Un virus me dérange Résolu

Question

Bonjour à tous!
*
           J'ai un problème. Quand je fais un double clic sur un disque de ma machine, ce périférique m'ouvre une nouvelle fenêtre. Ce n'ai pas habituel. J'ai donc detecté le fichier caché qui porte le nom "xn1i9x.com" il est accompagné d'un fichier autorun.inf. Il s'installe sur la partie amorçable du disque et se regénère quand on l'éfface.

                                                                                      Aidez moi Sil vous plait!!!

g!rly · Answer

salut le peintre,

Ouvre le bloc notes (Démarrer >> exécuter et tape notepad), et copie tout ce qui ci-dessous:

@ echo off

if exist \G!RLY.TXT del \G!RLY.TXT
FOR %%A in (C D E F G H I J K L M N O P Q R S T U V W X Y Z) DO IF EXIST %%A: (
IF EXIST %%A:\autorun.inf ECHO %%A:\autorun.inf Présent>>\G!RLY.TXT
IF NOT EXIST %%A:\autorun.inf ECHO %%A:\autorun.inf Non trouvé>>\G!RLY.TXT
IF EXIST %%A:\MS32DLL.dll.vbs ECHO %%A:\MS32DLL.dll.vbs Présent>>\G!RLY.TXT
IF NOT EXIST %%A:\MS32DLL.dll.vbs ECHO %%A:\MS32DLL.dll.vbs Non trouvé>>\G!RLY.TXT
)
IF EXIST %WINDIR%\MS32DLL.dll.vbs (
ECHO %WINDIR%\MS32DLL.dll.vbs Présent>>\G!RLY.TXT) else (
ECHO %WINDIR%\MS32DLL.dll.vbs non trouvé >>\G!RLY.TXT)
REG QUERY "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" >>\G!RLY.TXT
REG QUERY "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" >>\G!RLY.TXT
notepad \G!RLY.TXT
exit

Dans le menu du bloc notes, clic sur "Fichier" >> Enregistrer sous.
Choisis le bureau comme lieu d'enregistrement, puis dans:

Type -> choisis "tous les fichiers"
Nom du fichier -> tape G!RLY.bat
clic sur enregistrer.

Sur ton bureau tu auras maintenant un fichier nommé G!RLY.bat.

Connecte les périphériques externes susceptibles d'avoir été infectés au pc:
Clé USB, DD externe... etc

Puis une fois fait, double clic sur le fichier G!RLY.bat.
Une fenêtre noire va s'ouvrir et se refermer rapidement, c'est normal.
Le bloc note va s'ouvrir ensuite avec le listing des fichiers que le script aura détecté.
Copie et colle ici le contenu de ce rapport.

@+

drain_u · Answer

j'ai le meme proble avec ce "xn1i9x.com"
et voici  ce ke j'ai obtenu aprs les manip ke  tu a demander:

"C:\autorun.inf Présent 
C:\MS32DLL.dll.vbs Non trouvé 
H:\autorun.inf Présent 
H:\MS32DLL.dll.vbs Non trouvé 
C:\WINDOWS\MS32DLL.dll.vbs non trouvé 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    AVP	REG_SZ	"C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 for Windows Workstations\avp.exe"

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    CTFMON.EXE	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    LightScribe Control Panel	REG_SZ	C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden
    amva	REG_SZ	C:\WINDOWS\system32\amvo.exe
 j'aimerais bien comprendre comment faire pour deplacer ce virus et a quoi ca va te servir ce script.
merci d'avance

g!rly · Answer

salut drain_u,

Télécharge combofix.exe (par sUBs) sur ton Bureau.

-> http://download.bleepingcomputer.com/sUBs/ComboFix.exe      

-> Double clique combofix.exe.
-> Tape sur la touche 1 (Yes) pour démarrer le scan.
-> Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse. 

