d'activ-X nuisibles au PC. Fonctionne en arrière plan)

Voila,
Bonne lecture....

A+

Voici rapport Kasper qui dit que pas de logiciel malveillant et ceux analysés saints.
à ce soir merci
-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Thursday, August 28, 2008 8:21:52 AM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.84.2
Dernière mise à jour de la base antivirus Kaspersky : 27/08/2008
Enregistrements dans la base antivirus Kaspersky : 1026698
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
Z:\

Statistiques de l'analyse:
Total d'objets analysés: 206139
Nombre de virus trouvés: 0
Nombre d'objets infectés: 0 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 01:43:25

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\All Users\Application Data\Avg8\emc\Log\emc.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Avg8\Log\avgcore.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Avg8\Log\avglng.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Avg8\Log\avgrs.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Avg8\Log\avgsched.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Avg8\Log\avgwd.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\dscrp\IMG2.JPG.3eea2b1c.mpd L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030625\dscrp\IMG9.JPG.3eea2b60.mpd L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\TempSBE\MSDVRMM_821523251_2079260672_5044 L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\TempSBE\MSDVRMM_821523251_3080192_5049 L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\TempSBE\SBE1.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\TempSBE\SBE2.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\{748FC7E6-B9F9-4A47-A94B-239DDB917BC9}.TmpSBE L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\Documents\TV enregistrée\TempRec\{840015B6-78AA-42D9-AA09-0150BF1C8CE5}.TmpSBE L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\All Users\DRM\drmstore.hds L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\ApplicationHistory\CLI.EXE.c88dbd71.ini.inuse L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\Perflib_Perfdata_484.dat L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Temp\Perflib_Perfdata_c14.dat L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\HP_Administrateur\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temp\Fichiers Internet temporaires\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP14\A0005076.exe L'objet est verrouillé ignoré
C:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP14\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{74F85C62-EF98-4B38-AE93-DF7ECA0A7A41}.crmlog L'objet est verrouillé ignoré
C:\WINDOWS\SchedLgU.Txt L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\ACEEvent.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\IntelDH.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Internet.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\Media Ce.evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
D:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP14\change.log L'objet est verrouillé ignoré
E:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP14\change.log L'objet est verrouillé ignoré
Z:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
Z:\System Volume Information\_restore{512DF77D-45B5-4AE1-9C2A-EC48B0F584C1}\RP14\change.log L'objet est verrouillé ignoré

Analyse terminée.

Ok très bien.

Alors avant de terminer :

> Fais un scan en ligne avec Kaspersky : https://www.kaspersky.fr/?domain=webscanner.kaspersky.fr
N.B. : Le scan ne marche que sous Internet Explorer.
- Commence par connecter tout ton matériel de stockage à ton PC (clés USB, DD amovible...) si possible. Allume les si necessaire.
- Sous Démonstration en ligne, on t'explique la marche à suivre, et pour lancer le scan il faut sélectionner < Exécuter l'analyse en ligne >.
- On va te demander de télécharger un contrôle active x, accepte .
- Dans le menu < Choisissez la cible de l'analyse >, sélectionne < Poste de travail >. Le scan va commencer.
- Poste le rapport qui sera généré stp.
S'il y a un problème, assure toi que les contrôles active x sont bien configurés dans les options internet comme décrit sur ce lien : http://www.inoculer.com/activex.php3
Rappel : le scan est à faire sous Internet Explorer
Tuto ici si problème : http://www.vista-xp.fr/forum/topic109.html

Je te répondrai demain pour la fin (il reste une étape).

Bonne fin de soirée.

Oui g une webcam Philips SPC500NC.
Pour le fichier info.exe je ne trouve rien ni chemin et l'analyse virutotale reste bloquée.

As-tu une webcam de marque Philips et peut être "ToUcam Camera" ?

Pour le fichier Info.exe il me faudrait son chemin : C:\........\Info.exe

A+

Non connais pas Vpro500.exe / je recherche de mon coté.

voici hijackt
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:40:51, on 27/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\QTTask.exe
C:\logiciels télé\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\WINDOWS\VPro500.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPro500.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Boonty Games - Unknown owner - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe (file missing)
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

je n'arrive pas à faire analyser les résultats recherche un fichier.

http://www.virustotal.com/fr/reanalisis.html?46ef785a49ff1a3271c2ddb3ab4e21a6

http://www.virustotal.com/fr/reanalisis.html?e24faa0f5e5e705b342e679d4964a08e

http://www.virustotal.com/fr/reanalisis.html?b374c2b01031fc9326b414ccec5c197c

Re,
parfait pour cela.

Quand tu auras la suite je suis preneur.

A+

DIID
voici rapport combofix
ComboFix 08-08-26.03 - HP_Administrateur 2008-08-27 21:47:45.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1450 [GMT 2:00]
Endroit: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Administrateur\Bureau\CFScript.txt
* Création d'un nouveau point de restauration

FILE ::
C:\WINDOWS\system32\bopircjm.exe
C:\WINDOWS\system32\exmbohuf.exe
C:\WINDOWS\system32\hmbyzylq.exe
C:\WINDOWS\system32\sxyzklot.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\vwrqhklu
C:\Documents and Settings\All Users\Application Data\vwrqhklu\pszqtida.exe
C:\Program Files\duxasze
C:\Program Files\duxasze\WinChk.dll
C:\Program Files\Fichiers communs\BOONTY Shared
C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
C:\WINDOWS\system32\bopircjm.exe
C:\WINDOWS\system32\exmbohuf.exe
C:\WINDOWS\system32\hmbyzylq.exe
C:\WINDOWS\system32\sxyzklot.exe

.
((((((((((((((((((((((((((((( Fichiers créés 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
.

2008-08-27 18:58 . 2008-08-27 18:58 <REP> d-------- C:\Documents and Settings\TÚlia
2008-08-26 22:08 . 2008-08-26 22:08 <REP> d-------- C:\WINDOWS\ERUNT
2008-08-26 22:00 . 2008-08-26 22:24 <REP> d-------- C:\SDFix
2008-08-25 22:13 . 2008-08-25 22:13 <REP> d-------- C:\Documents and Settings\Télia\Application Data\AVGTOOLBAR
2008-08-25 13:32 . 2008-08-25 13:32 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-25 13:32 . 2008-08-25 13:32 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-08-25 13:31 . 2008-08-27 17:29 <REP> d-------- C:\WINDOWS\system32\drivers\Avg
2008-08-25 13:31 . 2008-08-25 13:51 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\AVGTOOLBAR
2008-08-25 13:31 . 2008-08-25 13:31 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-25 13:30 . 2008-08-25 13:32 8,192 --a------ C:\Documents and Settings\AD20E3~1
2008-08-25 13:12 . 2008-08-25 13:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-08-25 13:11 . 2008-08-25 13:11 262,144 --a------ C:\Documents and Settings\ADMINI~4
2008-08-25 13:07 . 2008-08-25 13:07 262,144 --a------ C:\Documents and Settings\ADMINI~3
2008-08-25 12:53 . 2008-08-25 12:53 262,144 --a------ C:\Documents and Settings\ADMINI~2
2008-08-25 12:50 . 2008-08-25 12:50 1,374 --a------ C:\WINDOWS\system32\wpa.bak
2008-08-24 23:33 . 2008-08-24 23:33 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-24 23:33 . 2008-08-24 23:33 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Malwarebytes
2008-08-24 23:33 . 2008-08-24 23:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-24 23:33 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-24 23:33 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 21:57 . 2008-08-24 21:57 <REP> d-------- C:\Program Files\Trend Micro

