infection par trojan Résolu

Question

Bonjour,
j'ai sans cesse des alertes de trojan malgré des scans de combofix et de mawarebytes je ne sais plus quoi faire
je joins le log file de hijack
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 06:52, on 2008-10-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\WINDOWS\system32\clsxujgt.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
C:\WINDOWS\system32\AEServEx.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32
vsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\eMule\emule.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\pc\Bureau\bebebe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: (no name) - {39E06D62-AA5E-4E40-8ADC-E22CCB4BD55C} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: (no name) - {79A5FE92-DF31-4165-A503-C6A36D330FE8} - (no file)
O2 - BHO: (no name) - {9BF234AF-A93D-85E4-4296-A18F055779C2} - (no file)
O2 - BHO: (no name) - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O2 - BHO: {1eca6da5-071a-61cb-e394-6bac0a796f2c} - {c2f697a0-cab6-493e-bc16-a1705ad6ace1} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google IME Autoupdater] "C:\Program Files\Google\Google Pinyin\GooglePinyinDaemon.exe"
O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount
O4 - HKCU\..\Run: [ActComSmart] C:\WINDOWS\system32\clsxujgt.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKLM\..\Policies\Explorer\Run: [KhTPEE8LmM] C:\Documents and Settings\All Users\Application Data\ajwdupsh\obalgxeb.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32	scupgrd.exe (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\RunOnce: [Config] %systemroot%\system32un.cmd (User 'SERVICE RÉSEAU')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Liens de téléchargement avec Mega Manager... - C:\Program Files\Megaupload\Mega Manager\mm_file.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF97FE39-BAB9-4AD2-A192-C839639E241F}: NameServer = 194.2.0.20,194.2.0.50
O17 - HKLM\System\CS7\Services\Tcpip\..\{0B942C92-9B68-4DD2-B57E-AEF89E5EC7DD}: NameServer = 192.168.1.1
O17 - HKLM\System\CS8\Services\Tcpip\..\{0B942C92-9B68-4DD2-B57E-AEF89E5EC7DD}: NameServer = 192.168.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: LogonLauncher - C:\WINDOWS\SYSTEM32\LogLaun.dll
O20 - Winlogon Notify: yayaWNFw - yayaWNFw.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AEServ - Faronics Corporation - C:\WINDOWS\system32\AEServEx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech - c:\program files\fichiers communs\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32
vsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/pc/LOCALS~1/Temp/msohtml1/01/clip_image002.gif

ariane11 · Answer

oui peut etre mais je ne sais pas comment faire

ariane11 · Answer

ok je vais le faire j'ai aussi scanné avec sdfix et depuis je n'ai plus de message d'alertes de windows 
je colle ici le rapport moi je n'y comprends rien
merci de tes conseils
[b]SDFix: Version 1.231 [/b]
Run by pc on 2008-10-07 at 08:38

Microsoft Windows XP [version 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


[b]Checking Files [/b]: 

Trojan Files Found:

C:\WINDOWS\system32\1.reg - Deleted
C:\WINDOWS\Fonts\*.zip - 1 fichier(s)          118,342 octets - Deleted



Folder C:\Temp\maxsv15 - Removed


Removing Temp Files

[b]ADS Check [/b]:
 


                                 [b]Final Check [/b]:

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-07 08:43:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet006\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:26,ff,3b,f7,5c,dd,4c,2d,7b,3a,a1,df,f6,a2,71,90,be,65,cc,a2,05,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:85,dd,3b,ca,23,03,ae,61,1e,46,63,69,f6,56,44,ff,6f,7d,c4,5c,30,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1f,5d,04,57,a4,26,09,9e,f3,d8,b0,b8,a1,46,da,dc,41,..
"khjeh"=hex:cc,f2,22,d4,74,7f,07,cc,32,69,08,02,2d,26,bd,27,09,a3,06,1e,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:bb,cf,b1,61,88,87,86,7d,6a,f2,d1,aa,40,66,c2,11,39,b2,33,25,5b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:26,ff,3b,f7,5c,dd,4c,2d,7b,3a,a1,df,f6,a2,71,90,be,65,cc,a2,05,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:85,dd,3b,ca,23,03,ae,61,1e,46,63,69,f6,56,44,ff,6f,7d,c4,5c,30,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1f,5d,04,57,a4,26,09,9e,f3,d8,b0,b8,a1,46,da,dc,41,..
"khjeh"=hex:cc,f2,22,d4,74,7f,07,cc,32,69,08,02,2d,26,bd,27,09,a3,06,1e,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:bb,cf,b1,61,88,87,86,7d,6a,f2,d1,aa,40,66,c2,11,39,b2,33,25,5b,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:26,ff,3b,f7,5c,dd,4c,2d,7b,3a,a1,df,f6,a2,71,90,be,65,cc,a2,05,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:85,dd,3b,ca,23,03,ae,61,1e,46,63,69,f6,56,44,ff,6f,7d,c4,5c,30,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,1f,5d,04,57,a4,26,09,9e,f3,d8,b0,b8,a1,46,da,dc,41,..
"khjeh"=hex:cc,f2,22,d4,74,7f,07,cc,32,69,08,02,2d,26,bd,27,09,a3,06,1e,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet009\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:bb,cf,b1,61,88,87,86,7d,6a,f2,d1,aa,40,66,c2,11,39,b2,33,25,5b,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:47e1af21
"s2"=dword:56b106d9
"h0"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:26,ff,3b,f7,5c,dd,4c,2d,7b,3a,a1,df,f6,a2,71,90,be,65,cc,a2,05,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:85,dd,3b,ca,23,03,ae,61,1e,46,63,69,f6,56,44,ff,6f,7d,c4,5c,30,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:74,29,99,4d,99,0e,cb,fc,1c,f2,3a,8d,72,87,f1,eb,c7,0b,02,86,ad,..
"a0"=hex:20,01,00,00,4a,46,63,45,12,09,3e,49,16,f3,ff,fb,3a,ea,2b,7b,6c,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:50,8c,0b,0a,dc,20,0e,aa,7d,3b,73,c1,67,1a,f3,18,05,19,2b,bd,d0,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet011\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000001
"ujdew"=hex:26,ff,3b,f7,5c,dd,4c,2d,7b,3a,a1,df,f6,a2,71,90,be,65,cc,a2,05,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet011\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"h0"=dword:00000000
"khjeh"=hex:85,dd,3b,ca,23,03,ae,61,1e,46,63,69,f6,56,44,ff,6f,7d,c4,5c,30,..
"p0"="C:\Program Files\DAEMON Tools Lite\"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet011\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"khjeh"=hex:74,29,99,4d,99,0e,cb,fc,1c,f2,3a,8d,72,87,f1,eb,c7,0b,02,86,ad,..
"a0"=hex:20,01,00,00,4a,46,63,45,12,09,3e,49,16,f3,ff,fb,3a,ea,2b,7b,6c,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet011\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:50,8c,0b,0a,dc,20,0e,aa,7d,3b,73,c1,67,1a,f3,18,05,19,2b,bd,d0,..

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="avgrsstx.dll"
"DeviceNotSelectedTimeout"="15"
"GDIProcessHandleQuota"=dword:00002710
"Spooler"="yes"
"swapdisk"=""
"TransmissionRetryTimeout"="90"
"USERProcessHandleQuota"=dword:00002710

scanning hidden files ...

C:\WINDOWS	emp\f5ca1197-e87a-4e58-ac59-c8c6dc9fb500.tmp

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\eMule\emule.exe"="C:\eMule\emule.exe:*:Enabled:eMule"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Messenger"
"C:\Program Files\Exalight\NetworkDiagnostic.exe"="C:\Program Files\Exalight\NetworkDiagnostic.exe:*:Enabled:Exalight Network Diagnostic"
"C:\Program Files\Exalight\Exalight.exe"="C:\Program Files\Exalight\Exalight.exe:*:Enabled:Exalight"
"C:\Documents and Settings\pc\Local Settings\Application Data\F4\ClientUpdater\ClientUpdater.exe"="C:\Documents and Settings\pc\Local Settings\Application Data\F4\ClientUpdater\ClientUpdater.exe:*:Enabled:F4 Game Client Updater"
"H:\utorrent.exe"="H:\utorrent.exe:*:Enabled:µTorrent"
"C:\Documents and Settings\pc\Bureau\utorrent.exe"="C:\Documents and Settings\pc\Bureau\utorrent.exe:*:Enabled:µTorrent"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\MSN Messenger\msnmsgr.exe"="C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Program Files\MSN Messenger\livecall.exe"="C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[b]Remaining Files [/b]:


File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Mon 28 Jan 2008     5,146,448 A..H. --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Fri 18 Apr 2008     1,479,150 A.SH. --- "C:\WINDOWS\system32\qwuuehcs.tmp"
Fri 21 Mar 2008         4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"

[b]Finished![/b]

jlpjlp · Answer

slt

dans lopsd il y a:

--------------------\ Recherche de Fichiers / Dossiers Lop

C:\Program Files\BitTorrent Fastest Tool
C:\Program Files\BitTorrent Fastest Tool\BitDownload-4.5.0.0-setup.exe
C:\Program Files\BitTorrent Fastest Tool\Checklime.exe
C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG
C:\Program Files\Multi_Media_France
C:\Program Files\Multi_Media_France\INSTALL.LOG
C:\Program Files\Multi_Media_France
C:\Program Files\Multi_Media_France\INSTALL.LOG

--------------------\ Verification du Registre 



_____________________


alors:
refais lopsd:

* Choisis cette fois ci l'Option 2 (Suppression)
* Ne ferme pas la fenêtre lors de la suppression !
* Poste le rapport généré (C:\lopR.txt)


(Si le Bureau ne réapparaît pas, presse Ctrl + Alt + Suppr , Onglet Fichier , Nouvelle tâche , tape explorer.exe et valide)


________________________

puis:

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau. 
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2 

lance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée". 
! Ne ferme pas la fenêtre lors de la suppression ! 
Un rapport sera généré, poste son contenu ici. 

