Virus win32:BHO-SI

non, je n'ai pas mis VISTA, toujours XP.

Re,

C'est bizarre
As-tu mis Vista sur ton PC ?

Essaie ceci :

1. Naviguez jusqu'au dossier C:\Program Files\Avira\AntiVir PersonalEdition Classic (Via "Poste de travail" --> Disque C --> Program Files --> Avira --> antivir PersonalEdition Classic)
2. Faites un clic droit sur le fichier avnotify.exe-> Propriétés -> Sécurité
3. Cliquez sur l'utilisateur SYSTEM
4. En bas, cochez la case « refuser » sur la ligne "Lecture & Execution"

Al.

QUESTION :

Depuis l'installation de Antivir, voila un message qui revient regulierement a chaque update... quelqu'un a t'il une explication ?
Le message :
"The file size of avnotify.exe has been changed! This could be due to a virus! Do you want to shut down setup?"

Et aucune autre solution que de cliquer sur "OK"

pb Picasa réglé. C'etait du a l'activation du filtrage "publicité" dans le firewall.

bon, je vais voir.
Depuis toutes ces operation, je trouve que sur les 2 pc traités quelques trucs vont plus doucement, genre ouverture de page internet, ...
Autre truc, impossible dorenavant de voir les images sur le web de picasa... c'est lié tu crois ???

Re,

Cit. « Pour combofix, j'ai lu quelques tuto, »

Non, je ne veux pas entendre te diminuer de la sorte !
Oublie les tutos que tu as lus, et fais comme je le demande.
Tout le monde sait le faire ... donc, toi aussi.

Demande si quelque chose ne va pas.
Je vais passer au lit.

Al.

j'ai du lancer a plusieur reprise Tcleaners, puis il a fait sont travail a la fin.

Pour combofix, j'ai lu quelques tuto, et je dois dire que je ne me sens pas suffisamment expert pour ca. Est vraiment indispensable, apres tout ce que l'on a fait ?

(suite)

Que s'est-il passé ?

N'oublie pas combofix.exe sur le PC de Madame.

Bonne nuit
Al.

ok ca fonctionne

sur le 2eme PC traité, TCleaner ne repond pas lorsqu'il est lancé... quid ??

rapport antivir :

Avira AntiVir Personal
Report file date: dimanche 31 août 2008 19:25

Scanning for 1583963 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Boot mode: Save mode
Username: pc
Computer name: SNNECCI

Version information:
BUILD.DAT : 8.1.0.331 16934 Bytes 12/08/2008 11:46:00
AVSCAN.EXE : 8.1.4.7 315649 Bytes 26/06/2008 08:57:53
AVSCAN.DLL : 8.1.4.0 40705 Bytes 26/05/2008 07:56:40
LUKE.DLL : 8.1.4.5 164097 Bytes 12/06/2008 12:44:19
LUKERES.DLL : 8.1.4.0 12033 Bytes 26/05/2008 07:58:52
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 10:33:34
ANTIVIR1.VDF : 7.0.5.1 8182784 Bytes 24/06/2008 13:54:15
ANTIVIR2.VDF : 7.0.6.60 2802176 Bytes 24/08/2008 15:37:15
ANTIVIR3.VDF : 7.0.6.93 209920 Bytes 30/08/2008 15:37:16
Engineversion : 8.1.1.23
AEVDF.DLL : 8.1.0.5 102772 Bytes 25/02/2008 09:58:21
AESCRIPT.DLL : 8.1.0.68 315770 Bytes 31/08/2008 15:37:23
AESCN.DLL : 8.1.0.23 119156 Bytes 10/07/2008 12:44:49
AERDL.DLL : 8.1.0.20 418165 Bytes 24/04/2008 12:37:48
AEPACK.DLL : 8.1.2.1 364917 Bytes 15/07/2008 12:58:35
AEOFFICE.DLL : 8.1.0.22 192890 Bytes 31/08/2008 15:37:22
AEHEUR.DLL : 8.1.0.50 1388918 Bytes 31/08/2008 15:37:21
AEHELP.DLL : 8.1.0.15 115063 Bytes 10/07/2008 12:44:48
AEGEN.DLL : 8.1.0.36 315764 Bytes 31/08/2008 15:37:18
AEEMU.DLL : 8.1.0.7 430452 Bytes 31/07/2008 08:33:21
AECORE.DLL : 8.1.1.8 172406 Bytes 31/07/2008 08:33:21
AEBB.DLL : 8.1.0.1 53617 Bytes 10/07/2008 12:44:48
AVWINLL.DLL : 1.0.0.12 15105 Bytes 09/07/2008 08:40:05
AVPREF.DLL : 8.0.2.0 38657 Bytes 16/05/2008 09:28:01
AVREP.DLL : 8.0.0.2 98344 Bytes 31/08/2008 15:37:17
AVREG.DLL : 8.0.0.1 33537 Bytes 09/05/2008 11:26:40
AVARKT.DLL : 1.0.0.23 307457 Bytes 12/02/2008 08:29:23
AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 12/06/2008 12:27:49
SQLITE3.DLL : 3.3.17.1 339968 Bytes 22/01/2008 17:28:02
SMTPLIB.DLL : 1.2.0.23 28929 Bytes 12/06/2008 12:49:40
NETNT.DLL : 8.0.0.1 7937 Bytes 25/01/2008 12:05:10
RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 12/06/2008 13:48:07
RCTEXT.DLL : 8.0.52.0 86273 Bytes 27/06/2008 13:34:37