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-27 16:56 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\OpenOffice.org2
2008-08-26 19:46 --------- d-----w C:\Program Files\Navilog1
2008-08-26 19:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-26 19:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 16:08 --------- d-----w C:\Program Files\Java
2008-07-08 13:43 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-07-08 12:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:31 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 08:28 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:21 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:21 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 247,808 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-14 17:59 272,768 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-13 20:30 4,550 ----a-w C:\WINDOWS\system32\tmp.reg
2008-05-29 07:35 86,528 ----a-w C:\WINDOWS\system32\VACFix.exe
2007-11-28 09:44 282 ----a-w C:\Documents and Settings\mathis\Application Data\wklnhst.dat
2006-12-31 14:45 0 ------w C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
2006-12-25 22:59 251 ----a-w C:\Program Files\wt3d.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 23:35 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"Steam"="d:\steam\steam.exe" [2008-03-29 00:19 1271032]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 21:34 64512]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 15:15 151552]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 19:12 90112]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 23:34 249856]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 03:23 663552]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 00:50 221184]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-01-02 19:25 180269]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01 110592]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-16 01:41 163840]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 09:44 61440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-25 13:31 1177368]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-22 01:56 16261632 C:\WINDOWS\RTHDCPL.EXE]

C:\Documents and Settings\mathis\Menu D‚marrer\Programmes\D‚marrage\
Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-01-02 18:53:44 27136]
PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-01-02 18:53:44 27136]

C:\Documents and Settings\T‚lia\Menu D‚marrer\Programmes\D‚marrage\
Pin.lnk - C:\hp\bin\CLOAKER.EXE [2006-01-02 18:53:44 27136]
PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-01-02 18:53:44 27136]

C:\Documents and Settings\HP_Administrateur\Menu D‚marrer\Programmes\D‚marrage\
OpenOffice.org 2.1.lnk - C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe [2006-11-27 17:45:48 393216]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2004-12-21 21:42:30 45056]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 10:15:56 65588]
VPro500.lnk - C:\WINDOWS\VPro500.exe [2007-04-15 14:31:52 470016]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\steam\\SteamApps\\leo1701\\counter-strike source\\hl2.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\STEAM\\Steam.exe"=
"D:\\STEAM\\SteamApps\\leo1701\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\PC-Doctor 5 for Windows\\pcdrsysinfovideocapture.p5x"=
"D:\\STEAM\\SteamApps\\leo1701\\the ship\\ship.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\\coktel\\ADI5\\TTS\\SpeechCube.exe"=
"D:\\JEUX\\unreal\\FEAR.exe"=
"D:\\STEAM\\SteamApps\\common\\quake 3 arena demo\\quake3.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgui.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgtray.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:shareaza
"6346:UDP"= 6346:UDP:shareaza
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-25 13:31]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-25 13:31]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-25 13:31]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-25 13:32]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-12 05:36]
R3 SPC610NC;Philips SPC500NC Webcam;C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2005-10-13 16:41]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S3 ATIXPGAA;ATIXPGAA;C:\Program Files\PC-Doctor 5 for Windows\ATIXPGAA.SYS []
S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe []
S3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys [2005-10-05 19:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'

2008-08-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2008-08-27 C:\WINDOWS\Tasks\Vérifier les mises à jour de Windows Live Toolbar.job
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-comapisrv - C:\WINDOWS\system32\exmbohuf.exe
HKCU-Run-ProcSmartCom - C:\WINDOWS\system32\hmbyzylq.exe
HKCU-Run-DbMsgWeb - C:\WINDOWS\system32\bopircjm.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 21:48:52
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-08-27 21:49:19
ComboFix-quarantined-files.txt 2008-08-27 19:49:17
ComboFix2.txt 2008-08-27 16:58:49

Pre-Run: 289,140,047,872 octets libres
Post-Run: 289,147,203,584 octets libres

193 --- E O F --- 2008-08-13 21:24:11

Ok,
alors,

> Télécharge ATF Cleaner par Atribune sur ton bureau.
- Démarre ATF-Cleaner et Coche les valeurs suivantes :

Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
Recycle Bin

- Clique sur <Empty Selected> et au message "Done Cleaning" sur <Ok>

NB : Si tu utilises Firefox ou Opera :
- Clique sur Firefox ou Opera en haut puis choisis <Select All>.
- Clique sur le bouton <Empty Selected> (NB : Si tu veux conserver tes mots de passe sauvegardés alors clique sur <No> à l'invite).
- Clique sur <Main> pour revenir à menu principal

- Clique sur <Exit>, du menu prinicipal, pour quitter ATFcleaner.

Ensuite,
/!\ Pour les personnes ayant les mêmes problèmes ou similaires /!\
Cette manip. est spécifique au PC de l'utilisateur ayant créé cette discussion. La reproduire sur un autre ordinateur pourrait endommager le système.

Alors,
> Avec Combofix :
- Crée un nouveau document texte : clic droit de souris sur le bureau => Nouveau => Document Texte, et copie/colle dedans les lignes suivantes :

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] 
"comapisrv"=
"ProcSmartCom"=
"DbMsgWeb"=
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WinChk"=-

File::
C:\WINDOWS\system32\bopircjm.exe 
C:\WINDOWS\system32\hmbyzylq.exe 
C:\WINDOWS\system32\exmbohuf.exe 
C:\WINDOWS\system32\sxyzklot.exe 

Folder::
C:\Program Files\duxasze 
C:\Documents and Settings\All Users\Application Data\vwrqhklu 
C:\Program Files\Fichiers communs\BOONTY Shared

- Enregistre ce fichier sous le nom CFScript (Type du fichier : tous les fichiers)
- Ferme tous tes navigateurs web (donc copie ou imprime les instructions suivantes avant si besoin est).
- Désactive ton antivirus et tes autres protections résidentes (ex : Spybot) si tu en as (c'est important).
- Fait un glisser/déposer de ce fichier CFScript sur le programme ComboFix.exe comme sur cette image.
(Explications du glisser/coller : Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relâche alors le bouton de la souris).
- Combofix va démarrer puis une fenêtre bleue va apparaître. Au message qui s'affiche (Type 1 to continue, or 2 to abort) : tape 1 puis valide.
- Patiente le temps du scan. Le bureau va disparaître à plusieurs reprises: c'est normal !
- Ne touche à rien tant que le scan n'est pas terminé sinon le PC peut planter !
- Une fois le scan achevé, un rapport va s'afficher: poste le stp.
PS : Si le fichier ne s'ouvre pas, il se trouve ici => C:\ComboFix.txt
PS2 : Il peut s'avérer que le rapport Combofix soit trop long pour être supporter par CCM.net. Dans ce cas utilise ce service http://www.cijoint.fr pour me l'envoyer (dépose le fichier puis poste le lien sur le forum).