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches. 
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..." 
Tape explorer puis valide.

ariane11 · Answer

ok je le fais tout de suite

jlpjlp · Answer

ensuite analyse ce fihcier sur virus total et colle le rapport:  C:\WINDOWS\system32\clsxujgt.exe
https://www.virustotal.com/gui/




et recolle un nouveau rapport hijakchits

ariane11 · Answer

voila le rapport de lopd

   --------------------\  Lop S&D 4.2.4-5   XP/Vista

   Microsoft Windows XP Professionnel ( v5.1.2600 ) Service Pack 2
   X86-based PC ( Multiprocessor Free : Genuine Intel(R) CPU           T2050  @ 1.60GHz )
   BIOS : Ver 1.00PARTTBLA
   USER : pc ( Administrator )
   BOOT : Normal boot
   Antivirus : ESET NOD32 antivirus system 2.70 2.70 (Not Activated)
   C:\ (Local Disk) - NTFS - Total : 35 Go Free : 2 Go
   D:\ (Local Disk) - FAT32 - Total : 35 Go Free : 19 Go
   E:\ (CD or DVD)
   F:\ (CD or DVD)
   I:\ (Local Disk) - FAT32 - Total : 465 Go Free : 243 Go

   "C:\Lop SD" ( MAJ : 02-10-2008|23:42 )
   Option : [2] ( 2008-10-07|10:19 )


   \\\\\\\\\\\\\\\ SUPPRESSION

   Supprime! - C:\Program Files\BitTorrent Fastest Tool\BitDownload-4.5.0.0-setup.exe
   Supprime! - C:\Program Files\BitTorrent Fastest Tool\Checklime.exe
   Supprime! - C:\Program Files\BitTorrent Fastest Tool\INSTALL.LOG
   Supprime! - C:\Program Files\Multi_Media_France\INSTALL.LOG
   Supprime! - C:\Program Files\BitTorrent Fastest Tool
   Supprime! - C:\Program Files\Multi_Media_France
   -
   [ Fichier Hosts ] .. Restaure!
 
   \\\\\\\\\\\\\\\ 

 
   --------------------\  Listing des dossiers dans APPLIC~1  

   [2008-01-22|22:03] C:\DOCUME~1\ADMINI~1\APPLIC~1\Lavasoft
   [2008-10-07|05:16] C:\DOCUME~1\ADMINI~1\APPLIC~1\Microsoft

   [2007-03-03|20:03] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Acronis
   [2008-04-27|13:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe
   [2007-03-02|15:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
   [2008-10-06|11:10] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ajwdupsh
   [2008-09-02|08:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
   [2008-09-02|08:37] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
   [2008-10-07|05:17] C:\DOCUME~1\ALLUSE~1\APPLIC~1\avg8
   [2008-07-12|10:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\AVS4YOU
   [2007-04-09|11:13] C:\DOCUME~1\ALLUSE~1\APPLIC~1\BOONTY
   [2007-04-08|13:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Ciel
   [2007-03-02|13:28] C:\DOCUME~1\ALLUSE~1\APPLIC~1\DVD Shrink
   [2008-09-14|20:43] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
   [2008-07-28|12:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
   [2008-01-16|15:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak
   [2008-04-27|14:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
   [2007-10-26|19:30] C:\DOCUME~1\ALLUSE~1\APPLIC~1\MailFrontier
   [2008-10-06|14:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Malwarebytes
   [2007-03-03|17:55] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Micro Application
   [2008-03-30|21:11] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft
   [2007-08-30|21:24] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Mozilla
   [2008-05-05|21:25] C:\DOCUME~1\ALLUSE~1\APPLIC~1
View_Profiles
   [2007-04-17|18:36] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Real
   [2008-07-28|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Roxio
   [2008-08-06|19:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
   [2007-10-21|08:27] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Softdisk LLC
   [2008-07-28|12:58] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sonic
   [2007-09-07|07:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sony Ericsson
   [2008-09-12|01:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
   [2007-09-07|07:51] C:\DOCUME~1\ALLUSE~1\APPLIC~1\Teleca
   [2008-09-19|11:16] C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP
   [2008-04-01|13:21] C:\DOCUME~1\ALLUSE~1\APPLIC~1\WLInstaller
   [2008-05-04|09:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\ZoomBrowser

   [2007-03-02|10:26] C:\DOCUME~1\DEFAUL~1\APPLIC~1\Microsoft

   [2008-10-07|05:16] C:\DOCUME~1\LOCALS~1\APPLIC~1\Microsoft
   [2008-07-28|13:01] C:\DOCUME~1\LOCALS~1\APPLIC~1\Roxio