Configuration settings for the scan:
Jobname..........................: Manual Selection
Configuration file...............: C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\PROFILES\folder.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:, D:,
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: dimanche 31 août 2008 19:25

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
11 processes with 11 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan the registry.
The registry was scanned ( '56' files ).

Starting the file scan:

Begin scan in 'C:\' <HDD>
C:\pagefile.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'
Search path D:\ could not be opened!
System error [21]: Le périphérique n'est pas prêt.

End of the scan: dimanche 31 août 2008 20:29
Used time: 1:03:28 Hour(s)

The scan has been done completely.

5392 Scanning directories
331953 Files were scanned
0 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
0 files were moved to quarantine
0 files were renamed
1 Files cannot be scanned
331952 Files not concerned
7503 Archives were scanned
1 Warnings
0 Notes

Euh8
Un petit remords.

Télécharge combofix.exe http://download.bleepingcomputer.com/sUBs/ComboFix.exe de sUBs et sauvegarde le sur ton bureau (et pas ailleurs).

• Assure toi que tous les programmes sont fermés avant de commencer.
• ==> Déconnecte ton PC d'Internet et referme les fenêtres de tous les programmes en cours.
• ==> Désactive provisoirement (et seulement le temps de l'utilisation de ComboFix), la protection en temps réel de ton Antivirus et de ton Antispywares, (activés, ils pourraient gêner fortement la procédure de recherche et de nettoyage de l'outil).
• Double-clique combofix.exe afin de l'exécuter.
• Clique sur "Oui" au message de Limitation de Garantie qui s'affiche.
• Il est possible que ton pare-feu (firewall) te demande si tu acceptes ou non l'accès de nircmd.cfexe à la zone sûre: accepte.
• Ou bien --> Réponds oui au message d'avertissement, pour que le programme commence à procéder à l'analyse du pc.
• Ne ferme pas la fenêtre qui vient de s'ouvrir, tu te retrouverais avec un bureau vide.
• Laisse se dérouler le scan.
• /!\ Pendant la durée de cette étape, ne te sers pas du pc et n'ouvre aucun programme. Soit patient (même si tu penses que le PC est arrêté) ; les temps « d'arrêt apparent » sont parfois de plusieurs minutes (il y a ± 40 étapes d’analyse)./i\
• Lorsque l'analyse sera terminée, un rapport apparaîtra.
• Copie-colle ce rapport dans ta prochaine réponse.
• Le rapport se trouve dans : C:\Combofix.txt (si jamais).

Merci
Al.