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

@+

bobs · Answer

C:\autorun.inf Présent
C:\MS32DLL.dll.vbs Non trouvé
D:\autorun.inf Présent
D:\MS32DLL.dll.vbs Non trouvé
E:\autorun.inf Présent
E:\MS32DLL.dll.vbs Non trouvé
F:\autorun.inf Présent
F:\MS32DLL.dll.vbs Non trouvé
G:\autorun.inf Présent
G:\MS32DLL.dll.vbs Non trouvé
H:\autorun.inf Présent
H:\MS32DLL.dll.vbs Non trouvé
I:\autorun.inf Présent
I:\MS32DLL.dll.vbs Non trouvé
C:\WINDOWS\MS32DLL.dll.vbs non trouvé 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    ehTray	REG_SZ	C:\WINDOWS\ehome\ehtray.exe
    NvCplDaemon	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    SigmatelSysTrayApp	REG_SZ	stsystra.exe
    00THotkey	REG_SZ	C:\WINDOWS\system32\00THotkey.exe
    000StTHK	REG_SZ	000StTHK.exe
    TFNF5	REG_SZ	TFNF5.exe
    SmoothView	REG_SZ	C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    SynTPEnh	REG_SZ	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    TouchED	REG_SZ	C:\Program Files\TOSHIBA\TouchED\TouchED.exe
    PadTouch	REG_SZ	C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    AGRSMMSG	REG_SZ	AGRSMMSG.exe
    TosHKCW.exe	REG_SZ	"C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
    NDSTray.exe	REG_SZ	NDSTray.exe
    TPSODDCtl	REG_SZ	TPSODDCtl.exe
    TPSMain	REG_SZ	TPSMain.exe
    Kraidman	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
    DDWMon	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
    TFncKy	REG_SZ	TFncKy.exe
    IntelZeroConfig	REG_SZ	"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    IntelWireless	REG_SZ	"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    DAEMON Tools-1033	REG_SZ	"C:\Program Files\D-Tools\daemon.exe"  -lang 1033
    avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
    SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    msnmsgr	REG_SZ	"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
    amva	REG_SZ	C:\WINDOWS\system32\amvo.exe