   [2008-10-07|05:16] C:\DOCUME~1\NETWOR~1\APPLIC~1\Microsoft

   [2008-05-05|07:15] C:\DOCUME~1\pc\APPLIC~1\.ABC
   [2007-12-29|12:22] C:\DOCUME~1\pc\APPLIC~1\Adobe
   [2007-12-29|12:23] C:\DOCUME~1\pc\APPLIC~1\AdobeUM
   [2008-04-27|15:22] C:\DOCUME~1\pc\APPLIC~1\Ahead
   [2007-12-04|21:54] C:\DOCUME~1\pc\APPLIC~1\Apple Computer
   [2008-03-28|21:49] C:\DOCUME~1\pc\APPLIC~1\AutoTransfer
   [2008-07-12|10:54] C:\DOCUME~1\pc\APPLIC~1\AVS4YOU
   [2008-04-17|11:03] C:\DOCUME~1\pc\APPLIC~1\BitTorrent
   [2008-05-12|16:39] C:\DOCUME~1\pc\APPLIC~1\BSplayer
   [2008-05-12|14:12] C:\DOCUME~1\pc\APPLIC~1\BSplayer Pro
   [2008-09-19|08:32] C:\DOCUME~1\pc\APPLIC~1\Canneverbe_Limited
   [2008-04-24|15:59] C:\DOCUME~1\pc\APPLIC~1\CDBurnerXP_Soft
   [2008-07-01|22:19] C:\DOCUME~1\pc\APPLIC~1\DAEMON Tools
   [2008-07-10|12:28] C:\DOCUME~1\pc\APPLIC~1\DivX
   [2007-04-08|22:22] C:\DOCUME~1\pc\APPLIC~1\DreamChess
   [2007-11-28|17:59] C:\DOCUME~1\pc\APPLIC~1\elefundesktops
   [2008-01-01|23:00] C:\DOCUME~1\pc\APPLIC~1\EoRezo
   [2008-08-23|11:48] C:\DOCUME~1\pc\APPLIC~1\F4
   [2008-09-15|04:10] C:\DOCUME~1\pc\APPLIC~1\Google
   [2008-04-06|18:49] C:\DOCUME~1\pc\APPLIC~1\gtk-2.0
   [2008-04-16|19:36] C:\DOCUME~1\pc\APPLIC~1\Hamachi
   [2007-04-12|17:38] C:\DOCUME~1\pc\APPLIC~1\Help
   [2007-03-02|10:34] C:\DOCUME~1\pc\APPLIC~1\Identities
   [2008-06-16|13:10] C:\DOCUME~1\pc\APPLIC~1\InstallShield
   [2008-01-01|19:24] C:\DOCUME~1\pc\APPLIC~1\ItsLabel
   [2007-03-02|12:37] C:\DOCUME~1\pc\APPLIC~1\Lavasoft
   [2008-10-06|13:32] C:\DOCUME~1\pc\APPLIC~1\Leadertech
   [2008-09-08|14:46] C:\DOCUME~1\pc\APPLIC~1\LimeWire
   [2007-03-15|00:00] C:\DOCUME~1\pc\APPLIC~1\Macromedia
   [2008-09-24|12:18] C:\DOCUME~1\pc\APPLIC~1\MailWasherPro
   [2008-10-06|14:24] C:\DOCUME~1\pc\APPLIC~1\Malwarebytes
   [2008-09-04|21:42] C:\DOCUME~1\pc\APPLIC~1\Media Player Classic
   [2008-06-16|13:13] C:\DOCUME~1\pc\APPLIC~1\Megaupload
   [2008-10-07|05:16] C:\DOCUME~1\pc\APPLIC~1\Microsoft
   [2008-08-30|19:27] C:\DOCUME~1\pc\APPLIC~1\Mozilla
   [2008-08-31|10:02] C:\DOCUME~1\pc\APPLIC~1\MxBoost
   [2007-09-04|09:24] C:\DOCUME~1\pc\APPLIC~1\Opera
   [2008-08-02|18:24] C:\DOCUME~1\pc\APPLIC~1\Orbit
   [2007-05-03|06:25] C:\DOCUME~1\pc\APPLIC~1\Real
   [2008-07-28|13:03] C:\DOCUME~1\pc\APPLIC~1\Roxio
   [2008-04-18|20:39] C:\DOCUME~1\pc\APPLIC~1\Shareaza
   [2008-08-07|00:09] C:\DOCUME~1\pc\APPLIC~1\skypePM
   [2007-09-07|07:52] C:\DOCUME~1\pc\APPLIC~1\Sony Ericsson
   [2007-03-14|15:47] C:\DOCUME~1\pc\APPLIC~1\Sun
   [2007-08-30|21:25] C:\DOCUME~1\pc\APPLIC~1\Talkback
   [2007-09-07|07:52] C:\DOCUME~1\pc\APPLIC~1\Teleca
   [2007-11-28|17:00] C:\DOCUME~1\pc\APPLIC~1\TERMINAL Studio
   [2008-10-05|09:04] C:\DOCUME~1\pc\APPLIC~1\uTorrent
   [2007-03-02|14:13] C:\DOCUME~1\pc\APPLIC~1\vlc
   [2008-09-08|14:35] C:\DOCUME~1\pc\APPLIC~1\Vso
   [2007-08-25|10:47] C:\DOCUME~1\pc\APPLIC~1\WinRAR
   [2008-04-29|18:43] C:\DOCUME~1\pc\APPLIC~1\ZoomBrowser EX
 
