Virus trigger alert

eilime19 -  
Bonjour,
j' ai mon pc infesté par trigger j' ai essayé de suivre vos indications ds les différents postes mais je n' y arrive pas toute seule, est ce que quelqu' un peut m' aider ? Merci d' avance
Configuration: Windows XP
Internet Explorer 7.0

54 réponses

Résumé de la discussion

Un PC est infesté par Trigger et les échanges visent à obtenir une aide efficace pour éliminer l’infection, dépister les processus malveillants et rétablir un fonctionnement normal. Pour cela, des rapports évoquent l’utilisation d’outils tels que SmitFraudFix et HijackThis pour analyser les clés du registre et les processus actifs afin d’identifier les composants malveillants. En pratique, les interventions portent sur l’examen de rapports, la désactivation temporaire du logiciel de sécurité pour permettre les scans, et l’effacement des entrées suspects pour restaurer la configuration système. Envisager ensuite une étape de restauration ou d’actualisation des signatures antivirus selon les conseils reçus et, si nécessaire, exécuter les outils en mode dépannage afin d’éviter les conflits lors du nettoyage.

Bobot (l’IA à votre service)
  1. jlpjlp Contributeur sécurité
    verifie que le fichier webmediaviewer n'est plus present en allant dans poste de travail puis
    C:\Program Files\WebMediaViewer

    relance hijakchits , fais do a ssytem scan only et fix ces lignes (fix cheked)

    O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll (file missing)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Policies\Explorer\Run: [QuickTime Task] C:\Program Files\WebMediaViewer\qttask.exe
    O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Program Files\WebMediaViewer\hpmon.exe

    _____________________

    mets a jour adobe reader avec la version 9
    https://acrobat.adobe.com/fr/fr/acrobat/pdf-reader.html

    _________________________

    remets ensuite un rapport RSIT

    puis

    lance tools cleaner et colle nous le rapport:

    Télécharge ToolsCleaner sur ton bureau.
    --> https://www.commentcamarche.net/telecharger/ 34055291 toolscleaner
    # Clique sur Recherche et laisse le scan agir ...
    # Clique sur Suppression pour finaliser.
    # Tu peux, si tu le souhaites, te servir des Options facultatives.
    # Clique sur Quitter pour obtenir le rapport.
    # Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\).
    1. eilime19
      Si une derniere question est ce que je garde sur mon bureau ( combofix, toolbar...etc ) ????
      1. eilime19
        Nikel, plus de triangle, plus d' alertes c' est génial !!!! BRAVO !!! UN GRAND MERCI !!!!
        1. eilime19
          A Logfile of Trend Micro HijackThis v2.0.2
          Scan saved at 18:44:56, on 26/11/2008
          Platform: Windows XP SP2 (WinNT 5.01.2600)
          MSIE: Internet Explorer v7.00 (7.00.6000.16735)
          Boot mode: Normal

          Running processes:
          C:\WINDOWS\System32\smss.exe
          C:\WINDOWS\system32\winlogon.exe
          C:\WINDOWS\system32\services.exe
          C:\WINDOWS\system32\lsass.exe
          C:\WINDOWS\system32\svchost.exe
          C:\WINDOWS\System32\svchost.exe
          C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
          C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
          C:\WINDOWS\system32\spoolsv.exe
          C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
          C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
          C:\WINDOWS\eHome\ehRecvr.exe
          C:\WINDOWS\eHome\ehSched.exe
          C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
          C:\Program Files\CDBurnerXP\NMSAccessU.exe
          C:\WINDOWS\system32\nvsvc32.exe
          C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
          C:\WINDOWS\system32\svchost.exe
          C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
          C:\WINDOWS\Explorer.EXE
          C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
          C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
          C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
          C:\WINDOWS\system32\dllhost.exe
          C:\Program Files\Apoint\Apoint.exe
          C:\WINDOWS\ehome\ehtray.exe
          C:\WINDOWS\system32\ICO.EXE
          C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
          C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
          C:\Program Files\Sony\ISB Utility\ISBMgr.exe
          C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
          C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
          C:\WINDOWS\eHome\ehmsas.exe
          C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
          C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
          C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
          C:\Program Files\Apoint\Apntex.exe
          C:\Program Files\iTunes\iTunesHelper.exe
          C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
          C:\WINDOWS\system32\ctfmon.exe
          C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
          C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
          C:\Program Files\Microsoft Money 1998\MNYCoreFiles\System\reminder.exe
          C:\Program Files\Picasa2\PicasaMediaDetector.exe
          C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
          C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
          C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
          C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
          C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
          C:\Program Files\Messenger\msmsgs.exe
          C:\Program Files\Windows Live\Messenger\usnsvc.exe
          C:\Program Files\iPod\bin\iPodService.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\WINDOWS\system32\wuauclt.exe
          C:\Program Files\Internet Explorer\IEXPLORE.EXE
          C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
          C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