Après,
> Rends toi sur ce site virustotal et fais analyser le/les fichier(s) suivant(s) stp : (copie/colle la/les ligne(s) dans le cadre "envoyer un fichier")
Si problème : http://pageperso.aol.fr/loraline60/virus_total.htm

C:\Documents and Settings\mathis\Application Data\wklnhst.dat 
C:\WINDOWS\VPro500.exe 
C:\Program Files\wt3d.ini 

et poste le/les résultat(s) par copier/coller stp (ou le/les lien(s) http, c'est plus rapide et préférable).

Ensuite,
> Assure toi d'avoir accès aux fichiers cachés :
Menu démarrer => apparence et thèmes => options des dossiers => affichage
"Afficher les fichiers cachés" => coché
"Masquer les extensions.." => décoché
"Masquer les fichiers protégés du système" => décoché

Vas dans menu démarrer puis rechercher un fichier. Choisis tout type de fichier.
Puis copie/colle :

Info.exe

Ensuite fais le analyser avec chez Virus Total comme les 3 précédents. Poste le rapport stp.

Puis,
Fais ensuite la manip. suivante :
Menu démarrer => apparence et thèmes => options des dossiers => affichage
"Afficher les fichiers cachés" => décoché
"Masquer les extensions.." => coché
"Masquer les fichiers protégés du système" => coché

Pour finir,
poste un nouveau rapport HiJackT stp.

Bon courage,
on a bientôt terminé.

A+

ComboFix 08-08-26.03 - HP_Administrateur 2008-08-27 17:46:26.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1605 [GMT 2:00]
Endroit: C:\Documents and Settings\HP_Administrateur\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@edt02[2].txt
C:\Documents and Settings\HP_Administrateur\Cookies\hp_administrateur@trafiz[2].txt
C:\Documents and Settings\mathis\Application Data\macromedia\Flash Player\#SharedObjects\QEWZZYQV\bin.clearspring.com
C:\Documents and Settings\mathis\Application Data\macromedia\Flash Player\#SharedObjects\QEWZZYQV\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\mathis\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\mathis\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\mathis\Menu Démarrer\Programmes\Antivirus 2008
C:\Documents and Settings\mathis\Menu Démarrer\Programmes\Antivirus 2008\Antivirus-2008.lnk
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\cpbkwgxi.ini
C:\WINDOWS\system32\efjgkbvv.ini
C:\WINDOWS\system32\gpvfyvgb.dll
C:\WINDOWS\system32\ixmupq.dll
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\rscava.dll
C:\WINDOWS\system32\sqoubsic.ini
C:\WINDOWS\system32\vkhxwrmx.dll
E:\Autorun.inf
C:\Documents and Settings\Télia\Cookies\télia@bluestreak[2].txt . . . . Echec de suppression
C:\Documents and Settings\Télia\Cookies\télia@edt02[2].txt . . . . Echec de suppression
C:\Documents and Settings\Télia\Cookies\télia@ehg-dig.hitbox[2].txt . . . . Echec de suppression
C:\Documents and Settings\Télia\Cookies\télia@news.fr.msn[1].txt . . . . Echec de suppression

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-07-27 to 2008-08-27 ))))))))))))))))))))))))))))))))))))
.

2008-08-26 22:08 . 2008-08-26 22:08 <REP> d-------- C:\WINDOWS\ERUNT
2008-08-26 22:00 . 2008-08-26 22:24 <REP> d-------- C:\SDFix
2008-08-25 13:32 . 2008-08-25 13:32 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-08-25 13:32 . 2008-08-25 13:32 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-08-25 13:31 . 2008-08-27 17:29 <REP> d-------- C:\WINDOWS\system32\drivers\Avg
2008-08-25 13:31 . 2008-08-25 13:51 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\AVGTOOLBAR
2008-08-25 13:31 . 2008-08-25 13:31 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-25 13:30 . 2008-08-25 13:32 8,192 --a------ C:\Documents and Settings\AD20E3~1
2008-08-25 13:23 . 2008-08-25 13:23 106,496 --a------ C:\WINDOWS\system32\bopircjm.exe
2008-08-25 13:12 . 2008-08-25 13:31 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avg8
2008-08-25 13:11 . 2008-08-25 13:11 262,144 --a------ C:\Documents and Settings\ADMINI~4
2008-08-25 13:07 . 2008-08-25 13:07 262,144 --a------ C:\Documents and Settings\ADMINI~3
2008-08-25 12:53 . 2008-08-25 12:53 262,144 --a------ C:\Documents and Settings\ADMINI~2
2008-08-25 12:52 . 2008-08-25 12:52 <REP> d-------- C:\Program Files\duxasze
2008-08-25 12:51 . 2008-08-25 12:51 86,016 --a------ C:\WINDOWS\system32\hmbyzylq.exe
2008-08-25 12:50 . 2008-08-25 12:50 1,374 --a------ C:\WINDOWS\system32\wpa.bak
2008-08-24 23:33 . 2008-08-24 23:33 <REP> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-24 23:33 . 2008-08-24 23:33 <REP> d-------- C:\Documents and Settings\HP_Administrateur\Application Data\Malwarebytes
2008-08-24 23:33 . 2008-08-24 23:33 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-24 23:33 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-24 23:33 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-24 21:57 . 2008-08-24 21:57 <REP> d-------- C:\Program Files\Trend Micro
2008-08-22 09:21 . 2008-08-22 09:21 77,824 --a------ C:\WINDOWS\system32\exmbohuf.exe
2008-08-19 14:09 . 2008-08-19 14:09 90,112 --a------ C:\WINDOWS\system32\sxyzklot.exe
2008-08-14 18:52 . 2008-08-14 18:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\vwrqhklu