J'aimerais bien savoir comment m'en séparer.
Merci d'avance

bobs · Answer

Rapport Combofix.exe ComboFix 08-02.02.5 - Boris 2008-02-02 18:39:49.1 - NTFSx86 Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1314 [GMT 1:00] Endroit: C:\Documents and Settings\Boris\Bureau\ComboFix.exe * Création d'un nouveau point de restauration [color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color] . (((((((((((((((((((((((((((((((((((( Autres suppressions )))))))))))))))))))))))))))))))))))))))))))))))) . C:\Autorun.inf C:\WINDOWS\setup.exe C:\WINDOWS\system32\amvo.exe D:\Autorun.inf . ((((((((((((((((((((((((((((( Fichiers créés 2008-01-02 to 2008-02-02 )))))))))))))))))))))))))))))))))))) . 2008-01-15 14:19 . 2008-01-15 14:19 d-------- C:\Documents and Settings\Boris\Application Data\GeoVid 2008-01-15 14:18 . 2008-01-15 14:18 d-------- C:\Program Files\GeoVid 2008-01-15 14:18 . 2008-01-15 14:18 d-------- C:\Program Files\Fichiers communs\GeoVid 2008-01-15 14:18 . 2008-01-15 14:18 d-------- C:\Documents and Settings\All Users\Application Data\GeoVid 2008-01-15 14:18 . 2004-08-18 15:00 1,712,128 --a------ C:\WINDOWS\system32\gdiplus.dll 2008-01-15 14:18 . 2005-06-07 15:11 60,416 --a------ C:\WINDOWS\system32\dsetup.dll 2008-01-12 00:09 . 2008-01-12 00:42 470 --a------ C:\WINDOWS\cdplayer.ini 2008-01-07 01:59 . 2008-01-07 01:59 49,152 --a------ C:\WINDOWS\outlook.pst 2008-01-07 01:59 . 2008-01-07 01:59 8,655 --a------ C:\WINDOWS\extend.dat 2008-01-05 03:03 . 2008-01-05 03:03 d-------- C:\Program Files\Fichiers communs\Eltima Shared 2008-01-05 03:03 . 2008-01-05 03:03 d-------- C:\Program Files\Eltima Software 2008-01-05 03:03 . 2008-01-05 03:03 d-------- C:\Documents and Settings\Boris\Application Data\Eltima Software 2008-01-05 03:03 . 2008-01-14 19:02 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-01-05 03:03 . 2007-12-02 14:14 3,345,408 --a------ C:\WINDOWS\system32\avcodec-51.dll 2008-01-05 03:03 . 2007-12-02 14:14 448,512 --a------ C:\WINDOWS\system32\avformat-50.dll 2008-01-05 03:03 . 2007-12-02 14:13 40,960 --a------ C:\WINDOWS\wavdest.ax 2008-01-05 03:03 . 2007-12-02 14:14 19,968 --a------ C:\WINDOWS\system32\avutil-49.dll 2008-01-05 02:35 . 2008-01-05 02:35 d-------- C:\Program Files\Flash Movie Player 2008-01-05 02:09 . 2001-03-08 12:30 233,472 --a------ C:\WINDOWS\esellerateEngine.dll . (((((((((((((((((((((((((((((((((( Compte-rendu de Find3M )))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-02 15:29 --------- d-----w C:\Program Files\Wanadoo 2008-02-02 15:29 --------- d-----w C:\Documents and Settings\Boris\Application Data\OpenOffice.org2 2008-01-16 17:48 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-01-16 17:48 --------- d-----w C:\Program Files\InterVideo 2007-12-29 16:36 --------- d-----w C:\Documents and Settings\Boris\Application Data\AdobeUM 2007-12-29 16:35 --------- d-----w C:\Program Files\Fichiers communs\xing shared 2007-12-29 16:34 --------- d-----w C:\Program Files\Real 2007-12-29 16:34 --------- d-----w C:\Program Files\Fichiers communs\Real 2007-12-20 18:50 --------- d-----w C:\Program Files\directx 2007-12-11 18:03 --------- d-----w C:\Program Files\Crouzet Automatismes 2007-12-09 13:31 --------- d-----w C:\Program Files\Java 2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys 2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys 2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys 2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys 2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys 2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe 2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr 2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll . ((((((((((((((((((((((((((((((((( Point de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))) . . REGEDIT4 *Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360] "WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55 32768] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 12:34 64512] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-25 15:32 7340032] "SigmatelSysTrayApp"="stsystra.exe" [] "00THotkey"="C:\WINDOWS\system32\[u]0[/u]0THotkey.exe" [2006-08-11 06:52 253952] "000StTHK"="000StTHK.exe" [2001-06-23 03:28 24576 C:\WINDOWS\system32\[u]0[/u]00StTHK.exe] "TFNF5"="TFNF5.exe" [2006-02-14 02:24 593920 C:\WINDOWS\system32\TFNF5.exe] "SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 08:24 118784] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-08 17:58 761947] "TouchED"="C:\Program Files\TOSHIBA\TouchED\TouchED.exe" [2005-09-07 13:25 98304] "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-12-22 12:19 1077329] "AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 15:50 88204 C:\WINDOWS\agrsmmsg.exe] "TosHKCW.exe"="C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-17 10:42 49152] "NDSTray.exe"="NDSTray.exe" [] "TPSODDCtl"="TPSODDCtl.exe" [2006-08-09 10:57 102400 C:\WINDOWS\system32\TPSODDCtl.exe] "TPSMain"="TPSMain.exe" [2006-08-09 10:57 299008 C:\WINDOWS\system32\TPSMain.exe] "Kraidman"="C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe" [2006-08-21 10:46 1097804] "DDWMon"="C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe" [2006-04-28 10:38 262144] "TFncKy"="TFncKy.exe" [] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-07-03 00:07 802816] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-07-02 20:50 700416] "DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 16:05 81920] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49 20480] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-12-29 17:34 185896] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360] C:\Documents and Settings\Boris\Menu D‚marrer\Programmes\D‚marrage\ D‚marrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-12-16 23:00:00 51984] Microsoft Recherche acc‚l‚r‚e.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-12-16 23:00:00 111376] OpenOffice.org 2.2.lnk - C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe [2007-02-02 16:54:56 393216] C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\ Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-09-23 16:10:29 110592] DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-08-21 17:01:07 962661] Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-03-26 21:44:08 257752] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-03-13 12:11 233472] R0 KR10N;KR10N;C:\WINDOWS\system32\drivers\KR10N.sys [2006-02-14 17:41] R2 tdudf;TOSHIBA UDF File System Driver;C:\WINDOWS\system32\DRIVERS\tdudf.sys [2006-06-28 10:50] R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;C:\WINDOWS\system32\DRIVERS\thdudf.sys [2006-09-13 10:15] R2 TNaviSrv;TOSHIBA Navi Support Service;C:\Program Files\Toshiba\TOSHIBA HD DVD PLAYER\TNaviSrv.exe [2006-07-27 21:02] R2 TOS_SPS;TOSHIBA SPS Driver;C:\Program Files\Fichiers communs\Toshiba Shared\tos_sps.sys [2006-07-31 18:12] R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys [2006-03-02 17:49] R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 13:47] R3 ttv400x;TOSHIBA PCI DVB-T/Analog Hybrid Tuner;C:\WINDOWS\system32\drivers\ttv400x.sys [2006-07-11 22:44] R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08] R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 09:45] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0133fa14-06c4-11dc-b453-0018de6ea026}] \Shell\AutoRun\command - I:\xn1i9x.com \Shell\explore\Command - I:\xn1i9x.com \Shell\open\Command - I:\xn1i9x.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{28702a4a-079f-11dc-ade4-806d6172696f}] \Shell\AutoRun\command - F:\autoplay.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{418ab046-a339-11dc-ae5a-0018de6ea026}] \Shell\AutoRun\command - G:\xn1i9x.com \Shell\explore\Command - G:\xn1i9x.com \Shell\open\Command - G:\xn1i9x.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54ad996e-0635-11dc-b44f-806d6172696f}] \Shell\AutoRun\command - C:\xn1i9x.com \Shell\explore\Command - C:\xn1i9x.com \Shell\open\Command - C:\xn1i9x.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54ad996f-0635-11dc-b44f-806d6172696f}] \Shell\AutoRun\command - xn1i9x.com \Shell\explore\Command - xn1i9x.com \Shell\open\Command - xn1i9x.com [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54ad9970-0635-11dc-b44f-806d6172696f}] \Shell\AutoRun\command - E:\install.exe \Shell\directx\command - E:\DirectX\dxsetup.exe \Shell\setup\command - E:\install.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8379a58f-2708-11dc-ae05-0018de6ea026}] \Shell\AutoRun\command - H:\AutoRun.exe . Contenu du dossier 'Scheduled Tasks/Tâches planifiées' "2008-01-31 12:38:11 C:\WINDOWS\Tasks\avast! Antivirus.job" - C:\PROGRA~1\ALWILS~1\Avast4\ashAvast.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-02 18:41:41 Windows 5.1.2600 Service Pack 2 NTFS Balayage processus cachés ... Balayage caché autostart entries ... Balayage des fichiers cachés ... Scan terminé avec succès Les fichiers cachés: 0 ************************************************************************** . Temps d'accomplissement: 2008-02-02 18:41:56 ComboFix-quarantined-files.txt 2008-02-02 17:41:54 . 2008-01-11 18:56:31 --- E O F ---