OK Very good.
Thanks
Good luck

Al

rapport lopR sans echec :
Al, tu peux me confirmer su'apparement, y'a rien a supprimer ?

--------------------\\ Lop S&D 4.2.3-8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : AMD Turion(tm) 64 Mobile Technology ML-28 )
BIOS : Insyde Software MobilePRO BIOS Version 4.20.10
USER : pc ( Administrator )
BOOT : Fail-safe boot
Antivirus : avast! antivirus 4.7.1098 [VPS 080830-0] 4.7.1098 (Activated)

"C:\Lop SD" ( MAJ : 31-08-2008|15:45 )
Option : [2] ( 31/08/2008|17:08 )

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ SUPPRESSION

Supprime! - C:\DOCUME~1\pc\Cookies\pc@advertstream[1].txt
Supprime! - C:\DOCUME~1\pc\Cookies\pc@advertising[2].txt
Supprime! - C:\DOCUME~1\pc\Cookies\pc@adopt.euroclick[1].txt
-
[ Fichier Hosts ] .. Restaure!

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

Supprime! - C:\Program Files\Viewpoint
Supprime! - C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint

\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

--------------------\\ Listing des dossiers dans APPLIC~1

[01/07/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[01/07/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[17/09/2006|12:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[16/08/2004|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[31/08/2008|15:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[31/08/2008|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[01/12/2007|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/07/2006|21:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[01/07/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[28/02/2007|22:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[15/05/2007|22:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar

[16/08/2004|17:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

[30/03/2008|17:02] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[13/07/2007|07:52] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[01/07/2006|15:31] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec

[29/08/2008|19:16] C:\DOCUME~1\pc\APPLIC~1\Adobe
[18/10/2007|16:14] C:\DOCUME~1\pc\APPLIC~1\AdobeUM
[26/08/2006|21:06] C:\DOCUME~1\pc\APPLIC~1\CyberLink
[16/08/2004|17:55] C:\DOCUME~1\pc\APPLIC~1\desktop.ini
[05/07/2007|23:31] C:\DOCUME~1\pc\APPLIC~1\GDIPFONTCACHEV1.DAT
[05/06/2007|21:44] C:\DOCUME~1\pc\APPLIC~1\Google
[01/07/2006|21:38] C:\DOCUME~1\pc\APPLIC~1\Identities
[01/07/2006|15:44] C:\DOCUME~1\pc\APPLIC~1\Macromedia
[31/08/2008|12:42] C:\DOCUME~1\pc\APPLIC~1\Malwarebytes
[05/06/2007|21:41] C:\DOCUME~1\pc\APPLIC~1\Microsoft
[31/08/2008|14:59] C:\DOCUME~1\pc\APPLIC~1\OpenOffice.org2
[25/08/2006|17:20] C:\DOCUME~1\pc\APPLIC~1\Real
[01/07/2006|21:38] C:\DOCUME~1\pc\APPLIC~1\Sun
[01/07/2006|13:20] C:\DOCUME~1\pc\APPLIC~1\Symantec
[01/05/2008|20:34] C:\DOCUME~1\pc\APPLIC~1\U3
[08/06/2008|18:03] C:\DOCUME~1\pc\APPLIC~1\vlc
[01/07/2006|21:38] C:\DOCUME~1\pc\APPLIC~1\You've Got Pictures Screensaver

