[Trojan] Infecté par Win32:VBStat-c

Résolu
chibiluk -  
Bonjour,
Mon antivirus a détecté ce trojan mais est incapable de s'en débarassé.
J'ai donc télécharger Hijackthis afin de résoudre ce problème avec votre aide si vous le voulez bien. Je vous remercie d'avance. Avant de créer un log Hijack dois-je le renommer en scanner?
Configuration: Windows XP
Firefox 2.0.0.4

19 réponses

  1. chibiluk Auteur
    Voici mon log après avoir renommé Hijackthis.exe en Scanner.exe

    Logfile of HijackThis v1.99.1
    Scan saved at 16:13:37, on 04/06/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16441)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\Program Files\Equant\Dialer\EACSvrMngr.exe
    C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
    C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
    C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\Program Files\OCS Inventory Agent\ocsservice.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\WINDOWS\system32\nvsvct5.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Documents and Settings\All Users\Application Data\novsvida.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxsrvc.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
    C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {2AF8C526-9F8C-4171-9C3D-45AC6D2A284D} - C:\WINDOWS\system32\pmnnl.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: (no name) - {9A853E36-4A35-4DBF-9C03-AD9423798E35} - C:\WINDOWS\system32\pmnmljh.dll
    O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINDOWS\system32\menbtgse.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
    O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [novsvida.exe] C:\Documents and Settings\All Users\Application Data\novsvida.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [Genuine] rundll32.exe "C:\WINDOWS\system32\danywpdh.dll",realset
    O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
    O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
    O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
    O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = bride.fr
    O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
    O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
    O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
    O20 - Winlogon Notify: pmnmljh - C:\WINDOWS\SYSTEM32\pmnmljh.dll
    O20 - Winlogon Notify: pmnnl - C:\WINDOWS\system32\pmnnl.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: winxvb32 - C:\WINDOWS\SYSTEM32\winxvb32.dll
    O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
    O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
    O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
    O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
    O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
    O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
    O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
    O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
    O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    1. Regis59 Contributeur sécurité
      Bienvenue sur le forum d’entraide de CommentCaMarche.net

      Nous connaissons votre situation et nous vous conseillons de ne surtout pas vous inquiéter.
      De plus, au vu du nombre croissant de désinfections effectuées sur le forum, nous vous demandons un peu de patience et surtout de ne pas créer plusieurs postes pour le même problème.
      Merci de votre compréhension.

      Télécharge VundoFix.exe (par Atribune) sur ton Bureau.
      http://www.atribune.org/ccount/click.php?id=4

      Double-clique VundoFix.exe afin de le lancer.
      Coche Run VundoFix as a task.
      Un message t'avertira que l'outil va se fermer et s'ouvrir à nouveau : clique Ok
      Clique sur le bouton Scan for Vundo.
      Lorsque le scan est complété, clique sur le bouton Remove Vundo.
      Une invite te demandera si tu veux supprimer les fichiers, clique YES
      Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
      Tu verras une invite qui t'annonce que ton PC va s'éteindre ("shutdown") ; clique OK
      Démarre ton PC à nouveau.
      Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis! dans ta prochaine réponse.

      A+
      1. chibiluk Auteur
        RAPPORT HIJACK

        Logfile of HijackThis v1.99.1
        Scan saved at 09:26:23, on 05/06/2007
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v7.00 (7.00.6000.16441)

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
        C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        C:\Program Files\Alwil Software\Avast4\ashServ.exe
        C:\Program Files\Equant\Dialer\EACSvrMngr.exe
        C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
        C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
        C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
        C:\Program Files\OCS Inventory Agent\ocsservice.exe
        C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\Apoint\Apoint.exe
        C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
        C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
        C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
        C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
        C:\WINDOWS\system32\dla\tfswctrl.exe
        C:\Program Files\Apoint\Apntex.exe
        C:\WINDOWS\system32\nvsvct5.exe
        C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        C:\Documents and Settings\All Users\Application Data\novsvida.exe
        C:\WINDOWS\system32\hkcmd.exe
        C:\WINDOWS\system32\igfxpers.exe
        C:\WINDOWS\system32\igfxsrvc.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Digital Line Detect\DLG.exe
        C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
        C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
        C:\WINDOWS\System32\svchost.exe
        C:\WINDOWS\system32\wuauclt.exe
        C:\Program Files\Internet Explorer\IEXPLORE.EXE
        C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe

        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
        R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
        R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
        R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
        R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: (no name) - {2DECFF05-41D3-4276-BAD3-23074C12FB4D} - C:\WINDOWS\system32\pmnnl.dll (file missing)
        O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
        O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
        O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
        O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
        O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
        O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
        O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
        O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
        O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
        O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe
        O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
        O4 - HKLM\..\Run: [novsvida.exe] C:\Documents and Settings\All Users\Application Data\novsvida.exe
        O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
        O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
        O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
        O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\nkxjpxda.dll",realset
        O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
        O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
        O4 - Global Startup: Digital Line Detect.lnk = ?
        O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
        O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
        O11 - Options group: [INTERNATIONAL] International*
        O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
        O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
        O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = bride.fr
        O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
        O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
        O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
        O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
        O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
        O20 - Winlogon Notify: winxvb32 - C:\WINDOWS\SYSTEM32\winxvb32.dll
        O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
        O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
        O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
        O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
        O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
        O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
        O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
        O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
        O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
        O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
        O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
        O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
        O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
        O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

        RAPPORT VUNDOFIX

        VundoFix V6.4.2

        Checking Java version...

        Java version is 1.4.2.3
        Old versions of java are exploitable and should be removed.

        Scan started at 09:13:08 05/06/2007

        Listing files found while scanning....

        C:\WINDOWS\system32\adxpjxkn.ini
        C:\WINDOWS\system32\cbxwxwv.dll
        C:\WINDOWS\system32\danywpdh.dll
        C:\WINDOWS\system32\ddccbbb.dll
        C:\WINDOWS\system32\hdpwynad.ini
        C:\WINDOWS\system32\lnnmp.bak1
        C:\WINDOWS\system32\lnnmp.bak2
        C:\WINDOWS\system32\lnnmp.ini
        C:\WINDOWS\system32\lnnmp.ini2
        C:\WINDOWS\system32\lnnmp.tmp
        C:\WINDOWS\system32\menbtgse.dll
        C:\WINDOWS\system32\mhjuyvnx.dll
        C:\WINDOWS\system32\nkxjpxda.dll
        C:\WINDOWS\system32\pmnmljh.dll
        C:\WINDOWS\system32\pmnnl.dll
        C:\WINDOWS\system32\rqrpnlj.dll
        C:\WINDOWS\system32\xuyrrhpi.dll

        Beginning removal...

        Attempting to delete C:\WINDOWS\system32\adxpjxkn.ini
        C:\WINDOWS\system32\adxpjxkn.ini Has been deleted!

        Attempting to delete C:\WINDOWS\system32\cbxwxwv.dll
        C:\WINDOWS\system32\cbxwxwv.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\danywpdh.dll
        C:\WINDOWS\system32\danywpdh.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\ddccbbb.dll
        C:\WINDOWS\system32\ddccbbb.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\hdpwynad.ini
        C:\WINDOWS\system32\hdpwynad.ini Has been deleted!

        Attempting to delete C:\WINDOWS\system32\lnnmp.bak1
        C:\WINDOWS\system32\lnnmp.bak1 Has been deleted!

        Attempting to delete C:\WINDOWS\system32\lnnmp.bak2
        C:\WINDOWS\system32\lnnmp.bak2 Has been deleted!

        Attempting to delete C:\WINDOWS\system32\lnnmp.ini
        C:\WINDOWS\system32\lnnmp.ini Has been deleted!

        Attempting to delete C:\WINDOWS\system32\lnnmp.ini2
        C:\WINDOWS\system32\lnnmp.ini2 Has been deleted!

        Attempting to delete C:\WINDOWS\system32\lnnmp.tmp
        C:\WINDOWS\system32\lnnmp.tmp Has been deleted!

        Attempting to delete C:\WINDOWS\system32\menbtgse.dll
        C:\WINDOWS\system32\menbtgse.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\mhjuyvnx.dll
        C:\WINDOWS\system32\mhjuyvnx.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\nkxjpxda.dll
        C:\WINDOWS\system32\nkxjpxda.dll Could not be deleted.

        Attempting to delete C:\WINDOWS\system32\pmnmljh.dll
        C:\WINDOWS\system32\pmnmljh.dll Could not be deleted.

        Attempting to delete C:\WINDOWS\system32\pmnnl.dll
        C:\WINDOWS\system32\pmnnl.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\rqrpnlj.dll
        C:\WINDOWS\system32\rqrpnlj.dll Has been deleted!

        Performing Repairs to the registry.
        Done!

        Beginning removal...

        Attempting to delete C:\WINDOWS\system32\nkxjpxda.dll
        C:\WINDOWS\system32\nkxjpxda.dll Has been deleted!

        Attempting to delete C:\WINDOWS\system32\pmnmljh.dll
        C:\WINDOWS\system32\pmnmljh.dll Has been deleted!