          R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://fr.yahoo.com/
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
          R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
          O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll (file missing)
          O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
          O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
          O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
          O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
          O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
          O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
          O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
          O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"
          O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
          O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
          O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
          O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
          O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
          O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
          O4 - HKLM\..\Run: [VAIO Update 3] "C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe" /Stationary
          O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
          O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
          O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
          O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
          O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
          O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
          O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
          O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
          O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money 1998\MNYCoreFiles\System\reminder.exe
          O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
          O4 - HKLM\..\Policies\Explorer\Run: [QuickTime Task] C:\Program Files\WebMediaViewer\qttask.exe
          O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Program Files\WebMediaViewer\hpmon.exe
          O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
          O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
          O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
          O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
          O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
          O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
          O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
          O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
          O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
          O8 - Extra context menu item: Ajouter un site de support RSS à VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
          O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
          O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
          O8 - Extra context menu item: Transfert par Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
          O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
          O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
          O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
          O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
          O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
          O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
          O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
          O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
          O15 - Trusted Zone: *.sony-europe.com
          O15 - Trusted Zone: *.sonystyle-europe.com
          O15 - Trusted Zone: *.vaio-link.com
          O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
          O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://millie19emilie19.spaces.live.com//PhotoUpload/MsnPUpld.cab
          O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) -
          O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader4.cab
          O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader5.cab
          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
          O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
          O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
          O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
          O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
          O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
          O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
          O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
          O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
          O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
          O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
          O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
          O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
          O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
          O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
          O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
          O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
          O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
          O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
          O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
          O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
          O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
          O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
          O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
          O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
          O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
          O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
          O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
          O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
          O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
          2. jlpjlp Contributeur sécurité
            parfait

            remets un rapport hijackhtis et dis si encore des soucis
            1. eilime19
              ========== FILES ==========
              Folder move failed. c:\program files\WebMediaViewer scheduled to be moved on reboot.
              File/Folder c:\program files\WebMediaViewer\hpmon.exe not found.
              DllUnregisterServer procedure not found in c:\program files\WebMediaViewer\hpmun.dll
              c:\program files\WebMediaViewer\hpmun.dll NOT unregistered.
              File move failed. c:\program files\WebMediaViewer\hpmun.dll scheduled to be moved on reboot.
              c:\program files\WebMediaViewer\qttask.exe moved successfully.
              ========== COMMANDS ==========
              File delete failed. C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\hpodvd09.log scheduled to be deleted on reboot.
              File delete failed. C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DF4ACA.tmp scheduled to be deleted on reboot.
              File delete failed. C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DF4ADD.tmp scheduled to be deleted on reboot.
              File delete failed. C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DFD055.tmp scheduled to be deleted on reboot.
              File delete failed. C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DFD163.tmp scheduled to be deleted on reboot.
              User's Temp folder emptied.
              User's Temporary Internet Files folder emptied.
              User's Internet Explorer cache folder emptied.
              Local Service Temp folder emptied.
              File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
              Local Service Temporary Internet Files folder emptied.
              File delete failed. C:\WINDOWS\temp\JETDA43.tmp scheduled to be deleted on reboot.
              File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_524.dat scheduled to be deleted on reboot.
              Windows Temp folder emptied.
              Java cache emptied.
              FireFox cache emptied.
              Temp folders emptied.
              Explorer started successfully
              Error: Unable to interpret <Registry:: > in the current context!
              Error: Unable to interpret <[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}] > in the current context!
              Error: Unable to interpret <[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversio­n\policies\explorer\Run] > in the current context!
              Error: Unable to interpret <"QuickTime Task"=- > in the current context!
              Error: Unable to interpret <"VMware hptray"=- > in the current context!

              OTMoveIt3 by OldTimer - Version 1.0.7.1 log created on 11262008_180901

              Files moved on Reboot...
              c:\program files\WebMediaViewer moved successfully.
              File c:\program files\WebMediaViewer\hpmun.dll not found!
              C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\hpodvd09.log moved successfully.
              File C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DF4ACA.tmp not found!
              File C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DF4ADD.tmp not found!
              File C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DFD055.tmp not found!
              File C:\DOCUME~1\MILIE~1\LOCALS~1\Temp\~DFD163.tmp not found!
              File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
              File C:\WINDOWS\temp\JETDA43.tmp not found!
              File C:\WINDOWS\temp\Perflib_Perfdata_524.dat not found!
              1. jlpjlp Contributeur sécurité
                non pas bon alors:

                télécharge OTMoveIt
                http://oldtimer.geekstogo.com/OTMoveIt3.exe (de Old_Timer) sur ton Bureau.

                double-clique sur OTMoveIt.exe pour le lancer.
                copie la liste qui se trouve en citation ci-dessous,
                et colle-la dans le cadre de gauche de OTMoveIt :Paste instruction for items to be moved.

                :files
                c:\program files\WebMediaViewer
                c:\program files\WebMediaViewer\hpmon.exe
                c:\program files\WebMediaViewer\hpmun.dll
                c:\program files\WebMediaViewer\qttask.exe

                :commands
                [purity]
                [emptytemp]
                [start explorer]

                Registry::
                [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
                [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversio­n\policies\explorer\Run]
                "QuickTime Task"=-
                "VMware hptray"=-

                clique sur MoveIt! pour lancer la suppression.
                le résultat apparaitra dans le cadre "Results".
                clique sur Exit pour fermer.
                poste le rapport situé dans C:\_OTMoveIt\MovedFiles.

                il te sera peut-être demander de redémarrer le pc pour achever la suppression.si c'est le cas accepte par Yes.
                1. eilime19 Auteur
                  voila alors j' ai recommencé en coupant kaspersky j' espére que c' est bon dis moi.

                  ComboFix 08-11-21.05 - émilie 2008-11-25 15:43:06.3 - NTFSx86
                  Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.415 [GMT 1:00]
                  Lancé depuis: c:\documents and settings\émilie\Bureau\ComboFix.exe
                  Commutateurs utilisés :: c:\documents and settings\émilie\Bureau\CFscript.txt
                  * Un nouveau point de restauration a été créé

                  [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
                  .