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-27 15:45 --------- d-----w C:\Documents and Settings\HP_Administrateur\Application Data\OpenOffice.org2
2008-08-26 19:46 --------- d-----w C:\Program Files\Navilog1
2008-08-26 19:39 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-26 19:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 16:08 --------- d-----w C:\Program Files\Java
2008-07-08 13:43 --------- d-----w C:\Program Files\Fichiers communs\Blizzard Entertainment
2008-07-08 12:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\TrackMania
2007-11-28 09:44 282 ----a-w C:\Documents and Settings\mathis\Application Data\wklnhst.dat
2006-12-31 14:45 0 ------w C:\Documents and Settings\HP_Administrateur\Application Data\wklnhst.dat
2006-12-25 22:59 251 ----a-w C:\Program Files\wt3d.ini
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-12 23:35 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"Steam"="d:\steam\steam.exe" [2008-03-29 00:19 1271032]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 17:45 313472]
"comapisrv"="C:\WINDOWS\system32\exmbohuf.exe" [2008-08-22 09:21 77824]
"ProcSmartCom"="C:\WINDOWS\system32\hmbyzylq.exe" [2008-08-25 12:51 86016]
"DbMsgWeb"="C:\WINDOWS\system32\bopircjm.exe" [2008-08-25 13:23 106496]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 21:34 64512]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2006-07-06 15:15 151552]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 19:12 90112]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2005-07-22 23:14 237568]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-15 23:34 249856]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2004-12-14 03:23 663552]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-28 00:50 221184]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2006-01-02 19:25 180269]
"UpdateManager"="C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01 110592]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-16 01:41 163840]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 09:44 61440]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-25 13:31 1177368]
"ftutil2"="ftutil2.dll" [2004-06-07 14:05 106496 C:\WINDOWS\system32\ftutil2.dll]
"RTHDCPL"="RTHDCPL.EXE" [2006-07-22 01:56 16261632 C:\WINDOWS\RTHDCPL.EXE]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableLockWorkstation"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WinChk"= {6D81E840-C806-6346-C1F1-0084446FF1AD} - C:\Program Files\duxasze\WinChk.dll [2008-08-25 12:52 126976]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\steam\\SteamApps\\leo1701\\counter-strike source\\hl2.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\STEAM\\Steam.exe"=
"D:\\STEAM\\SteamApps\\leo1701\\day of defeat source\\hl2.exe"=
"C:\\Program Files\\PC-Doctor 5 for Windows\\pcdrsysinfovideocapture.p5x"=
"D:\\STEAM\\SteamApps\\leo1701\\the ship\\ship.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"D:\\coktel\\ADI5\\TTS\\SpeechCube.exe"=
"D:\\JEUX\\unreal\\FEAR.exe"=
"D:\\STEAM\\SteamApps\\common\\quake 3 arena demo\\quake3.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgui.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgtray.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:shareaza
"6346:UDP"= 6346:UDP:shareaza
"1700:TCP"= 1700:TCP:MioNet Remote Drive Access
"1641:TCP"= 1641:TCP:MioNet Remote Drive Verification

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-25 13:31]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-25 13:31]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-25 13:31]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-25 13:32]
R3 3xHybrid;3xHybrid service;C:\WINDOWS\system32\DRIVERS\3xHybrid.sys [2006-04-12 05:36]
R3 SPC610NC;Philips SPC500NC Webcam;C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2005-10-13 16:41]
R3 usbstor;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-10 13:00]
S3 ATIXPGAA;ATIXPGAA;C:\Program Files\PC-Doctor 5 for Windows\ATIXPGAA.SYS []
S3 Boonty Games;Boonty Games;C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe [2007-06-03 18:39]
S3 WN5301;LIteon Wireless PCI Network Adapter Service;C:\WINDOWS\system32\DRIVERS\wn5301.sys [2005-10-05 19:44]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'

2008-08-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-hlpuiapi - C:\WINDOWS\system32\rodcpixu.exe
HKLM-Run-DMAScheduler - c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe
HKLM-Run-iTunesHelper - C:\logiciels télé\iTunesHelper.exe
HKLM-Run-PCDrProfiler - (no file)
HKLM-Run-SecuUFD - (no file)

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.aliceadsl.fr/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
O8 -: &Windows Live Search - C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 -: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites

O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
C:\WINDOWS\Downloaded Program Files\oscan8.inf
C:\WINDOWS\bdoscandellang.ini
C:\WINDOWS\bdoscandel.exe
C:\WINDOWS\Downloaded Program Files\live.ini
C:\WINDOWS\Downloaded Program Files\scanoptions.tsi
C:\WINDOWS\Downloaded Program Files\lang.ini
C:\WINDOWS\Downloaded Program Files\ipsupd.dll
C:\WINDOWS\Downloaded Program Files\bdupd.dll
C:\WINDOWS\Downloaded Program Files\libfn.dll
C:\WINDOWS\Downloaded Program Files\bdcore.dll
C:\WINDOWS\Downloaded Program Files\oscan8.ocx
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 18:54:15
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\PAStiSvc.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\ELService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\WINDOWS\VPro500.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.bin
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\WINDOWS\system\hpsysdrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-08-27 18:58:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-27 16:58:46

Pre-Run: 286,677,590,016 octets libres
Post-Run: 288,760,758,272 octets libres

225 --- E O F --- 2008-08-13 21:24:11

Salut DIID
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:38:32, on 27/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\QuickTime\QTTask.exe
C:\logiciels télé\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\exmbohuf.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
c:\windows\system\hpsysdrv.exe
C:\WINDOWS\VPro500.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.exe
C:\Program Files\OpenOffice.org 2.1\program\soffice.BIN
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://portail.free.fr/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Alice ADSL
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: (no name) - {09E531B4-FFC3-4D18-9D8D-B077636B961C} - (no file)
O2 - BHO: (no name) - {3651C93D-DEEF-4CDC-9026-17AD87514551} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {b08e19c9-62d0-47b2-a262-038e96a16301} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {CCADEC71-FD5A-4101-9221-292F3F493252} - (no file)
O2 - BHO: (no name) - {D897CA1E-2A4B-474C-92E6-6147B6AEAA7E} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\logiciels télé\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Steam] "d:\steam\steam.exe" -silent
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [hlpuiapi] C:\WINDOWS\system32\rodcpixu.exe
O4 - HKCU\..\Run: [comapisrv] C:\WINDOWS\system32\exmbohuf.exe
O4 - HKCU\..\Run: [ProcSmartCom] C:\WINDOWS\system32\hmbyzylq.exe
O4 - HKCU\..\Run: [DbMsgWeb] C:\WINDOWS\system32\bopircjm.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - .DEFAULT User Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe (User 'Default user')
O4 - Startup: OpenOffice.org 2.1.lnk = C:\Program Files\OpenOffice.org 2.1\program\quickstart.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: VPro500.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - https://onedrive.live.com/?id=favorites
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqemea/downloads/sysinfo.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.bitdefender.fr/scan_fr/scan8/oscan8.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: ixmupq.dll,azhajc.dll,cuvgvr.dll,wvydjg.dll,inugyg.dll,avgrsstx.dll
O21 - SSODL: WinChk - {6D81E840-C806-6346-C1F1-0084446FF1AD} - C:\Program Files\duxasze\WinChk.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Fichiers communs\BOONTY Shared\Service\Boonty.exe
O23 - Service: Intel(R) Quick Resume technology (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology Drivers\Elservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

Bonjour,
en accord avec Benurrr, je prends la suite.