[04/09/2007|23:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[31/08/2008 15:09][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
[01/07/2006 12:52][--a------] C:\WINDOWS\tasks\Rappel d'enregistrement 3.job
[31/08/2008 17:03][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 14:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[01/07/2006|21:38] C:\Program Files\Adobe
[13/10/2006|19:34] C:\Program Files\Alwil Software
[01/07/2006|21:38] C:\Program Files\AMD
[01/07/2006|21:39] C:\Program Files\AOL 9.0
[01/07/2006|21:39] C:\Program Files\AOL Compagnon
[01/07/2006|21:38] C:\Program Files\ATI Technologies
[01/07/2006|21:38] C:\Program Files\ComPlus Applications
[01/07/2006|21:38] C:\Program Files\CyberLink
[17/09/2007|22:24] C:\Program Files\Fichiers communs
[31/08/2008|16:53] C:\Program Files\Google
[01/07/2006|21:38] C:\Program Files\InstallShield Installation Information
[25/08/2008|20:33] C:\Program Files\Internet Explorer
[31/08/2008|15:07] C:\Program Files\Java
[01/07/2006|21:38] C:\Program Files\Learn2.com
[31/08/2008|12:42] C:\Program Files\Malwarebytes' Anti-Malware
[25/08/2008|20:30] C:\Program Files\Messenger
[22/05/2007|05:44] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/07/2006|21:38] C:\Program Files\microsoft frontpage
[01/07/2006|21:38] C:\Program Files\microsoft office
[01/07/2006|21:38] C:\Program Files\Microsoft Visual Studio
[01/07/2006|21:43] C:\Program Files\Movie Maker
[01/07/2006|21:38] C:\Program Files\MSN
[01/07/2006|21:38] C:\Program Files\MSN Gaming Zone
[15/05/2007|22:31] C:\Program Files\MSN Messenger
[15/11/2006|08:59] C:\Program Files\MSXML 4.0
[01/07/2006|21:43] C:\Program Files\NetMeeting
[01/07/2006|21:43] C:\Program Files\Online Services
[28/11/2007|23:11] C:\Program Files\OpenOffice.org 2.3
[14/06/2007|07:33] C:\Program Files\Outlook Express
[01/07/2006|21:44] C:\Program Files\QuickTime
[01/07/2006|21:38] C:\Program Files\Real
[01/07/2006|21:38] C:\Program Files\Realtek
[01/07/2006|21:44] C:\Program Files\Services en ligne
[01/07/2006|21:38] C:\Program Files\Sonic
[01/07/2006|21:38] C:\Program Files\Synaptics
[01/07/2006|21:38] C:\Program Files\Uninstall Information
[08/06/2008|17:17] C:\Program Files\VideoLAN
[01/12/2007|10:12] C:\Program Files\Windows Live Favorites
[01/12/2007|10:12] C:\Program Files\Windows Live Toolbar
[05/02/2008|20:31] C:\Program Files\Windows Media Connect 2
[05/02/2008|20:31] C:\Program Files\Windows Media Player
[01/07/2006|21:45] C:\Program Files\Windows NT
[01/07/2006|21:38] C:\Program Files\WindowsUpdate
[01/07/2006|21:38] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[28/08/2006|17:52] C:\Program Files\Fichiers communs\Adobe
[01/07/2006|21:40] C:\Program Files\Fichiers communs\AOL
[01/07/2006|21:40] C:\Program Files\Fichiers communs\aolshare
[01/07/2006|21:40] C:\Program Files\Fichiers communs\Designer
[01/07/2006|21:38] C:\Program Files\Fichiers communs\InstallShield
[01/07/2006|21:38] C:\Program Files\Fichiers communs\Java
[19/09/2007|07:24] C:\Program Files\Fichiers communs\Microsoft Shared
[01/07/2006|21:38] C:\Program Files\Fichiers communs\MSSoap
[01/07/2006|21:38] C:\Program Files\Fichiers communs\Nullsoft
[01/07/2006|21:38] C:\Program Files\Fichiers communs\ODBC
[01/07/2006|21:38] C:\Program Files\Fichiers communs\Real
[01/07/2006|21:41] C:\Program Files\Fichiers communs\Services
[01/07/2006|21:41] C:\Program Files\Fichiers communs\Sonic Shared
[01/07/2006|21:38] C:\Program Files\Fichiers communs\SpeechEngines
[01/07/2006|21:41] C:\Program Files\Fichiers communs\SureThing Shared
[14/06/2007|07:33] C:\Program Files\Fichiers communs\System
[01/07/2006|21:38] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 14 Processus )

... OK !