                  ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-25 au 2008-11-25 ))))))))))))))))))))))))))))))))))))
                  .

                  2008-11-21 21:54 . 2008-11-21 23:48 <REP> d-------- c:\program files\Navilog1
                  2008-11-21 21:42 . 2008-11-21 21:42 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
                  2008-11-21 21:42 . 2008-11-21 21:42 <REP> d-------- c:\documents and settings\émilie\Application Data\Malwarebytes
                  2008-11-21 21:42 . 2008-11-21 21:42 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
                  2008-11-21 21:42 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
                  2008-11-21 21:42 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
                  2008-11-21 13:45 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe
                  2008-11-21 13:45 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe
                  2008-11-21 13:45 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe
                  2008-11-21 12:48 . 2008-11-21 12:48 <REP> d-------- c:\documents and settings\MILIE~1ttings\émilie
                  2008-11-21 12:48 . 2008-11-21 12:48 <REP> d-------- c:\documents and settings\MILIE~1ttings
                  2008-11-21 12:17 . 2008-11-21 22:19 <REP> d-------- C:\ToolBar SD
                  2008-11-21 12:04 . 2008-11-21 12:04 <REP> d-------- C:\rsit
                  2008-11-21 11:30 . 2008-11-21 11:30 <REP> d-------- c:\program files\Trend Micro
                  2008-11-21 11:00 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
                  2008-11-21 11:00 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
                  2008-11-21 11:00 . 2008-03-14 09:09 86,528 --a------ c:\windows\system32\VACFix.exe
                  2008-11-21 11:00 . 2008-03-15 17:16 82,432 --a------ c:\windows\system32\IEDFix.exe
                  2008-11-21 11:00 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
                  2008-11-21 11:00 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
                  2008-11-20 07:11 . 2008-11-21 21:01 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
                  2008-11-20 07:10 . 2008-11-20 07:10 <REP> d-------- c:\program files\WebMediaViewer
                  2008-11-14 00:35 . 2008-11-14 00:35 197 --a------ c:\windows\system32\MRT.INI
                  2008-11-13 07:35 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
                  2008-10-25 09:03 . 2008-10-25 09:03 <REP> d-------- c:\program files\MSN Pictures Displayer
                  2008-10-25 09:03 . 2008-10-25 09:03 <REP> d-------- c:\documents and settings\émilie\Application Data\MSN Pictures Displayer
                  2008-10-25 09:03 . 2008-10-25 09:03 446,976 --a------ c:\windows\system32\ShellMPD.dll

                  .
                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  2008-11-25 14:46 68,171,296 --sha-w c:\windows\system32\drivers\fidbox.dat
                  2008-11-25 14:46 1,146,656 --sha-w c:\windows\system32\drivers\fidbox2.dat
                  2008-11-25 12:57 --------- d-----w c:\documents and settings\émilie\Application Data\OpenOffice.org2
                  2008-11-25 12:57 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
                  2008-11-25 12:30 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
                  2008-11-25 06:33 910,328 --sha-w c:\windows\system32\drivers\fidbox.idx
                  2008-11-25 06:33 108,848 --sha-w c:\windows\system32\drivers\fidbox2.idx
                  2008-11-21 23:10 6,862 ----a-w c:\documents and settings\émilie\Application Data\wklnhst.dat
                  2008-11-21 20:26 3,702 ----a-w c:\windows\system32\tmp.reg
                  2008-11-21 20:13 --------- d-----w c:\program files\Microsoft Money 2007
                  2008-11-20 12:28 --------- d-----w c:\documents and settings\émilie\Application Data\Ford Error Hide
                  2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
                  2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
                  2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
                  2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
                  2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
                  2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
                  2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
                  2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
                  2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
                  2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
                  2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
                  2008-10-14 14:06 --------- d-----w c:\program files\CDBurnerXP
                  2008-10-14 14:06 --------- d-----w c:\documents and settings\émilie\Application Data\Canneverbe_Limited
                  2008-09-30 18:17 --------- d-----w c:\program files\Picasa2
                  2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
                  2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys
                  2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll
                  2008-08-26 08:11 826,368 ----a-w c:\windows\system32\wininet.dll
                  .

                  ((((((((((((((((((((((((((((( snapshot@2008-11-22_16.21.47.25 )))))))))))))))))))))))))))))))))))))))))
                  .
                  - 2008-11-22 07:53:38 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
                  + 2008-11-25 10:55:32 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
                  - 2008-11-22 07:53:38 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                  + 2008-11-25 10:55:32 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                  + 2008-11-25 12:55:39 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_774.dat
                  .
                  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                  .
                  .
                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                  REGEDIT4

                  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
                  2008-11-25 13:56 31518 --a------ c:\program files\WebMediaViewer\hpmun.dll

                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
                  "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-22 68856]
                  "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
                  "SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 81920]
                  "Reminder"="c:\program files\Microsoft Money 1998\MNYCoreFiles\System\reminder.exe" [1997-10-13 35840]
                  "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                  "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-08 7561216]
                  "Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-17 118784]
                  "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
                  "VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]
                  "SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-27 217088]
                  "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
                  "Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128]
                  "Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 483328]
                  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
                  "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2006-10-23 40048]
                  "VAIO Update 3"="c:\program files\Sony\VAIO Update 3\VAIOUpdt.exe" [2007-01-25 546936]
                  "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
                  "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
                  "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-31 271672]
                  "Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 c:\windows\system32\ico.exe]