Poste une nouveau rapport HiJackT stp.

Ensuite,
> Télécharge ComboFix : http://download.bleepingcomputer.com/sUBs/ComboFix.exe (par sUBs) sur ton Bureau.
Déconnecte toi du net et désactive ton antivirus pour que Combofix puisse s'exécuter normalement.
- Double clique combofix.exe
- Tape sur la touche 1 (Yes) pour démarrer le scan.
- Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.
NOTE : Le rapport se trouve également ici : C:\Combofix.txt
PS2 : Il peut s'avérer que le rapport Combofix soit trop long pour être supporter par CCM.net. Dans ce cas utilise ce service http://www.cijoint.fr pour me l'envoyer (dépose le fichier puis poste le lien sur le forum).
Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer la machine.

A+

# Rapport Lopxp fait le 27/08/2008 à 0:43:43
# Exécuté dans : C:\Program Files\Lopxp
# Version 3.10 - Maj du 11/04/2008

Killing 'iexplore.exe'
"C:\Program Files\Internet Explorer\iexplore.exe" (1232)

========== Listing des dossiers Application Data

+- C:\Documents and Settings\All Users\Application Data

2007-01-17 à 10:50:21 - Adobe
2008-05-29 à 19:34:14 - Alexandra Ledermann 8
2007-09-21 à 17:30:33 - Apple
2007-09-21 à 17:31:16 - Apple Computer
2008-08-25 à 11:31:45 - Avg8
2007-06-03 à 16:39:28 - BOONTY
2006-01-02 à 17:27:31 - CyberLink
2006-12-25 à 13:23:59 - Google
2006-01-02 à 17:59:05 - Hewlett-Packard
2006-01-02 à 17:25:56 - InstallShield
2008-08-24 à 21:33:04 - Malwarebytes
2008-06-17 à 07:17:22 - Messenger Plus!
2008-05-29 à 19:34:59 - Microsoft
2006-12-25 à 23:05:59 - muvee Technologies
2007-05-12 à 11:27:29 - Muzzy Lane Software
2007-10-17 à 17:33:11 - Otto
2006-01-02 à 17:00:03 - SBSI
2006-01-02 à 17:21:49 - Sonic
2008-08-26 à 19:37:46 - Spybot - Search & Destroy
2006-12-25 à 11:23:26 - Symantec
2008-07-08 à 12:50:06 - TrackMania
2008-08-14 à 16:52:25 - vwrqhklu
2006-12-27 à 02:03:13 - Windows Genuine Advantage
2007-10-19 à 20:04:43 - Windows Live Toolbar

+- C:\Documents and Settings\HP_Administrateur\Application Data

2008-04-16 à 20:17:03 - Adobe
2008-05-12 à 19:08:51 - AdobeUM
2007-04-18 à 09:15:38 - Apple Computer
2007-04-15 à 12:41:22 - ArcSoft
2006-01-02 à 17:20:06 - ATI
2008-08-25 à 11:51:49 - AVGTOOLBAR
2007-01-28 à 10:07:56 - CyberLink
2007-08-20 à 19:50:29 - Earthsim
2007-01-01 à 15:33:55 - Google
2008-06-08 à 22:03:58 - Help
2008-02-16 à 22:25:23 - Hewlett-Packard
2006-12-24 à 23:36:53 - HP
2006-12-24 à 23:06:22 - HPQ
2005-11-15 à 02:22:38 - Identities
2006-12-31 à 14:39:33 - Leadertech
2006-12-25 à 13:23:44 - Macromedia
2008-08-24 à 21:33:14 - Malwarebytes
2008-08-25 à 11:30:06 - Microsoft
2007-11-27 à 20:59:05 - Microsoft Web Folders
2007-07-08 à 21:07:55 - MSNInstaller
2007-02-24 à 09:38:48 - muvee Technologies
2008-08-26 à 20:26:44 - OpenOffice.org2
2006-01-02 à 17:25:10 - Real
2007-01-17 à 11:04:39 - Shareaza
2006-12-31 à 14:39:50 - Sonic
2007-01-03 à 15:23:16 - Sun
2006-12-31 à 14:45:35 - Template
2007-01-01 à 18:03:12 - Toshiba

+- C:\Documents and Settings\HP_Administrateur\Local Settings\Application Data

2006-12-25 à 11:56:48 - Adobe
2007-09-21 à 21:07:55 - Apple Computer
2008-08-25 à 17:55:24 - ApplicationHistory
2006-01-02 à 17:20:06 - ATI
2007-06-16 à 16:25:37 - DVDPlay
2006-12-25 à 13:28:39 - Google
2008-06-08 à 22:03:58 - Help
2006-12-24 à 23:36:47 - HP
2006-12-25 à 13:55:14 - Identities
2006-12-24 à 23:36:52 - IsolatedStorage
2008-08-25 à 11:30:06 - Microsoft
2007-07-02 à 23:56:19 - MicroVision Applications
2007-01-17 à 11:04:39 - Shareaza
2007-09-14 à 21:08:59 - Steam
2006-12-27 à 21:15:42 - Toshiba
2006-01-02 à 17:01:36 - {3248F0A6-6813-11D6-A77B-00B0D0150060}

+- C:\Documents and Settings\mathis\Application Data

2008-04-17 à 08:07:16 - Adobe
2007-02-28 à 19:07:29 - AdobeUM
2008-03-17 à 19:50:33 - Apple Computer
2008-04-27 à 11:00:31 - ArcSoft
2006-01-02 à 17:20:06 - ATI
2006-12-26 à 17:48:28 - Google
2007-03-05 à 20:42:50 - HP
2007-01-14 à 09:50:01 - HPQ
2005-11-15 à 02:22:38 - Identities
2007-12-25 à 11:20:49 - InstallShield
2006-12-25 à 14:31:42 - InstallShield Installation Information
2007-05-02 à 15:12:18 - Macromedia
2008-08-25 à 11:30:06 - Microsoft
2007-11-21 à 19:13:32 - MySpace
2007-10-17 à 17:33:11 - Otto
2007-02-20 à 10:20:41 - Real
2007-03-05 à 20:41:39 - Sonic
2007-02-04 à 19:03:37 - Sun
2007-09-23 à 14:07:01 - Template
2007-01-01 à 17:12:05 - Toshiba