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 17:08:52
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:25][D:33]-> C:\DOCUME~1\pc\LOCALS~1\Temp
[F:646][D:0]-> C:\DOCUME~1\pc\Cookies
[F:7140][D:23]-> C:\DOCUME~1\pc\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 31/08/2008|17:00 - Option : [1]
1 - 31/08/2008|17:10 - Option : [2]
3 - "C:\Lop SD\LopR_3.txt" - 31/08/2008|17:10 - Option : [2]

--------------------\\ Fin du rapport a 17:10:44

rapport LopR en mode normal :

--------------------\\ Lop S&D 4.2.3-8 XP/Vista

Microsoft Windows XP Édition familiale ( v5.1.2600 ) Service Pack 2
X86-based PC ( Uniprocessor Free : AMD Turion(tm) 64 Mobile Technology ML-28 )
BIOS : Insyde Software MobilePRO BIOS Version 4.20.10
USER : pc ( Administrator )
BOOT : Normal boot
Antivirus : avast! antivirus 4.7.1098 [VPS 080830-0] 4.7.1098 (Activated)

"C:\Lop SD" ( MAJ : 31-08-2008|15:45 )
Option : [1] ( 31/08/2008|16:58 )

--------------------\\ Listing des dossiers dans APPLIC~1

[01/07/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
[01/07/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
[17/09/2006|12:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\CyberLink
[16/08/2004|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\desktop.ini
[31/08/2008|15:07] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
[31/08/2008|12:42] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
[01/12/2007|10:12] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
[01/07/2006|21:41] C:\DOCUME~1\ALLUSE~1\APPLIC~1\QuickTime
[01/07/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\SBSI
[01/07/2006|21:38] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
[28/02/2007|22:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
[15/05/2007|22:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Live Toolbar

[16/08/2004|17:55] C:\DOCUME~1\DEFAUL~1\APPLIC~1\desktop.ini
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Identities
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Real
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Symantec
[01/07/2006|21:38] C:\DOCUME~1\DEFAUL~1\APPLIC~1\You've Got Pictures Screensaver

[30/03/2008|17:02] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft

[13/07/2007|07:52] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft
[01/07/2006|15:31] C:\DOCUME~1\NETWOR~1\APPLIC~1\Symantec

[29/08/2008|19:16] C:\DOCUME~1\pc\APPLIC~1\Adobe
[18/10/2007|16:14] C:\DOCUME~1\pc\APPLIC~1\AdobeUM
[26/08/2006|21:06] C:\DOCUME~1\pc\APPLIC~1\CyberLink
[16/08/2004|17:55] C:\DOCUME~1\pc\APPLIC~1\desktop.ini
[05/07/2007|23:31] C:\DOCUME~1\pc\APPLIC~1\GDIPFONTCACHEV1.DAT
[05/06/2007|21:44] C:\DOCUME~1\pc\APPLIC~1\Google
[01/07/2006|21:38] C:\DOCUME~1\pc\APPLIC~1\Identities
[01/07/2006|15:44] C:\DOCUME~1\pc\APPLIC~1\Macromedia
[31/08/2008|12:42] C:\DOCUME~1\pc\APPLIC~1\Malwarebytes
[05/06/2007|21:41] C:\DOCUME~1\pc\APPLIC~1\Microsoft
[31/08/2008|14:59] C:\DOCUME~1\pc\APPLIC~1\OpenOffice.org2
[25/08/2006|17:20] C:\DOCUME~1\pc\APPLIC~1\Real
[01/07/2006|21:38] C:\DOCUME~1\pc\APPLIC~1\Sun
[01/07/2006|13:20] C:\DOCUME~1\pc\APPLIC~1\Symantec
[01/05/2008|20:34] C:\DOCUME~1\pc\APPLIC~1\U3
[08/06/2008|18:03] C:\DOCUME~1\pc\APPLIC~1\vlc
[01/07/2006|21:38] C:\DOCUME~1\pc\APPLIC~1\You've Got Pictures Screensaver