                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
                  "DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
                  "QuickTime Task"="c:\program files\WebMediaViewer\qttask.exe" [2008-11-20 56687]
                  "VMware hptray"="c:\program files\WebMediaViewer\hpmon.exe" [2008-11-20 73493]

                  c:\documents and settings\bastien\Menu D‚marrer\Programmes\D‚marrage\
                  Programme de d‚marrage du Mode automatique Click to DVD.lnk - c:\program files\Sony\Click to DVD 2\ctdatsvr.exe [2006-09-02 86016]

                  c:\documents and settings\‚milie\Menu D‚marrer\Programmes\D‚marrage\
                  MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-10-25 4708864]
                  OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]
                  Outil de d‚tection de support de Cyber-shot Viewer.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-12-25 155648]

                  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                  Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-05-10 738968]
                  HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
                  Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
                  2006-03-09 13:51 73728 c:\windows\system32\VESWinlogon.dll

                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                  "VIDC.dvsd"= c:\progra~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
                  "MSACM.MSNAUDIO"= msnaudio.acm

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
                  "DisableMonitoring"=dword:00000001

                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                  "DisableMonitoring"=dword:00000001

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                  "EnableFirewall"= 0 (0x0)

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                  "%windir%\\system32\\sessmgr.exe"=
                  "c:\\Program Files\\Adobe\\Photoshop Elements 4.0\\AdobePhotoshopElementsMediaServer.exe"=
                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                  "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                  "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                  "c:\\Program Files\\Shareaza\\Shareaza.exe"=
                  "c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
                  "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                  "c:\\Program Files\\Messenger\\msmsgs.exe"=
                  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                  "c:\\Program Files\\iTunes\\iTunes.exe"=
                  "c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\French\\setup.exe"=

                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                  "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

                  R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB []
                  R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
                  R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2006-07-27 30080]
                  R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-07-27 808448]
                  S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 2\IcVzMon.exe [2006-09-02 32768]
                  S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-11-21 38496]
                  S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB []
                  .
                  Contenu du dossier 'Tâches planifiées'

                  2008-10-22 c:\windows\Tasks\AppleSoftwareUpdate.job
                  - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-07-25 13:15]
                  .

                  **************************************************************************

                  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                  Rootkit scan 2008-11-25 15:46:06
                  Windows 5.1.2600 Service Pack 2 NTFS

                  Recherche de processus cachés ...

                  Recherche d'éléments en démarrage automatique cachés ...

                  Recherche de fichiers cachés ...

                  Scan terminé avec succès
                  Fichiers cachés: 0

                  **************************************************************************
                  .
                  Heure de fin: 2008-11-25 15:47:29
                  ComboFix-quarantined-files.txt 2008-11-25 14:47:23
                  ComboFix2.txt 2008-11-25 13:51:31
                  ComboFix3.txt 2008-11-22 15:22:50

                  Avant-CF: 23,798,198,272 octets libres
                  Après-CF: 23,787,655,168 octets libres

                  193 --- E O F --- 2008-11-21 20:40:00
                  1. eilime19 Auteur
                    Encore une question, quand je clique sur Cfscript et que je le glisse sur combofix et que je relache ma souris, combofix ne s' ouvre pas diérectement j' ai une fenêtre qui me demande exécuter ou annuler, et la premiére fois que j' ai fais la manip il est vrai que je n' ai pas eu le mesaage: type1 to continue, or 2 to abort) est ce normal ??
                    1. eilime19 Auteur
                      ok, mais je vois pas où je me suis trompée. Par contre peux tu me redonner l' orthographe de CFscript ??? Car tu l' as ecrit de plusieurs façon: CFscript, CFScript ou le i avec un tréma ???
                      1. jlpjlp Contributeur sécurité
                        C:\windows etc j' attaque directement à folder ???

                        OUI

                        et desactive kaspersky le temps de la manœuvre
                        1. eilime19 Auteur
                          et je ne recopie pas :
                          collect::
                          C:\windows etc j' attaque directement à folder ???
                          Je ne comprends ce que j' ai pu faire pour que ça ne fonctionne pas, par contre lorsque le scan à été lancé, j' ai eu sans arret des messages d' alertes d' intrusions dans mons systéme par Kaspersky hors connexion.
                          1. jlpjlp Contributeur sécurité
                            tu as mal fais fais avec ce qui suis :

                            Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                            folder::
                            c:\program files\WebMediaViewer

                            File::
                            c:\program files\WebMediaViewer\hpmon.exe
                            c:\program files\WebMediaViewer\hpmun.dll
                            c:\program files\WebMediaViewer\qttask.exe

                            Registry::
                            [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
                            [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversio­n\policies\explorer\Run]
                            "QuickTime Task"=-
                            "VMware hptray"=-

                            Enregistre ce fichier sous le nom CFscript (bien mettre majusule et minuscule)

                            Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                            Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                            Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                            Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                            Ne touche à rien tant que le scan n'est pas terminé.