+- C:\Documents and Settings\mathis\Local Settings\Application Data

2007-02-07 à 17:59:39 - Adobe
2007-09-21 à 17:30:47 - Apple
2007-01-03 à 19:59:02 - Apple Computer
2008-08-19 à 14:18:42 - ApplicationHistory
2006-01-02 à 17:20:06 - ATI
2007-05-17 à 16:45:45 - capcom
2006-12-25 à 15:19:30 - Google
2007-03-05 à 20:42:43 - HP
2007-03-18 à 14:13:16 - Identities
2007-03-05 à 20:42:49 - IsolatedStorage
2008-08-25 à 11:30:06 - Microsoft
2007-08-25 à 19:18:05 - Oblivion
2007-09-14 à 16:56:35 - Steam
2006-12-27 à 22:31:53 - Toshiba
2007-05-05 à 22:11:39 - WMTools Downloaded Files
2006-01-02 à 17:01:36 - {3248F0A6-6813-11D6-A77B-00B0D0150060}

+- C:\Documents and Settings\T‚lia\Application Data

2008-04-17 à 18:30:40 - Adobe
2007-11-30 à 20:21:41 - Apple Computer
2006-01-02 à 17:20:06 - ATI
2008-08-25 à 20:13:55 - AVGTOOLBAR
2007-01-07 à 21:11:52 - Google
2006-12-25 à 23:14:16 - Hewlett-Packard
2007-11-15 à 18:45:26 - HP
2006-12-25 à 17:56:42 - HPQ
2005-11-15 à 02:22:38 - Identities
2008-05-30 à 20:02:06 - InstallShield
2006-12-26 à 23:13:12 - Macromedia
2008-08-25 à 11:30:06 - Microsoft
2007-07-08 à 21:35:25 - MSNInstaller
2006-12-25 à 23:07:03 - muvee Technologies
2006-01-02 à 17:25:10 - Real
2008-05-07 à 11:38:55 - Shareaza
2008-05-29 à 21:17:52 - Sonic
2007-02-01 à 16:21:12 - Sun

+- C:\Documents and Settings\T‚lia\Local Settings\Application Data

2007-01-07 à 22:42:38 - Adobe
2007-11-07 à 17:56:00 - Apple
2007-02-06 à 16:51:41 - Apple Computer
2008-08-14 à 10:34:53 - ApplicationHistory
2006-01-02 à 17:20:06 - ATI
2006-12-25 à 18:36:53 - Google
2006-12-25 à 23:14:13 - HP
2007-02-01 à 18:35:47 - Identities
2007-11-15 à 18:45:24 - IsolatedStorage
2008-08-25 à 11:30:06 - Microsoft
2008-05-07 à 11:38:55 - Shareaza
2006-12-29 à 12:42:17 - Toshiba
2006-01-02 à 17:01:36 - {3248F0A6-6813-11D6-A77B-00B0D0150060}

========== Listing du dossier Program Files

+- C:\Program Files

2006-01-02 à 17:30:27 - Adobe
2007-05-23 à 19:51:04 - AGEIA Technologies
2008-06-09 à 13:42:06 - Alice
2006-12-25 à 13:39:07 - Alwil Software
2007-09-21 à 17:30:46 - Apple Software Update
2007-01-02 à 23:07:07 - ATI Technologies
2008-06-08 à 17:58:20 - AVG
2007-06-03 à 16:39:09 - Boonty
2007-06-03 à 16:39:10 - BoontyGames
2008-06-06 à 11:13:20 - Cheat Engine
2007-01-07 à 16:07:56 - Common Files
2005-11-12 à 00:09:16 - ComPlus Applications
2006-01-02 à 17:30:14 - DivX
2007-07-03 à 14:48:41 - Dofus
2008-08-25 à 10:52:38 - duxasze
2006-01-02 à 17:43:13 - EasyBits
2008-07-08 à 13:43:56 - Fichiers communs
2006-01-02 à 16:57:05 - FrenchOtto
2007-01-28 à 22:13:22 - Google
2006-01-02 à 17:42:50 - Hewlett-Packard
2006-01-02 à 17:27:19 - HP
2008-05-30 à 20:02:23 - InstallShield Installation Information
2006-01-02 à 17:15:12 - Intel
2008-08-13 à 21:17:01 - Internet Explorer
2008-05-29 à 20:28:25 - iPod
2008-07-25 à 16:08:08 - Java
2008-08-26 à 22:44:07 - Lopxp
2006-01-02 à 17:17:58 - MainConcept
2008-08-24 à 21:33:09 - Malwarebytes' Anti-Malware
2008-08-13 à 21:23:50 - Messenger
2008-06-16 à 17:38:14 - Messenger Plus! Live
2007-10-20 à 18:18:16 - Microsoft CAPICOM 2.1.0.2
2005-11-15 à 02:24:46 - microsoft frontpage
2007-05-04 à 18:28:15 - Microsoft IntelliPoint
2007-11-27 à 20:59:05 - Microsoft Office
2007-11-27 à 21:01:01 - Microsoft Visual Studio
2006-01-02 à 17:28:24 - Microsoft Works
2005-11-15 à 02:24:52 - Movie Maker
2007-07-08 à 21:06:36 - MSN
2005-11-15 à 02:25:02 - MSN Gaming Zone
2008-06-16 à 17:38:14 - MSN Messenger
2006-12-27 à 02:01:22 - MSXML 4.0
2006-01-02 à 17:29:47 - muvee Technologies
2008-08-26 à 19:46:59 - Navilog1
2005-11-15 à 02:25:12 - NetMeeting
2005-11-15 à 02:25:12 - Online Services
2007-01-06 à 22:22:10 - OpenOffice.org 2.1
2007-06-14 à 21:24:21 - Outlook Express
2007-05-29 à 19:45:42 - PC-Doctor 5 for Windows
2007-04-15 à 12:31:52 - Philips
2008-06-08 à 22:04:49 - QuickTime
2006-01-02 à 17:25:01 - Real
2006-01-02 à 17:44:44 - Services en ligne
2006-12-31 à 18:00:23 - Sonic
2008-08-26 à 19:39:42 - Spybot - Search & Destroy
2006-12-28 à 22:48:43 - Toshiba
2008-08-24 à 19:57:37 - Trend Micro
2007-04-24 à 11:53:51 - TurnTool
2008-05-30 à 20:02:24 - Ubisoft
2005-11-12 à 00:09:06 - Uninstall Information
2007-10-30 à 22:42:36 - VVSN
2008-06-16 à 17:38:14 - Windows Live
2007-11-30 à 19:50:34 - Windows Live Favorites
2007-11-30 à 19:50:46 - Windows Live Toolbar
2007-03-01 à 21:02:16 - Windows Media Connect 2
2007-03-01 à 21:02:15 - Windows Media Player
2005-11-15 à 02:25:24 - Windows NT
2005-11-15 à 02:25:58 - Windows Plus
2005-11-12 à 00:09:02 - WindowsUpdate
2005-11-15 à 02:26:08 - xerox
2007-01-02 à 22:49:48 - zz downloads

========== Tâches planifiées

AppleSoftwareUpdate.job: C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task
Vérifier les mises à jour de Windows Live Toolbar.job: C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE

========== Clés registre

========== Bloqueur popups Internet Explorer

www.precious-boy.com
webmail1a.orange.fr
concerts.wolfgangsvault.com

========== Suggestion ( /!\ Nécessite une interprétation.) ==========

+- Dossiers\Fichiers : Aucune suggestion.