        Performing Repairs to the registry.
        Done!
        1. Regis59 Contributeur sécurité
          Re,

          Vas sur le site https://virusscan.jotti.org/
          - Clic en haut à droite sur "Parcourir", navigue dans les dossiers et sélectionne ce fichier :
          C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
          - Clic sur submit toujours en haut à droite
          - Le scan va se lancer, ça va prendre un petit instant
          - En bas, tu as le résultat du scan, copie/colle le résultat complet du scan ici.
          Aide : https://www.malekal.com/scan-antivirus-ligne-nod32/#mozTocId662799
          2. chibiluk Auteur
            Voici les résultats du scan - Rien n'a été détecté

            A-Squared Found nothing
            AntiVir Found nothing
            ArcaVir Found nothing
            Avast Found nothing
            AVG Antivirus Found nothing
            BitDefender Found nothing
            ClamAV Found nothing
            Dr.Web Found nothing
            F-Prot Antivirus Found nothing
            F-Secure Anti-Virus Found nothing
            Fortinet Found nothing
            Kaspersky Anti-Virus Found nothing
            NOD32 Found nothing
            Norman Virus Control Found nothing
            Panda Antivirus Found nothing
            Rising Antivirus Found nothing
            VirusBuster Found nothing
            VBA32 Found nothing
            1. Regis59 Contributeur sécurité
              ok et tu peux faire pareil avec:
              C:\Documents and Settings\All Users\Application Data\novsvida.exe

              A+
              3. chibiluk Auteur
                Logfile of HijackThis v1.99.1
                Scan saved at 17:00:04, on 11/06/2007
                Platform: Windows XP SP2 (WinNT 5.01.2600)
                MSIE: Internet Explorer v7.00 (7.00.6000.16441)

                Running processes:
                C:\WINDOWS\System32\smss.exe
                C:\WINDOWS\system32\winlogon.exe
                C:\WINDOWS\system32\services.exe
                C:\WINDOWS\system32\lsass.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                C:\Program Files\OCS Inventory Agent\ocsservice.exe
                C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                C:\WINDOWS\system32\svchost.exe
                C:\WINDOWS\System32\svchost.exe
                C:\WINDOWS\system32\spoolsv.exe
                C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
                C:\WINDOWS\Explorer.EXE
                C:\Program Files\Apoint\Apoint.exe
                C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
                C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
                C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
                C:\WINDOWS\system32\dla\tfswctrl.exe
                C:\WINDOWS\system32\hkcmd.exe
                C:\WINDOWS\system32\igfxpers.exe
                C:\Program Files\Apoint\Apntex.exe
                C:\WINDOWS\system32\igfxsrvc.exe
                C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
                C:\WINDOWS\system32\ctfmon.exe
                C:\Program Files\Digital Line Detect\DLG.exe
                C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe

                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
                R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
                R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                O2 - BHO: (no name) - {2DECFF05-41D3-4276-BAD3-23074C12FB4D} - C:\WINDOWS\system32\pmnnl.dll (file missing)
                O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
                O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
                O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
                O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe
                O4 - HKLM\..\Run: [novsvida.exe] C:\Documents and Settings\All Users\Application Data\novsvida.exe
                O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\nkxjpxda.dll",realset
                O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
                O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                O4 - Global Startup: Digital Line Detect.lnk = ?
                O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                O11 - Options group: [INTERNATIONAL] International*
                O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
                O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
                O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
                O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
                O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
                O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
                O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                O20 - Winlogon Notify: winxvb32 - winxvb32.dll (file missing)
                O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
                O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
                O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
                O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                1. chibiluk Auteur
                  Il semblerait que ce fichier soit vu par Hijack "C:\Documents and Settings\All Users\Application Data\novsvida.exe " mais il n'apparait nulle part dans mon explorateur. J'ai bien sur activé la vision des fichiers cachés.
                  1. Regis59 Contributeur sécurité
                    Re,

                    Télécharge: Pocket Killbox ici
                    http://www.downloads.subratam.org/KillBox.exe

                    :: Démo d utilisation (merci a Balltrap34 pour cette réalisation) ::
                    http://pageperso.aol.fr/balltrap34/killbox.htm

                    puis lancer HijackThis:

                    clique sur "do a system scan only"

                    * Cocher la case au début de ces lignes:

                    O2 - BHO: (no name) - {2DECFF05-41D3-4276-BAD3-23074C12FB4D} - C:\WINDOWS\system32\pmnnl.dll (file missing)

                    O4 - HKLM\..\Run: [SvcManager] nvsvct5.exe

                    O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\nkxjpxda.dll",realset

                    O20 - Winlogon Notify: winxvb32 - winxvb32.dll (file missing)

                    * Valider avec fix checked

                    Double clic sur killbox.exe (Pocket Killbox)

                    - Avec la méthode du bloc note, voir vidéo, voici la liste a supprimer:

                    C:\WINDOWS\system32\nvsvct5.exe
                    C:\WINDOWS\system32\nkxjpxda.dll

                    Redemarre et remet un Hijackthis.