                            Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                            Remets aussi un rapport Hijackthis et surtout dis si encore des soucis

                            Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
                            1. eilime19 Auteur
                              Logfile of Trend Micro HijackThis v2.0.2
                              Scan saved at 14:58, on 2008-11-25
                              Platform: Windows XP SP2 (WinNT 5.01.2600)
                              MSIE: Internet Explorer v7.00 (7.00.6000.16735)
                              Boot mode: Normal

                              Running processes:
                              C:\WINDOWS\System32\smss.exe
                              C:\WINDOWS\system32\winlogon.exe
                              C:\WINDOWS\system32\services.exe
                              C:\WINDOWS\system32\lsass.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\WINDOWS\System32\svchost.exe
                              C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                              C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                              C:\WINDOWS\system32\spoolsv.exe
                              C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
                              C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                              C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
                              C:\WINDOWS\eHome\ehRecvr.exe
                              C:\WINDOWS\eHome\ehSched.exe
                              C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
                              C:\Program Files\CDBurnerXP\NMSAccessU.exe
                              C:\WINDOWS\system32\nvsvc32.exe
                              C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                              C:\WINDOWS\system32\svchost.exe
                              C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                              C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                              C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                              C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                              C:\Program Files\WebMediaViewer\qttask.exe
                              C:\Program Files\WebMediaViewer\qttaskm.exe
                              C:\Program Files\WebMediaViewer\hpmon.exe
                              C:\Program Files\Apoint\Apoint.exe
                              C:\WINDOWS\ehome\ehtray.exe
                              C:\WINDOWS\system32\ICO.EXE
                              C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe
                              C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
                              C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                              C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
                              C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
                              C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe
                              C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                              C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
                              C:\Program Files\iTunes\iTunesHelper.exe
                              C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
                              C:\WINDOWS\system32\ctfmon.exe
                              C:\Program Files\Apoint\Apntex.exe
                              C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                              C:\Program Files\Microsoft Money 1998\MNYCoreFiles\System\reminder.exe
                              C:\Program Files\Picasa2\PicasaMediaDetector.exe
                              C:\Program Files\WebMediaViewer\hpmom.exe
                              C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
                              C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                              C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
                              C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
                              C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
                              C:\WINDOWS\system32\dllhost.exe
                              C:\Program Files\iPod\bin\iPodService.exe
                              C:\Program Files\Windows Live\Messenger\usnsvc.exe
                              C:\WINDOWS\eHome\ehmsas.exe
                              C:\WINDOWS\system32\wuauclt.exe
                              C:\WINDOWS\explorer.exe
                              C:\Program Files\Windows Live\Messenger\msnmsgr.exe
                              C:\Program Files\Messenger\msmsgs.exe
                              C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

                              R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                              R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                              O2 - BHO: (no name) - {64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C} - C:\Program Files\WebMediaViewer\hpmun.dll
                              O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                              O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
                              O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
                              O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll
                              O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
                              O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                              O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
                              O4 - HKLM\..\Run: [Mouse Suite 98 Daemon] ICO.EXE
                              O4 - HKLM\..\Run: [VAIOCameraUtility] "C:\Program Files\Sony\VAIO Camera Utility\VCUServe.exe"
                              O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
                              O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
                              O4 - HKLM\..\Run: [Switcher.exe] C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe
                              O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
                              O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
                              O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
                              O4 - HKLM\..\Run: [VAIO Update 3] "C:\Program Files\Sony\VAIO Update 3\VAIOUpdt.exe" /Stationary
                              O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
                              O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
                              O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
                              O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                              O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
                              O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
                              O4 - HKCU\..\Run: [SsAAD.exe] C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
                              O4 - HKCU\..\Run: [Reminder] C:\Program Files\Microsoft Money 1998\MNYCoreFiles\System\reminder.exe
                              O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [QuickTime Task] C:\Program Files\WebMediaViewer\qttask.exe
                              O4 - HKLM\..\Policies\Explorer\Run: [VMware hptray] C:\Program Files\WebMediaViewer\hpmon.exe
                              O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
                              O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
                              O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
                              O4 - Startup: MSN Pictures Displayer.lnk = C:\Program Files\MSN Pictures Displayer\MSN Pictures Displayer.exe
                              O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
                              O4 - Startup: Outil de détection de support de Cyber-shot Viewer.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
                              O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
                              O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
                              O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
                              O8 - Extra context menu item: Ajouter un site de support RSS à VAIO Information FLOW - C:\Program Files\Sony\VAIO Information FLOW\aiesc.html
                              O8 - Extra context menu item: Ajouter à Kaspersky Anti-Bannière - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
                              O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
                              O8 - Extra context menu item: Transfert par Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
                              O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                              O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
                              O9 - Extra button: Statistiques d’Anti-Virus Internet - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
                              O9 - Extra button: (no name) - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
                              O9 - Extra 'Tools' menuitem: IExplorer Security - {3B8FB116-D358-48A3-A5C7-DB84F15CBB04} - http://www.ietoolexpress.com/redirect.php (file missing)
                              O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
                              O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                              O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                              O14 - IERESET.INF: START_PAGE_URL=http://www.club-vaio.com/fr/
                              O15 - Trusted Zone: *.sony-europe.com
                              O15 - Trusted Zone: *.sonystyle-europe.com
                              O15 - Trusted Zone: *.vaio-link.com
                              O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
                              O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://millie19emilie19.spaces.live.com//PhotoUpload/MsnPUpld.cab
                              O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) -
                              O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader4.cab
                              O16 - DPF: {BA162249-F2C5-4851-8ADC-FC58CB424243} (Image Uploader Control) - http://copainsdavant.linternaute.com/html_include_bibliotheque/objimageuploader/ImageUploader5.cab
                              O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
                              O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\FICHIE~1\Skype\SKYPE4~1.DLL
                              O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
                              O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                              O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
                              O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                              O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
                              O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1150\Intel 32\IDriverT.exe
                              O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
                              O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
                              O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe
                              O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
                              O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
                              O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe
                              O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
                              O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                              O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                              O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
                              O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe
                              O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
                              O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
                              O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
                              O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
                              O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
                              O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
                              O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
                              O23 - Service: VAIO Cooporated Initialisation (VCI) - Sony Corporation - C:\Program Files\Sony\VAIO Cooperated Initialisation\VCI_SVC.exe
                              O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
                              O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
                              O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
                              1. jlpjlp Contributeur sécurité
                                Ferme tous tes navigateurs (donc copie ou imprime les instructions avant)