+- Registre : Aucune suggestion.

- Fin du rapport -

Le lien https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/LopSD.exe?attachauth=ANoY7co3ntqUavpZ3q1BG-h4pc13vqDZmhcNeEPChtsyrgAykRbhE8bZzhk979EfQD4AgwtQUHCaQ7ZQwNYMo3_0kA8htAspckDJtu2K5t6J9z6dLW4fpZyH4FpFL1tVMBZ8H-KnN7afZ5vt-WxZRpnynk-a0XmV_Y0C0q6DxGEDKie1TnPT7gFoZnoCnspzBmbW6ZzxA4fNr3oEDlbelNZON-LjF8nOmQ%3D%3D&attredirects=2 ne fonctionne pas.
au fait c "windows security alert" qui dit que infecté par "Troyan-Downloader.Win32.Agent.bq"

salut Benurrr

voici le rapport sdfix, mais dès la première connexion pour te l'envoiyer la fenetre "Windows securiity report" apparait et me revele la fausse présence d'un pb type spyware.

[b]SDFix: Version 1.219 [/b]
Run by HP_Administrateur on 26/08/2008 at 22:11

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt17.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt21.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt29.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt35.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt37.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt39.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt3B.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt3D.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt3F.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt41.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt43.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt45.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt47.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt49.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt4B.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt4D.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt4F.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt51.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt53.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt55.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt57.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt59.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt5B.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt5D.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt5F.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt61.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt63.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt65.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt67.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt69.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt6B.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt6D.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt6F.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt71.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt73.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt75.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt77.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt79.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt8.tmp - Deleted
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\.tt8.tmp.vbs - Deleted

Folder C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\privacy_danger - Removed

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,

http://www.gmer.net
Rootkit scan 2008-08-26 22:20:35
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolic

y\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,

-22019"
"D:\\JEUX\\splinter cell\\Splinter Cell Pandora Tomorrow\\pandora.exe"="D:\\JEUX\\splinter

cell\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:pandora"
"D:\\steam\\SteamApps\\leo1701\\counter-strike

source\\hl2.exe"="D:\\steam\\SteamApps\\leo1701\\counter-strike

source\\hl2.exe:*:Enabled:hl2"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network

Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program

Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program

Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\AOL 9.0\\waol.exe"="C:\\Program Files\\AOL 9.0\\waol.exe:*:Disabled:AOL

France"
"D:\\STEAM\\Steam.exe"="D:\\STEAM\\Steam.exe:*:Enabled:Steam"
"D:\\STEAM\\SteamApps\\leo1701\\day of defeat

source\\hl2.exe"="D:\\STEAM\\SteamApps\\leo1701\\day of defeat

source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\PC-Doctor 5 for Windows\\pcdrsysinfovideocapture.p5x"="C:\\Program

Files\\PC-Doctor 5 for

Windows\\pcdrsysinfovideocapture.p5x:*:Enabled:pcdrsysinfovideocapture"
"C:\\Program Files\\TrackMania Nations ESWC\\TmNationsESWC.exe"="C:\\Program

Files\\TrackMania Nations ESWC\\TmNationsESWC.exe:*:Disabled:TmNationsESWC"
"C:\\Program Files\\TrackMania Sunrise Extreme Demo\\TmSunriseExtremeDemo.exe"="C:\\Program

Files\\TrackMania Sunrise Extreme

Demo\\TmSunriseExtremeDemo.exe:*:Disabled:TmSunriseExtremeDemo"
"D:\\JEUX\\GRAW.exe"="D:\\JEUX\\GRAW.exe:*:Disabled:GRAW"
"D:\\JEUX\\unreal\\System\\UnrealTournament.exe"="D:\\JEUX\\unreal\\System\\UnrealTournamen

t.exe:*:Disabled:UnrealTournament"
"D:\\STEAM\\SteamApps\\leo1701\\the ship\\ship.exe"="D:\\STEAM\\SteamApps\\leo1701\\the

ship\\ship.exe:*:Disabled:ship"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN

Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN

Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\logiciels t‚l‚\\iTunes.exe"="C:\\logiciels t‚l‚\\iTunes.exe:*:Enabled:iTunes"
"D:\\coktel\\ADI5\\TTS\\SpeechCube.exe"="D:\\coktel\\ADI5\\TTS\\SpeechCube.exe:*:Enabled:SP

eechCube"
"D:\\JEUX\\unreal\\FEAR.exe"="D:\\JEUX\\unreal\\FEAR.exe:*:Enabled:FEAR"
"D:\\eMule\\emule.exe"="D:\\eMule\\emule.exe:*:Disabled:eMule"
"D:\\STEAM\\SteamApps\\common\\quake 3 arena

demo\\quake3.exe"="D:\\STEAM\\SteamApps\\common\\quake 3 arena

demo\\quake3.exe:*:Disabled:quake3"
"C:\\Program Files\\AVG\\AVG8\\avgui.exe"="C:\\Program

Files\\AVG\\AVG8\\avgui.exe:*:Enabled:AVG Free User Interface"
"C:\\Program Files\\AVG\\AVG8\\avgtray.exe"="C:\\Program

Files\\AVG\\AVG8\\avgtray.exe:*:Enabled:AVG Free Tray Icon"
"D:\\programmes\\eMule\\emule.exe"="D:\\programmes\\eMule\\emule.exe:*:Disabled:eMule"
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"="C:\\Program

Files\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"="C:\\Program

Files\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolic

y\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,

-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network

Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN

Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN

Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 25 Dec 2006 211 ..SHR --- "C:\BOOT.BAK"
Thu 1 Mar 2007 0 A.SH. --- "C:\Documents and Settings\All

Users\DRM\Cache\Indiv01.tmp"
Wed 27 Dec 2006 5,741,210 A..H. --- "C:\Documents and Settings\mathis\Local