   --------------------\  Tâches planifiées dans C:\WINDOWS	asks

   [2008-10-03 09:04][--a------] C:\WINDOWS	asks\AppleSoftwareUpdate.job
   [2008-09-23 19:29][--a------] C:\WINDOWS	asks\EasyShare Registration Task.job
   [2008-10-05 09:00][--a------] C:\WINDOWS	askspc.job
   [2008-10-07 08:41][--ah-----] C:\WINDOWS	asks\SA.DAT
   [2001-10-02 19:16][-r-h-----] C:\WINDOWS	asks\desktop.ini

   --------------------\  Listing des dossiers dans C:\Program Files

   [2007-03-02|11:21] C:\Program Files\Acer
   [2008-04-27|13:55] C:\Program Files\Adobe
   [2008-09-11|23:34] C:\Program Files\Ahead
   [2008-07-28|12:24] C:\Program Files\Alcohol Soft
   [2007-08-09|18:56] C:\Program Files\Alice
   [2008-04-25|19:57] C:\Program Files\Alwil Software
   [2008-04-25|19:57] C:\Program Files\Alwil Software(2)
   [2008-09-02|08:37] C:\Program Files\Apple Software Update
   [2007-04-08|09:41] C:\Program Files\aRPNCalc
   [2008-04-25|14:02] C:\Program Files\AskTBar
   [2007-11-28|17:00] C:\Program Files\Astro Gemini Software
   [2008-04-27|14:37] C:\Program Files\AVG
   [2008-07-12|11:06] C:\Program Files\AVS4YOU
   [2007-04-09|11:13] C:\Program Files\Boonty
   [2007-03-02|14:02] C:\Program Files\BorderMaker
   [2007-04-08|12:33] C:\Program Files\CalcFi
   [2007-03-02|15:15] C:\Program Files\Canon
   [2007-03-02|12:35] C:\Program Files\CCleaner
   [2007-04-12|17:31] C:\Program Files\Ciel e-Commerce
   [2008-04-27|14:07] C:\Program Files\CodeStuff
   [2007-03-02|10:22] C:\Program Files\ComPlus Applications
   [2008-08-05|16:45] C:\Program Files\Conduit
   [2008-07-07|17:15] C:\Program Files\Config
   [2008-07-01|22:11] C:\Program Files\Counter-Strike Source
   [2008-10-06|13:20] C:\Program Files\DAEMON Tools Lite
   [2007-04-08|08:56] C:\Program Files\Deskcalc Pro
   [2007-03-02|10:56] C:\Program Files\DIFX
   [2008-09-04|21:41] C:\Program Files\DivX
   [2008-01-04|19:11] C:\Program Files\EoRezo
   [2007-03-02|13:27] C:\Program Files\Everest Ultimate 2006.2.80.534 sans install
   [2008-08-23|11:50] C:\Program Files\Exalight
   [2008-04-27|14:27] C:\Program Files\Feurio
   [2008-10-07|05:37] C:\Program Files\Fichiers communs
   [2007-04-21|10:03] C:\Program Files\FlashGet
   [2008-01-04|22:56] C:\Program Files\FreeLaunchBar
   [2008-05-09|06:41] C:\Program Files\Gabest
   [2008-04-18|21:01] C:\Program Files\Gnutella Turbo
   [2008-09-14|20:43] C:\Program Files\Google
   [2003-04-04|15:33] C:\Program Files\Groups
   [2008-09-21|14:58] C:\Program Files\InstallShield Installation Information
   [2007-03-02|11:19] C:\Program Files\Intel
   [2008-10-06|13:39] C:\Program Files\Internet Explorer
   [2007-04-08|12:20] C:\Program Files\IZArc
   [2007-08-25|10:39] C:\Program Files\Java
   [2008-07-10|10:48] C:\Program Files\KC Softwares
   [2007-04-08|12:45] C:\Program Files\khi3
   [2008-09-04|21:41] C:\Program Files\K-Lite Codec Pack
   [2008-04-26|03:25] C:\Program Files\Kodak
   [2003-08-18|20:44] C:\Program Files\Language
   [2008-04-27|14:33] C:\Program Files\Lavasoft
   [2007-09-04|11:06] C:\Program Files\Livre Album Fuji Photo
   [2008-04-24|13:17] C:\Program Files\MagicISO
   [2007-12-21|20:47] C:\Program Files\MailWasher Pro
   [2008-10-06|14:24] C:\Program Files\Malwarebytes' Anti-Malware
   [2008-04-25|11:26] C:\Program Files\Maxis
   [2007-04-17|18:36] C:\Program Files\Media Player Classic
   [2008-06-16|13:13] C:\Program Files\Megaupload
   [2008-10-06|13:40] C:\Program Files\Microsoft CAPICOM 2.1.0.2
   [2007-03-02|10:27] C:\Program Files\microsoft frontpage
   [2007-03-02|14:53] C:\Program Files\Microsoft Office
   [2008-04-25|20:18] C:\Program Files\MINOLTA-QMS
   [2007-03-02|10:27] C:\Program Files\movie maker
   [2008-10-07|10:06] C:\Program Files\Mozilla Firefox
   [2007-03-02|10:27] C:\Program Files\msn gaming zone
   [2008-09-14|20:43] C:\Program Files\MSN Messenger
   [2007-04-23|06:27] C:\Program Files\MSXML 4.0
   [2007-03-02|10:24] C:\Program Files\NetMeeting
   [2008-08-23|11:40] C:\Program Files\OpenAL
   [2008-03-27|08:29] C:\Program Files\Outlook Express
   [2003-08-18|20:46] C:\Program Files\Plugin
   [2007-04-08|09:20] C:\Program Files\QuData.com
   [2008-09-02|08:39] C:\Program Files\QuickTime
   [2007-10-21|09:29] C:\Program Files\Real
   [2008-09-08|14:13] C:\Program Files\Real Alternative
   [2007-03-02|11:31] C:\Program Files\Realtek
   [2007-10-25|07:25] C:\Program Files\RegSeeker
   [2007-03-02|12:44] C:\Program Files\RENOMME
   [2008-07-07|13:19] C:\Program Files\Saved Documents
   [2008-07-07|13:19] C:\Program Files\Saved Pictures
   [2007-08-25|14:38] C:\Program Files\Secret Maryo Chronicles
   [2003-12-27|16:00] C:\Program Files\Services
   [2007-03-02|10:24] C:\Program Files\Services en ligne
   [2003-08-18|20:44] C:\Program Files\Skin
   [2008-09-19|11:18] C:\Program Files\Smart DVD CD Burner
   [2007-09-07|07:50] C:\Program Files\Sony Ericsson
   [2007-03-24|14:26] C:\Program Files\Spider
   [2008-09-08|14:13] C:\Program Files\Spybot - Search & Destroy
   [2007-04-09|12:37] C:\Program Files\Stunt Playground
   [2008-04-27|14:24] C:\Program Files\SuperCopier2
   [2007-03-02|11:24] C:\Program Files\Synaptics
   [2007-04-08|09:01] C:\Program Files\Talking Calculator
   [2008-07-07|13:19] C:\Program Files	emplate
   [2007-08-08|10:53] C:\Program Files\THQ
   [2007-03-02|12:35] C:\Program Files\ToniArts
   [2007-03-02|10:34] C:\Program Files\Uninstall Information
   [2007-10-26|20:23] C:\Program Files\Unlocker
   [2007-03-02|14:00] C:\Program Files\VideoLAN
   [2008-09-20|12:12] C:\Program Files\ViVi Cursor 2.0
   [2008-04-27|14:25] C:\Program Files\VSO
   [2008-05-12|16:39] C:\Program Files\Webteh
   [2007-10-25|07:25] C:\Program Files\Wesnoth
   [2007-03-02|11:43] C:\Program Files\WIDCOMM
   [2008-04-27|14:21] C:\Program Files\Windows Live
   [2008-09-08|14:14] C:\Program Files\Windows Media Player
   [2007-03-02|10:27] C:\Program Files\Windows NT
   [2007-03-02|10:24] C:\Program Files\WindowsUpdate
   [2008-04-27|12:04] C:\Program Files\WinRAR
   [2007-03-02|10:27] C:\Program Files\xerox
   [2008-04-27|14:26] C:\Program Files\Yahoo!
   [2008-10-06|15:15] C:\Program Files\yjfcjyb
   [2007-04-21|15:01] C:\Program Files\ZC2.10
   [2008-09-08|13:54] C:\Program Files\Zone Labs