                                Crée un nouveau document texte : clic droit de souris sur le bureau > Nouveau > Document Texte, et copie dedans les lignes suivantes :

                                Collect::
                                C:\WINDOWS\system32\drivers\pcantispy.sys
                                C:\WINDOWS\.security
                                C:\.security
                                C:\Program Files\PC-Antispy

                                folder::
                                c:\program files\WebMediaViewer

                                File::
                                c:\program files\WebMediaViewer\hpmon.exe
                                c:\program files\WebMediaViewer\hpmun.dll
                                c:\program files\WebMediaViewer\qttask.exe

                                Registry::
                                [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
                                [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversio­n\policies\explorer\Run]
                                "QuickTime Task"=-
                                "VMware hptray"=-

                                Enregistre ce fichier sous le nom CFscript

                                Fait un glisser/déposer de ce fichier CFscrïpt sur le fichier ComboFix.exe

                                Clique sur le fichier CFScript, maintient le doigt enfoncé et glisse la souris pour que l'icône du CFScript vienne recouvrir l'icône de Combofix. Relache la souris. Combofix va démarrer.

                                Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

                                Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

                                Ne touche à rien tant que le scan n'est pas terminé.

                                Une fois le scan achevé, un rapport va s'afficher: poste son contenu.

                                Remets aussi un rapport Hijackthis et surtout dis si encore des soucis

                                Si le fichier ne s'ouvre pas, il se trouve ici > C:\ComboFix.txt
                                1. eilime19
                                  ComboFix 08-11-21.05 - émilie 2008-11-25 14:37:07.2 - NTFSx86
                                  Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.417 [GMT 1:00]
                                  Lancé depuis: c:\documents and settings\émilie\Bureau\ComboFix.exe

                                  [COLOR=RED][B]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/B][/COLOR]
                                  .

                                  ((((((((((((((((((((((((((((( Fichiers créés du 2008-10-25 au 2008-11-25 ))))))))))))))))))))))))))))))))))))
                                  .

                                  2008-11-21 21:54 . 2008-11-21 23:48 <REP> d-------- c:\program files\Navilog1
                                  2008-11-21 21:42 . 2008-11-21 21:42 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware
                                  2008-11-21 21:42 . 2008-11-21 21:42 <REP> d-------- c:\documents and settings\émilie\Application Data\Malwarebytes
                                  2008-11-21 21:42 . 2008-11-21 21:42 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
                                  2008-11-21 21:42 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
                                  2008-11-21 21:42 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
                                  2008-11-21 13:45 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\o4Patch.exe
                                  2008-11-21 13:45 . 2008-10-10 07:58 82,944 --a------ c:\windows\system32\IEDFix.C.exe
                                  2008-11-21 13:45 . 2008-08-18 11:19 82,432 --a------ c:\windows\system32\404Fix.exe
                                  2008-11-21 12:48 . 2008-11-21 12:48 <REP> d-------- c:\documents and settings\MILIE~1ttings\émilie
                                  2008-11-21 12:48 . 2008-11-21 12:48 <REP> d-------- c:\documents and settings\MILIE~1ttings
                                  2008-11-21 12:17 . 2008-11-21 22:19 <REP> d-------- C:\ToolBar SD
                                  2008-11-21 12:04 . 2008-11-21 12:04 <REP> d-------- C:\rsit
                                  2008-11-21 11:30 . 2008-11-21 11:30 <REP> d-------- c:\program files\Trend Micro
                                  2008-11-21 11:00 . 2007-09-05 23:22 289,144 --a------ c:\windows\system32\VCCLSID.exe
                                  2008-11-21 11:00 . 2006-04-27 16:49 288,417 --a------ c:\windows\system32\SrchSTS.exe
                                  2008-11-21 11:00 . 2008-03-14 09:09 86,528 --a------ c:\windows\system32\VACFix.exe
                                  2008-11-21 11:00 . 2008-03-15 17:16 82,432 --a------ c:\windows\system32\IEDFix.exe
                                  2008-11-21 11:00 . 2004-07-31 17:50 51,200 --a------ c:\windows\system32\dumphive.exe
                                  2008-11-21 11:00 . 2007-10-03 23:36 25,600 --a------ c:\windows\system32\WS2Fix.exe
                                  2008-11-20 07:11 . 2008-11-21 21:01 <REP> d-a------ c:\documents and settings\All Users\Application Data\TEMP
                                  2008-11-20 07:10 . 2008-11-20 07:10 <REP> d-------- c:\program files\WebMediaViewer
                                  2008-11-14 00:35 . 2008-11-14 00:35 197 --a------ c:\windows\system32\MRT.INI
                                  2008-11-13 07:35 . 2008-10-24 12:10 453,632 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
                                  2008-10-25 09:03 . 2008-10-25 09:03 <REP> d-------- c:\program files\MSN Pictures Displayer
                                  2008-10-25 09:03 . 2008-10-25 09:03 <REP> d-------- c:\documents and settings\émilie\Application Data\MSN Pictures Displayer
                                  2008-10-25 09:03 . 2008-10-25 09:03 446,976 --a------ c:\windows\system32\ShellMPD.dll