Settings\Temp\dn2C2.tmp"
Mon 12 May 2008 214,016 A..H. --- "C:\Documents and Settings\mathis\Local

Settings\Temp\~3A.tmp"
Sun 29 Jun 2008 214,016 A..H. --- "C:\Documents and Settings\mathis\Local

Settings\Temp\~44.tmp"
Mon 26 Feb 2007 122,880 A..H. --- "C:\Documents and Settings\mathis\Local

Settings\Temp\~5.tmp"
Sun 28 Oct 2007 20,233,232 A..H. --- "C:\Documents and Settings\T‚lia\Local

Settings\Temp\BIT5.tmp"
Wed 7 May 2008 0 A..H. ---

"C:\WINDOWS\SoftwareDistribution\Download\24af2a69c06a4de03e35dc89d706475f\BIT22.tmp"
Mon 25 Dec 2006 9,506 ..SH. --- "C:\Documents and Settings\All Users\Documents\Ma

musique\music ancien ordi\Sauvegarde de la licence\drmv2key.bak"
Tue 26 Aug 2008 5,940 A.SH. --- "C:\Documents and Settings\All Users\Documents\TV

enregistr‚e\TempRec\TempSBE\SBE1.tmp"
Tue 26 Aug 2008 5,686 A.SH. --- "C:\Documents and Settings\All Users\Documents\TV

enregistr‚e\TempRec\TempSBE\SBE2.tmp"

[b]Finished![/b]

Bonjour Benurrr

Aie!!!!
Tout fait sauf en mode sans echec car après sacn MAlware au re-démarrage plus de Windows!?!? il m'était proposé d'activer une copie de Windows/ ce que j'ai fait. Donc AVG plus reconnu car N° de licence autre. AVG réinstallé ce midi. Problème idem plus autre fenetre louche "windows warning message" avec 2 spyware identifiés : "virtumonde et privacyremover".

Que dois-je faire???

Voila le rapport maware avant ré-ouverture window.

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1083
Windows 5.1.2600 Service Pack 2

00:06:17 25/08/2008
mbam-log-08-25-2008 (00-06-17).txt

Type de recherche: Examen rapide
Eléments examinés: 97372
Temps écoulé: 26 minute(s), 30 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 10
Clé(s) du Registre infectée(s): 24
Valeur(s) du Registre infectée(s): 9
Elément(s) de données du Registre infecté(s): 4
Dossier(s) infecté(s): 82
Fichier(s) infecté(s): 122

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
C:\WINDOWS\system32\byXNeBsP.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\tbqfkbhs.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\unaxkjpb.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\vvrcjcju.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\azhajc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cuvgvr.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wvydjg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\rllrupmw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\hkarse.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\inugyg.dll (Trojan.Vundo) -> Delete on reboot.

Clé(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{661778f7-cdda-4611-99b0-43245c7e971d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbxpfewq (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{661778f7-cdda-4611-99b0-43245c7e971d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc5585f4-a918-4caf-ab5b-8bae13938f3e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{cc5585f4-a918-4caf-ab5b-8bae13938f3e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ccadec71-fd5a-4101-9221-292f3f493252} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{ccadec71-fd5a-4101-9221-292f3f493252} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\logons (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\typelib (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\iTunesMusic (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\currentcontrolset\Services\rdriv (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nmwegbsf.btxe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\nmwegbsf.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\30f7739c (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphc5kqj0eefp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\erpobmsw (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\byxnebsp -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\byxnebsp -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Dossier(s) infecté(s):
C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\BrowserObjects (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\AXPDefender\AXPDefender\Quarantine\Packages (Rogue.AdvancedXPDefender) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\BrowserObjects (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\AXPFixer\AXPFixer\Quarantine\Packages (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKCU\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\HKLM\RunOnce (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuAllUsers (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Autorun\StartMenuCurrentUser (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\BrowserObjects (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\AXPFixer\AXPFixer\Quarantine\Packages (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\rhc1kqj0eefp\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\shc3kqj0eefp\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Application Data\shc3kqj0eefp\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Application Data\shc3kqj0eefp\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\WINDOWS\system32\cbXPfEWQ.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\inugyg.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\byXNeBsP.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\PsBeNXyb.ini (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\PsBeNXyb.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\aucsdyxc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cxydscua.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cmbgydyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iydygbmc.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gequeokd.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dkoeuqeg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gqkrceth.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\htecrkqg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\pmpvjqsa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\asqjvpmp.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qftejcrc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\crcjetfq.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tbqfkbhs.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\shbkfqbt.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\unaxkjpb.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\bpjkxanu.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vvrcjcju.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\ujcjcrvv.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wgkhovdj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jdvohkgw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wiqmiqjy.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yjqimqiw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wqjtfajm.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mjaftjqw.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xwkjlomg.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gmoljkwx.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ygjrjpns.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\snpjrjgy.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\azhajc.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\cuvgvr.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\wvydjg.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\rllrupmw.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\hkarse.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\system32\dmfljm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ejofph.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\erdclodh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\gahdsvct.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\krrqyuks.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lffmvj.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lsmyslee.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mlsqobvn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mnsfiybl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nigkxu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ofqcfdtd.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qktpeqnl.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rgntjx.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\srefbtiq.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\srlktv.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sydgrhcm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\walwgm.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wiebjg.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fdvwnana.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fomohh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\xyjxltpc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Local Settings\Temporary Internet Files\Content.IE5\CJ02ZNWY\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Local Settings\Temporary Internet Files\Content.IE5\ZE6AYXZ4\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Local Settings\Temporary Internet Files\Content.IE5\25I1WGDT\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Local Settings\Temporary Internet Files\Content.IE5\8BNEG86I\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\UUHUQ5VP\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\HP_Administrateur\Local Settings\Temporary Internet Files\Content.IE5\C4DPYDWH\kb767887[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\smp\msrc.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Bureau\Antivirus XP 2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\oembios.dat (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\akttzn.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\anticipator.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\awtoolb.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bdn.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\bsva-egihsg52.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dpcproxy.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\emesx.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hoproxy.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hxiwlgpm.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\medup012.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msgp.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msnbho.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mssecu.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\msvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mtr2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mwin32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\netode.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\newsd32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ps1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psof1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\psoft1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\regc64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\regm64.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Rundl1.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sncntr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssurf022.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ssvchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysreq.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\taack.dat (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\taack.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\temp#01.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\thun.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\thun32.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\VBIEWER.OCX (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vcatchpi.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winlogonpc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winsystem.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\WINWGPX.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vbsys2.dll (Trojan.Clicker) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\E.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\mathis\Bureau\Antivirus-2008.lnk (Rogue.Antivirus) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Application Data\Microsoft\Internet Explorer\Quick Launch\AXPFixer.lnk (Rogue.AdvancedXPFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Télia\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.