   --------------------\  Listing des dossiers dans C:\Program Files\Fichiers communs

   [2007-03-02|11:21] C:\Program Files\Fichiers communs\Acer
   [2008-04-27|13:55] C:\Program Files\Fichiers communs\Adobe
   [2007-03-02|15:22] C:\Program Files\Fichiers communs\Adobe Systems Shared
   [2008-09-11|23:34] C:\Program Files\Fichiers communs\Ahead
   [2008-07-12|11:05] C:\Program Files\Fichiers communs\AVSMedia
   [2007-04-09|11:13] C:\Program Files\Fichiers communs\BOONTY Shared
   [2007-03-02|15:14] C:\Program Files\Fichiers communs\Canon
   [2007-03-02|14:53] C:\Program Files\Fichiers communs\Designer
   [2008-07-28|12:56] C:\Program Files\Fichiers communs\InstallShield
   [2007-03-02|13:20] C:\Program Files\Fichiers communs\Java
   [2008-09-11|23:19] C:\Program Files\Fichiers communs\Logitech
   [2008-03-30|21:11] C:\Program Files\Fichiers communs\Microsoft Shared
   [2007-03-02|10:23] C:\Program Files\Fichiers communs\MSSoap
   [2007-03-02|11:18] C:\Program Files\Fichiers communs\ODBC
   [2007-10-21|09:33] C:\Program Files\Fichiers communs\Real
   [2008-07-28|13:21] C:\Program Files\Fichiers communs\Roxio Shared
   [2007-04-08|13:34] C:\Program Files\Fichiers communs\Sage
   [2007-03-02|10:24] C:\Program Files\Fichiers communs\Services
   [2008-08-06|19:46] C:\Program Files\Fichiers communs\Skype
   [2008-09-08|14:14] C:\Program Files\Fichiers communs\Sonic Shared
   [2007-03-02|11:18] C:\Program Files\Fichiers communs\SpeechEngines
   [2007-08-11|01:53] C:\Program Files\Fichiers communs\System
   [2008-09-08|14:14] C:\Program Files\Fichiers communs\Teleca Shared
   [2008-03-30|21:11] C:\Program Files\Fichiers communs\WindowsLiveInstaller
   [2008-04-27|14:32] C:\Program Files\Fichiers communs\Wise Installation Wizard

   --------------------\  Process

   ( 29 Processes )

   ... OK !