[04/09/2007|23:28] C:\DOCUME~1\PROPRI~1\APPLIC~1\You've Got Pictures Screensaver

--------------------\\ Tâches planifiées dans C:\WINDOWS\tasks

[31/08/2008 15:09][--a------] C:\WINDOWS\tasks\V‚rifier les mises … jour de Windows Live Toolbar.job
[01/07/2006 12:52][--a------] C:\WINDOWS\tasks\Rappel d'enregistrement 3.job
[31/08/2008 16:42][--ah-----] C:\WINDOWS\tasks\SA.DAT
[05/08/2004 14:00][-rah-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing des dossiers dans C:\Program Files

[01/07/2006|21:38] C:\Program Files\Adobe
[13/10/2006|19:34] C:\Program Files\Alwil Software
[01/07/2006|21:38] C:\Program Files\AMD
[01/07/2006|21:39] C:\Program Files\AOL 9.0
[01/07/2006|21:39] C:\Program Files\AOL Compagnon
[01/07/2006|21:38] C:\Program Files\ATI Technologies
[01/07/2006|21:38] C:\Program Files\ComPlus Applications
[01/07/2006|21:38] C:\Program Files\CyberLink
[17/09/2007|22:24] C:\Program Files\Fichiers communs
[31/08/2008|16:53] C:\Program Files\Google
[01/07/2006|21:38] C:\Program Files\InstallShield Installation Information
[25/08/2008|20:33] C:\Program Files\Internet Explorer
[31/08/2008|15:07] C:\Program Files\Java
[01/07/2006|21:38] C:\Program Files\Learn2.com
[31/08/2008|12:42] C:\Program Files\Malwarebytes' Anti-Malware
[25/08/2008|20:30] C:\Program Files\Messenger
[22/05/2007|05:44] C:\Program Files\Microsoft CAPICOM 2.1.0.2
[01/07/2006|21:38] C:\Program Files\microsoft frontpage
[01/07/2006|21:38] C:\Program Files\microsoft office
[01/07/2006|21:38] C:\Program Files\Microsoft Visual Studio
[01/07/2006|21:43] C:\Program Files\Movie Maker
[01/07/2006|21:38] C:\Program Files\MSN
[01/07/2006|21:38] C:\Program Files\MSN Gaming Zone
[15/05/2007|22:31] C:\Program Files\MSN Messenger
[15/11/2006|08:59] C:\Program Files\MSXML 4.0
[01/07/2006|21:43] C:\Program Files\NetMeeting
[01/07/2006|21:43] C:\Program Files\Online Services
[28/11/2007|23:11] C:\Program Files\OpenOffice.org 2.3
[14/06/2007|07:33] C:\Program Files\Outlook Express
[01/07/2006|21:44] C:\Program Files\QuickTime
[01/07/2006|21:38] C:\Program Files\Real
[01/07/2006|21:38] C:\Program Files\Realtek
[01/07/2006|21:44] C:\Program Files\Services en ligne
[01/07/2006|21:38] C:\Program Files\Sonic
[01/07/2006|21:38] C:\Program Files\Synaptics
[01/07/2006|21:38] C:\Program Files\Uninstall Information
[08/06/2008|17:17] C:\Program Files\VideoLAN
[01/07/2006|21:38] C:\Program Files\Viewpoint
[01/12/2007|10:12] C:\Program Files\Windows Live Favorites
[01/12/2007|10:12] C:\Program Files\Windows Live Toolbar
[05/02/2008|20:31] C:\Program Files\Windows Media Connect 2
[05/02/2008|20:31] C:\Program Files\Windows Media Player
[01/07/2006|21:45] C:\Program Files\Windows NT
[01/07/2006|21:38] C:\Program Files\WindowsUpdate
[01/07/2006|21:38] C:\Program Files\xerox

--------------------\\ Listing des dossiers dans C:\Program Files\Fichiers communs