                    A+
                    1. chibiluk Auteur
                      Logfile of HijackThis v1.99.1
                      Scan saved at 10:42:32, on 12/06/2007
                      Platform: Windows XP SP2 (WinNT 5.01.2600)
                      MSIE: Internet Explorer v7.00 (7.00.6000.16441)

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                      C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                      C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                      C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                      C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                      C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                      C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                      C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                      C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                      C:\Program Files\OCS Inventory Agent\ocsservice.exe
                      C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
                      C:\WINDOWS\system32\userinit.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\Program Files\Apoint\Apoint.exe
                      C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
                      C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
                      C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
                      C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe
                      C:\WINDOWS\system32\dla\tfswctrl.exe
                      C:\WINDOWS\system32\hkcmd.exe
                      C:\WINDOWS\system32\igfxsrvc.exe
                      C:\WINDOWS\system32\igfxpers.exe
                      C:\Program Files\Apoint\Apntex.exe
                      C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
                      C:\WINDOWS\system32\ctfmon.exe
                      C:\Program Files\Digital Line Detect\DLG.exe
                      C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                      C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Documents and Settings\administrateur.BRIDE\Bureau\Scanner.exe
                      C:\WINDOWS\system32\userinit.exe
                      C:\WINDOWS\system32\wuauclt.exe

                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.dell.com/fr-fr
                      R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DR
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = https://www.bing.com/?toHttps=1&redig=5FC791212101479BAFBE1A679848B1AF
                      R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.msn.com/fr-fr/?ocid=iehp
                      R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://www.dell.com/fr-fr
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
                      O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
                      O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
                      O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
                      O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
                      O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
                      O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
                      O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Fichiers communs\Sonic\Update Manager\sgtray.exe" /r
                      O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
                      O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
                      O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
                      O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
                      O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
                      O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
                      O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
                      O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
                      O4 - Startup: PrintKey 2000 Fr.lnk = C:\Program Files\PrintKey 2000 Fr\Printkey 2000 Fr.exe
                      O4 - Global Startup: Digital Line Detect.lnk = ?
                      O4 - Global Startup: IPSec Dial Client.lnk = C:\Program Files\CoSine Communications\IPSec Dial Client\SafeCfg.exe
                      O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
                      O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
                      O11 - Options group: [INTERNATIONAL] International*
                      O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.euro.dell.com/systemprofiler/SysPro.CAB
                      O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
                      O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = bride.fr
                      O17 - HKLM\Software\..\Telephony: DomainName = bride.fr
                      O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = bride.fr
                      O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Fichiers communs\Microsoft Shared\Help\hxds.dll
                      O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\FICHIE~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
                      O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
                      O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
                      O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
                      O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
                      O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
                      O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
                      O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
                      O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
                      O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
                      O23 - Service: IA Analysing v2.0 (IACtrl) - Unknown owner - C:\Program Files\Pointdev\IDEAL Administration\IACtrl.exe
                      O23 - Service: SafeNet Monitor Service (IPSECMON) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IPSecMon.exe
                      O23 - Service: SafeNet IKE Service (IREIKE) - SafeNet - C:\Program Files\CoSine Communications\IPSec Dial Client\IreIKE.exe
                      O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
                      O23 - Service: mysql - Unknown owner - C:\Program.exe (file missing)
                      O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
                      O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - C:\Program Files\OCS Inventory Agent\ocsservice.exe
                      O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
                      O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
                      O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
                      3. chibiluk Auteur
                        Je ne peux pas changer le titre de départ pour marquer "[résolu]" ?
                        2. didi
                          bonjour
                          moi aussi mon antivirus a détecté ce trojan mais est incapable de s'en débarassé et moi je n'y comrend rien.

                          afin de résoudre ce problème j'aurai besoin de votre aide si vous le voulez bien. Je vous remercie d'avance.

                          Configuration: Windows XP
                          antivirus: avast 4.7
                          1. Regis59 Contributeur sécurité
                            Bonjour,

                            Il serait préférable que tu fasses ton message personnel, cela rendra les postes plus compréhensibles et la réponse à ton problème sera plus efficace
                            Procèdes comme ceci :
                            http://pageperso.aol.fr/balltrap34/demofairesontmessage.htm

                            A bientôt
                            1. sam
                              Que la pais soit avec vous
                              telecharger symantec antivirus et tous va marché bien

                              ou nod32
                              que la pais soit avec vous

                              Discussions similaires

                              Problème avec "PUADIManager:Win32/OfferCore
                              Knaki

                              3 réponses
                              PUADlManager:Win32/OfferCore
                              tenmalade

                              2 réponses
                              PUADlManager:Win32/OfferCore
                              bernardarrad

                              3 réponses
                              Aide pour un virus
                              cerise92700

                              41 réponses
                              Trojan impossible à supprimer!
                              Gridouu

                              12 réponses