   --------------------\  Recherche avec S_Lop

   Aucun fichier / dossier Lop trouvé !
 
   --------------------\  Recherche de Fichiers / Dossiers Lop

   Aucun fichier / dossier Lop trouvé ! 
 
   --------------------\  Verification du Registre
 
   ..... OK !

   --------------------\  Verification du fichier Hosts

   Fichier Hosts PROPRE


   --------------------\  Recherche de fichiers avec Catchme
 
   catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
   Rootkit scan 2008-10-07 10:20:19
   Windows 5.1.2600 Service Pack 2 NTFS
   scanning hidden processes ...
   scanning hidden files ...
   scan completed successfully
   hidden processes: 0
   hidden files: 99
 
   --------------------\  Recherche d'autres infections


   Aucune autre infection trouvée  !

   [F:2][D:2]-> C:\DOCUME~1\pc\LOCALS~1\Temp
   [F:31][D:0]-> C:\DOCUME~1\pc\Cookies
   [F:291][D:8]-> C:\DOCUME~1\pc\LOCALS~1\TEMPOR~1\content.IE5

   1 - "C:\Lop SD\LopR_1.txt" - 2008-10-07| 7:23 - Option : [1]
   2 - "C:\Lop SD\LopR_2.txt" - 2008-10-07|10:23 - Option : [2]

   --------------------\  Fin du rapport a 10:23:26

jlpjlp · Answer

Télécharge Toolbar-S&D (Team IDN) sur ton Bureau.
https://77b4795d-a-62cb3a1a-s-sites.googlegroups.com/site/eric71mespages/ToolBarSD.exe?attachauth=ANoY7cqJWPphpudyTqv7TRo5RQ3nm_Sx8JluVMO59X5E9cyE3j3LqKlmStIqiDqJdIgMJLi7MXn2nKVajQfoWuVvZZ2wIx_vkqO4k4P0K9jh-ra9jaKPXdZcoaVF2UqJZNH8ubL_42uIwh6f35xJ2GJMuzddVj2Qth1DgZ839lxEIFGkgWz3TdfvNMy-YtxfA3gqBUrj4U4LFeAPiWr3ClmjIP0t_Xs5PQ%3D%3D&attredirects=2

lance Toolbar-S&D en double-cliquant sur le raccourci. Tape sur "2" puis valide en appuyant sur "Entrée".
! Ne ferme pas la fenêtre lors de la suppression !
Un rapport sera généré, poste son contenu ici.

NOTE : Si ton Bureau ne réapparait pas, appuie simultanément sur Ctrl+Alt+Suppr pour ouvrir le Gestionnaire des tâches.
Rends-toi sur l'onglet "Processus". Clique en haut à gauche sur Fichier et choisis "Exécuter..."
Tape explorer puis valide.

______________

ensuite analyse ce fihcier sur virus total et colle le rapport: C:\WINDOWS\system32\clsxujgt.exe
https://www.virustotal.com/gui/




et recolle un nouveau rapport hijakchits

jlpjlp · Answer

tu vas sur le lien en bleu et tu fais analyser le fichier clsxujgt en le cherchant dans poste de travail puis C...

ensuite analyse ce fihcier sur virus total et colle le rapport: https://www.virustotal.com/gui/