                                  .
                                  (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
                                  .
                                  2008-11-25 13:45 67,965,216 --sha-w c:\windows\system32\drivers\fidbox.dat
                                  2008-11-25 13:44 1,141,280 --sha-w c:\windows\system32\drivers\fidbox2.dat
                                  2008-11-25 12:57 --------- d-----w c:\documents and settings\émilie\Application Data\OpenOffice.org2
                                  2008-11-25 12:57 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab
                                  2008-11-25 12:30 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
                                  2008-11-25 06:33 910,328 --sha-w c:\windows\system32\drivers\fidbox.idx
                                  2008-11-25 06:33 108,848 --sha-w c:\windows\system32\drivers\fidbox2.idx
                                  2008-11-21 23:10 6,862 ----a-w c:\documents and settings\émilie\Application Data\wklnhst.dat
                                  2008-11-21 20:26 3,702 ----a-w c:\windows\system32\tmp.reg
                                  2008-11-21 20:13 --------- d-----w c:\program files\Microsoft Money 2007
                                  2008-11-20 12:28 --------- d-----w c:\documents and settings\émilie\Application Data\Ford Error Hide
                                  2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
                                  2008-10-16 13:13 202,776 ----a-w c:\windows\system32\wuweb.dll
                                  2008-10-16 13:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
                                  2008-10-16 13:12 561,688 ----a-w c:\windows\system32\wuapi.dll
                                  2008-10-16 13:12 323,608 ----a-w c:\windows\system32\wucltui.dll
                                  2008-10-16 13:09 92,696 ----a-w c:\windows\system32\cdm.dll
                                  2008-10-16 13:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
                                  2008-10-16 13:09 43,544 ----a-w c:\windows\system32\wups2.dll
                                  2008-10-16 13:08 34,328 ----a-w c:\windows\system32\wups.dll
                                  2008-10-16 13:06 268,648 ----a-w c:\windows\system32\mucltui.dll
                                  2008-10-16 13:06 208,744 ----a-w c:\windows\system32\muweb.dll
                                  2008-10-14 14:06 --------- d-----w c:\program files\CDBurnerXP
                                  2008-10-14 14:06 --------- d-----w c:\documents and settings\émilie\Application Data\Canneverbe_Limited
                                  2008-09-30 18:17 --------- d-----w c:\program files\Picasa2
                                  2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
                                  2008-09-15 15:39 1,846,144 ----a-w c:\windows\system32\win32k.sys
                                  2008-09-04 16:45 1,106,944 ----a-w c:\windows\system32\msxml3.dll
                                  2008-08-26 08:11 826,368 ----a-w c:\windows\system32\wininet.dll
                                  .

                                  ((((((((((((((((((((((((((((( snapshot@2008-11-22_16.21.47.25 )))))))))))))))))))))))))))))))))))))))))
                                  .
                                  - 2008-11-22 07:53:38 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
                                  + 2008-11-25 10:55:32 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
                                  - 2008-11-22 07:53:38 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                                  + 2008-11-25 10:55:32 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Historique\History.IE5\index.dat
                                  + 2008-11-25 12:55:39 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_774.dat
                                  .
                                  ((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
                                  .
                                  .
                                  *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
                                  REGEDIT4

                                  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
                                  2008-11-25 13:56 31518 --a------ c:\program files\WebMediaViewer\hpmun.dll

                                  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                  "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
                                  "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-22 68856]
                                  "MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
                                  "SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.exe" [2006-05-08 81920]
                                  "Reminder"="c:\program files\Microsoft Money 1998\MNYCoreFiles\System\reminder.exe" [1997-10-13 35840]
                                  "Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]

                                  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
                                  "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-05-08 7561216]
                                  "Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-17 118784]
                                  "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
                                  "VAIOCameraUtility"="c:\program files\Sony\VAIO Camera Utility\VCUServe.exe" [2005-12-27 69632]
                                  "SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-27 217088]
                                  "ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
                                  "Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128]
                                  "Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2005-03-03 483328]
                                  "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
                                  "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2006-10-23 40048]
                                  "VAIO Update 3"="c:\program files\Sony\VAIO Update 3\VAIOUpdt.exe" [2007-01-25 546936]
                                  "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]
                                  "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
                                  "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-31 271672]
                                  "Mouse Suite 98 Daemon"="ICO.EXE" [2002-03-14 c:\windows\system32\ico.exe]

                                  [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
                                  "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]
                                  "DWQueuedReporting"="c:\progra~1\FICHIE~1\MICROS~1\DW\dwtrig20.exe" [2007-03-22 39264]

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
                                  "QuickTime Task"="c:\program files\WebMediaViewer\qttask.exe" [2008-11-20 56687]
                                  "VMware hptray"="c:\program files\WebMediaViewer\hpmon.exe" [2008-11-20 73493]

                                  c:\documents and settings\bastien\Menu D‚marrer\Programmes\D‚marrage\
                                  Programme de d‚marrage du Mode automatique Click to DVD.lnk - c:\program files\Sony\Click to DVD 2\ctdatsvr.exe [2006-09-02 86016]

                                  c:\documents and settings\‚milie\Menu D‚marrer\Programmes\D‚marrage\
                                  MSN Pictures Displayer.lnk - c:\program files\MSN Pictures Displayer\MSN Pictures Displayer.exe [2008-10-25 4708864]
                                  OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]
                                  Outil de d‚tection de support de Cyber-shot Viewer.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-12-25 155648]

                                  c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
                                  Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-05-10 738968]
                                  HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
                                  Lancement rapide d'Adobe Reader.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
                                  2006-03-09 13:51 73728 c:\windows\system32\VESWinlogon.dll