[28/08/2006|17:52] C:\Program Files\Fichiers communs\Adobe
[01/07/2006|21:40] C:\Program Files\Fichiers communs\AOL
[01/07/2006|21:40] C:\Program Files\Fichiers communs\aolshare
[01/07/2006|21:40] C:\Program Files\Fichiers communs\Designer
[01/07/2006|21:38] C:\Program Files\Fichiers communs\InstallShield
[01/07/2006|21:38] C:\Program Files\Fichiers communs\Java
[19/09/2007|07:24] C:\Program Files\Fichiers communs\Microsoft Shared
[01/07/2006|21:38] C:\Program Files\Fichiers communs\MSSoap
[01/07/2006|21:38] C:\Program Files\Fichiers communs\Nullsoft
[01/07/2006|21:38] C:\Program Files\Fichiers communs\ODBC
[01/07/2006|21:38] C:\Program Files\Fichiers communs\Real
[01/07/2006|21:41] C:\Program Files\Fichiers communs\Services
[01/07/2006|21:41] C:\Program Files\Fichiers communs\Sonic Shared
[01/07/2006|21:38] C:\Program Files\Fichiers communs\SpeechEngines
[01/07/2006|21:41] C:\Program Files\Fichiers communs\SureThing Shared
[14/06/2007|07:33] C:\Program Files\Fichiers communs\System
[01/07/2006|21:38] C:\Program Files\Fichiers communs\xing shared

--------------------\\ Process

( 47 Processus )

iexplore.exe ~ [PID:3352]

--------------------\\ Recherche avec S_Lop

Aucun fichier / dossier Lop trouvé !

--------------------\\ Recherche de Fichiers / Dossiers Lop

C:\DOCUME~1\pc\Cookies\pc@advertstream[1].txt
C:\DOCUME~1\pc\Cookies\pc@advertising[2].txt
C:\DOCUME~1\pc\Cookies\pc@adopt.euroclick[1].txt

--------------------\\ Verification du Registre

..... OK !

--------------------\\ Verification du fichier Hosts

Fichier Hosts PROPRE

--------------------\\ Recherche de fichiers avec Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 16:59:15
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden files: 0

--------------------\\ Recherche d'autres infections

Aucune autre infection trouvée !

[F:26][D:33]-> C:\DOCUME~1\pc\LOCALS~1\Temp
[F:649][D:0]-> C:\DOCUME~1\pc\Cookies
[F:7138][D:23]-> C:\DOCUME~1\pc\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - 31/08/2008|17:00 - Option : [1]

--------------------\\ Fin du rapport a 17:00:14

rapport SD fix :

[b]SDFix: Version 1.220 [/b]
Run by pc on 31/08/2008 at 15:25

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

[b]Checking Files [/b]:

No Trojan Files Found

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 16:46:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:0000006c

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%ProgramFiles%\\AOL 9.0\\aol.exe"="%ProgramFiles%\\AOL 9.0\\aol.exe:*:Enabled:AOL"
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\logo_ubi.exe:*:Enabled:SPLINTER CELL PANDORA"
"%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe"="%ProgramFiles%\\UBISOFT\\Splinter Cell Pandora Tomorrow\\pandora.exe:*:Enabled:PANDORA"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\APPS\\Inventime\\my.exe"="C:\\APPS\\Inventime\\my.exe:*:Enabled:INVENTIME"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:

[b]Files with Hidden Attributes [/b]:

Fri 22 Jul 2005 215 A.SHR --- "C:\BOOT.BAK"
Tue 31 May 2005 54,384 A..H. --- "C:\Program Files\AOL 9.0\aolphx.exe"
Tue 31 May 2005 156,784 A..H. --- "C:\Program Files\AOL 9.0\aoltray.exe"
Tue 31 May 2005 31,344 A..H. --- "C:\Program Files\AOL 9.0\RBM.exe"
Tue 5 Feb 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Wed 3 Jan 2007 307,200 A.SH. --- "C:\Documents and Settings\pc\Mes documents\20070101 rando aravis\SIV147.tmp"
Mon 21 Jul 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\405ae8e48aa46e265982686e1678047b\BIT1.tmp"
Tue 31 May 2005 106,496 A..H. --- "C:\Program Files\Fichiers communs\aolshare\shell\fr\shellext.dll"