 C:\WINDOWS\system32\clsxujgt.exe





et recolle un nouveau rapport hijakchits

ariane11 · Answer

OK je l'ai fais mais pour moi c du chinois je fais 1 copier collé du résultat de virus total
ntivirus  	Version  	Dernière mise à jour  	Résultat
AhnLab-V3	2008.10.3.2	2008.10.06	-
AntiVir	7.8.1.34	2008.10.07	-
Authentium	5.1.0.4	2008.10.07	-
Avast	4.8.1248.0	2008.10.06	-
AVG	8.0.0.161	2008.10.06	-
BitDefender	7.2	2008.10.07	-
CAT-QuickHeal	9.50	2008.10.07	-
ClamAV	0.93.1	2008.10.07	-
DrWeb	4.44.0.09170	2008.10.06	-
eSafe	7.0.17.0	2008.10.07	-
eTrust-Vet	31.6.6132	2008.10.06	-
Ewido	4.0	2008.10.06	-
F-Prot	4.4.4.56	2008.10.06	-
F-Secure	8.0.14332.0	2008.10.07	-
Fortinet	3.113.0.0	2008.10.07	-
GData	19	2008.10.07	-
Ikarus	T3.1.1.34.0	2008.10.07	-
K7AntiVirus	7.10.486	2008.10.06	-
Kaspersky	7.0.0.125	2008.10.06	-
McAfee	5398	2008.10.04	-
Microsoft	1.4005	2008.10.07	-
NOD32	3499	2008.10.07	-
Norman	5.80.02	2008.10.06	-
Panda	9.0.0.4	2008.10.07	-
PCTools	4.4.2.0	2008.10.06	-
Prevx1	V2	2008.10.07	-
Rising	20.65.10.00	2008.10.07	-
SecureWeb-Gateway	6.7.6	2008.10.06	-
Sophos	4.34.0	2008.10.07	-
Sunbelt	3.1.1707.1	2008.10.07	-
Symantec	10	2008.10.07	-
TheHacker	6.3.1.0.102	2008.10.07	-
TrendMicro	8.700.0.1004	2008.10.07	-
VBA32	3.12.8.6	2008.10.07	-
ViRobot	2008.10.7.1409	2008.10.07	-
VirusBuster	4.5.11.0	2008.10.06	-
Information additionnelle
File size: 1732 bytes
MD5...: 802a39e13b34535c04ffb09fbbe84d47
SHA1..: 02c69156230e16eb669d8700abd4f7f5832d1fc2
SHA256: de5217bde1e891cbacb7f22ad1900471863ddbfb41a859fe0ee395e9597267cf
SHA512: 8c2e5f422bdba06c97bfecdd6b143844b483be374487ab0123f6801423354146
d2d41ea1842432f2502d88e27ae8cac40a5ef5256b9083ca5bb479fa7a762523
PEiD..: -
TrID..: File type identification
Unknown!
PEInfo: -

s.

Autre fichier

jlpjlp · Answer

ok

recolle un nouveau rapport hijakchits

ariane11 · Answer

je viens de l'envoyer merci pour tout est ce qu'il y a 1 problème sur les rapports ?

jlpjlp · Answer

non tu as mis deux rapport virus total

ariane11 · Answer

j'ai fais 1 copié collé sur le site du rapport d'hijakis

jlpjlp · Answer

tu me colle ici dans ton prochain message!

ariane11 · Answer

ok je le fais tout de suite

jlpjlp · Answer

pour ad aware la version 2008 est sortie il y a un an .... alors vire le et garde malwarebyte en plus de spybot

__________________

Relance HijackThis, choisis "do a scan only" coche la case devant les lignes ci-dessous et clic en bas sur "fix checked". 


R3 - URLSearchHook: (no name) - {BE89472C-B803-4D1D-9A9A-0A63660E0FE3} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {0EEDB912-C5FA-486F-8334-57288578C627} - (no file)
O2 - BHO: (no name) - {39E06D62-AA5E-4E40-8ADC-E22CCB4BD55C} - (no file)
O2 - BHO: (no name) - {79A5FE92-DF31-4165-A503-C6A36D330FE8} - (no file)
O2 - BHO: (no name) - {9BF234AF-A93D-85E4-4296-A18F055779C2} - (no file)
O2 - BHO: {1eca6da5-071a-61cb-e394-6bac0a796f2c} - {c2f697a0-cab6-493e-bc16-a1705ad6ace1} - (no file)
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O20 - Winlogon Notify: yayaWNFw - yayaWNFw.dll (file missing) 

______________________

Mettre a jour java:
https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/

mettre a jour internet explorer
https://www.01net.com/telecharger/windows/Internet/navigateur/fiches/33081.html

mettre à jour adobe reader
https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html


_______________________

colle un rapport avec combofix que tu as pour voir

et dis si encore des soucis

ariane11 · Answer

est ce que tu as vu le rapport hacjis

ariane11 · Answer

c'est fait pour hijackis mais je ne retrouve + combofix ou puis le télécharger et est ce qu'il faut fermer internet pour le scan

ariane11 · Answer

merci pour tout je n'ai plus de plus de problème a première vue plus d'alertes windows 
un grand merci
ariane

jlpjlp · Answer

télécharge combofix (par sUBs) ici : 

http://download.bleepingcomputer.com/sUBs/ComboFix.exe 

et enregistre le sur le bureau. 

[si je suspecte une infection bagle, j'ajoute : 

sous le nom de antibagle. Fais le avant que le fichier ne soit enregistré sur le bureau] 

déconnecte toi d'internet et ferme toutes tes applications. 

désactive tes protections (antivirus, parefeu, garde en temps réel de l'antispyware) 


double-clique sur combofix.exe et suis les instructions 

à la fin, il va produire un rapport C:\ComboFix.txt 

réactive ton parefeu, ton antivirus, la garde de ton antispyware 

copie/colle le rapport C:\ComboFix.txt dans ta prochaine réponse. 

Attention, n'utilise pas ta souris ni ton clavier (ni un autre système de pointage) pendant que le programme tourne. Cela pourrait figer l'ordi. 

Tu as un tutoriel complet ici : 

https://www.bleepingcomputer.com/combofix/fr/comment-utiliser-combofix

Infection par trojan

24 réponses

Discussions similaires

Newsletters