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
                                  "VIDC.dvsd"= c:\progra~1\FICHIE~1\SONYSH~1\VideoLib\sonydv.dll
                                  "MSACM.MSNAUDIO"= msnaudio.acm

                                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
                                  "DisableMonitoring"=dword:00000001

                                  [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
                                  "DisableMonitoring"=dword:00000001

                                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
                                  "EnableFirewall"= 0 (0x0)

                                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
                                  "%windir%\\system32\\sessmgr.exe"=
                                  "c:\\Program Files\\Adobe\\Photoshop Elements 4.0\\AdobePhotoshopElementsMediaServer.exe"=
                                  "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
                                  "c:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
                                  "c:\\Program Files\\LimeWire\\LimeWire.exe"=
                                  "c:\\Program Files\\Shareaza\\Shareaza.exe"=
                                  "c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
                                  "c:\\Program Files\\Skype\\Phone\\Skype.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
                                  "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
                                  "c:\\Program Files\\Messenger\\msmsgs.exe"=
                                  "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
                                  "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
                                  "c:\\Program Files\\iTunes\\iTunes.exe"=
                                  "c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Internet Security 7.0.1.325\\French\\setup.exe"=

                                  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
                                  "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

                                  R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB []
                                  R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2007-12-13 24592]
                                  R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2006-07-27 30080]
                                  R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-07-27 808448]
                                  S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;c:\program files\Sony\Image Converter 2\IcVzMon.exe [2006-09-02 32768]
                                  S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys [2008-11-21 38496]
                                  S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB []
                                  .
                                  Contenu du dossier 'Tâches planifiées'

                                  2008-10-22 c:\windows\Tasks\AppleSoftwareUpdate.job
                                  - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-07-25 13:15]
                                  .
                                  .
                                  ------- Examen supplémentaire -------
                                  .
                                  FireFox -: Profile - c:\documents and settings\émilie\Application Data\Mozilla\Firefox\Profiles\exi7qws1.default\
                                  FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.msn.fr/
                                  .

                                  **************************************************************************

                                  catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
                                  Rootkit scan 2008-11-25 14:44:13
                                  Windows 5.1.2600 Service Pack 2 NTFS

                                  Recherche de processus cachés ...

                                  Recherche d'éléments en démarrage automatique cachés ...

                                  Recherche de fichiers cachés ...

                                  **************************************************************************
                                  .
                                  Heure de fin: 2008-11-25 14:51:23
                                  ComboFix-quarantined-files.txt 2008-11-25 13:46:52
                                  ComboFix2.txt 2008-11-22 15:22:50

                                  Avant-CF: 23 756 349 440 octets libres
                                  Après-CF: 23,853,502,464 octets libres

                                  194 --- E O F --- 2008-11-21 20:40:00
                              2. eilime19 Auteur
                                alors non je n' ai pas télécharger webmediaviewer, je sais même pas ce que c' est d' ailleurs !!! et pour ce qui se passe le triangle jaune est tjs là, avec system alert: malware threats qui s' affiche dans une bulle et aussi quand je clique sur internet explorer pour me connecté j' arrive sur la page de security center, qui m' annonce que j' ai un virus et qu' il faut que j' achète leur anti virus et impossible d' aller voir mes mails sur yahoo, dés que j' y vais ça me renvoit sur une page avec erreur de connexion......et j' ai sans arret des fenetres qui s' ouvrent comme quoi je suis infesté, voila sinon plus d apparition de trigger.
                                1. jlpjlp Contributeur sécurité
                                  arrète

                                  et dis moi:
                                  c'est toi qui as mis
                                  WebMediaViewer???

                                  et dis moi si encore des soucis

                                  _____________

                                  je me mets de coté ceci
                                  c:\program files\WebMediaViewer

                                  [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64466B8E-20A7-4A4A-AFF4-AAD9CA68B52C}]
                                  2008-11-22 16:18 31518 --a------ c:\program files\WebMediaViewer\hpmun.dll

                                  [HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
                                  "QuickTime Task"="c:\program files\WebMediaViewer\qttask.exe" [2008-11-20 56687]
                                  "VMware hptray"="c:\program files\WebMediaViewer\hpmon.exe" [2008-11-20 73493]
                                  1. eilime19 Auteur
                                    J' ai mis les deux fichiers en analyse depuis ce matin, et ça mouline toujours je pense que ça marche pas, est ce que c' est normal ? Est ce qu' il faut que je fasse autre chose ???
                                    1. jlpjlp Contributeur sécurité
                                      analyse ces deux fichiers sur virus total et colle le rapport

                                      https://www.virustotal.com/gui/

                                      c:\program files\WebMediaViewer\qttaskm.exe
                                      c:\program files\WebMediaViewer\hpmom.exe

                                      _____________

                                      puis refais hijakchits et colle le rapport (si cela passe pas ajoute un point ou une lettre a la fin du rapport et cela passera)
                                      1. eilime19 Auteur
                                        J ai relancé hijackthis, j ai un rapport mais lorsque je veux le coller sur la page du forum ça me dit impossible que je l' ai deja poster.
                                        • 1
                                        • 2
                                        • 3

                                        Discussions similaires

                                        Softonic,est-ce un virus ?
                                        techmel1

                                        6 réponses
                                        se debarasser de fausses alerte virus
                                        Evka

                                        1 réponse
                                        Chrome://newtab
                                        Nova

                                        14 réponses
                                        Désinstaller Softonic
                                        Diguimette

                                        5 réponses
                                        Supprimer New Tab
                                        tysaozon

                                        8 réponses