[b]Finished![/b]

je viens donc de lancer malware antimalware sur ce nouveau PC. Résultats impressionnants, j'ai supprimer comme indiquer les fichier infectés. je lance entre temps SDFix. Le rapport malware :

Malwarebytes' Anti-Malware 1.25
Version de la base de données: 1101
Windows 5.1.2600 Service Pack 2

14:56:03 31/08/2008
mbam-log-08-31-2008 (14-56-03).txt

Type de recherche: Examen complet (C:\|)
Eléments examinés: 97388
Temps écoulé: 1 hour(s), 51 minute(s), 23 second(s)

Processus mémoire infecté(s): 0
Module(s) mémoire infecté(s): 0
Clé(s) du Registre infectée(s): 1
Valeur(s) du Registre infectée(s): 0
Elément(s) de données du Registre infecté(s): 0
Dossier(s) infecté(s): 4
Fichier(s) infecté(s): 45

Processus mémoire infecté(s):
(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):
(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):
HKEY_CLASSES_ROOT\pbfrv2.pbfrv2 (Adware.2020Search) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):
(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):
(Aucun élément nuisible détecté)

Dossier(s) infecté(s):
C:\Program Files\dynamic toolbar (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2 (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache (Adware.2020search) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):
C:\Documents and Settings\pc\Bureau\backups\backup-20060805-110710-221.dll (Adware.2020Search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\batch.bat (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\unins000.dat (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\unins000.exe (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\go.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\home.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\logo_pb.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\parent_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\pbfrv2tb0200.cfg (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_off.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\popup_on.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\search.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\services.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin1.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin2.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin3.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin4.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\skin5.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\store.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\style.css (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\support.bmp (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\ticker.xml (Adware.2020search) -> Quarantined and deleted successfully.
C:\Program Files\dynamic toolbar\PBFRV2\Cache\_Ticker_ticker.txt (Adware.2020search) -> Quarantined and deleted successfully.

Al,

Je vais executer la meme opération sur le PC de ma femme. Je viens de lancer antimalware, qui deja en 5 minutes me trouve 2 infection. Je posterai le rapport une fois terminé.

Rom

Bonjour

OK

Tu gardes dans un coin Malwarebyte's Anti-Malware (il peux servir occasionnellement) ==> mais il n'a pas de protection résidente. Et si tu l'utilises, il faut préalablement le remettre à jour.

Tu jettes ToolsCleaner (de A.Rothstein) (c'est bizarre qu'il ait laisser traîner son icône -comme celle de SDFix d'ailleurs-)

Bon vent
Tu as au moins la conviction d'avoir un PC net et certainement mieux protégé avec ANTIVIR et KERIO.

Al.

Al,

Voila Kerio installé + blocage des principaux ports comme recommandé sur tuto.

Il me reste quelques logiciels installés que nous avons utilisé lors de laprocédue, comme antimalware, ToolCleaner, ainsi que quelques reports. Je prends l'initiative de les desinstaller et des les supprimer du bureau ?

Enfin, deja je te remercie vivement pour ton aide. Meme si, a ma grande surprise, on n'a pas vraiment trouver des trucs bien méchant (oui, non ?) sur mon PC.

Je suis loin d'etre calé en informatique, et t'ai fait une confiance aveugle ou presque. Je ne connais de plus pas très bien ce monde, ses acteurs et passionnés, et en ai une vision probablement assez floue. D'ou une probable derniere question, naive peut etre que j'espere que tu ne prendras pas mal : dans notre monde merveilleux de l'informatique ou traquenards et chausses trappes existent a tout coin de reseau, quel est TON intéret, si ce n'est la passion, de dépanner des mecs inconnus (moi) et d'y passer du temps (nous sommes dimanche, hein!) sur un forum plutot anonyme ??? (en corollaire, tu aurais pu me foutre un enorme bazard dans mon PC en manipulant un gros pigeon (encore moi) de l'informatique)...)

Thanks anyway, je pense que tout ira bien.

Rom