g!rly · Answer

salut bobs,

fais ceci :

ouvre le bloc note et copie colle les commandes ci dessous :

@echo on
taskkill /im explorer.exe /f
taskkill /im wscript.exe
start reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\EXplorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1 /f
start reg import kill.reg
del c:\autorun.* /f /q /as
del %SYSTEMROOT%\system32\autorun.* /f /q /as
del d:\autorun.* /f /q /as
del e:\autorun.* /f /q /as
del f:\autorun.* /f /q /as
del g:\autorun.* /f /q /as
del h:\autorun.* /f /q /as
del i:\autorun.* /f /q /as
del j:\autorun.* /f /q /as
del k:\autorun.* /f /q /as
del l:\autorun.* /f /q /as
start explorer.exe

ferme le bloc et enregistre le sur le bureau sous le nom de kill_autorun_vbs.bat

va sur le bureau et double clik sur kill_autorun_vbs.bat et laisse le faire son boulot

repost en suite le resultat de g!rly.bat

@+

bobs · Answer

A première vue le virus à disparu.
Merci

bobs · Answer

C:\autorun.inf Non trouvé
C:\MS32DLL.dll.vbs Non trouvé
D:\autorun.inf Non trouvé
D:\MS32DLL.dll.vbs Non trouvé
E:\autorun.inf Présent
E:\MS32DLL.dll.vbs Non trouvé
F:\autorun.inf Présent
F:\MS32DLL.dll.vbs Non trouvé
G:\autorun.inf Non trouvé
G:\MS32DLL.dll.vbs Non trouvé
H:\autorun.inf Présent
H:\MS32DLL.dll.vbs Non trouvé
I:\autorun.inf Non trouvé
I:\MS32DLL.dll.vbs Non trouvé
C:\WINDOWS\MS32DLL.dll.vbs non trouvé 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    ehTray	REG_SZ	C:\WINDOWS\ehome\ehtray.exe
    NvCplDaemon	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    SigmatelSysTrayApp	REG_SZ	stsystra.exe
    00THotkey	REG_SZ	C:\WINDOWS\system32\00THotkey.exe
    000StTHK	REG_SZ	000StTHK.exe
    TFNF5	REG_SZ	TFNF5.exe
    SmoothView	REG_SZ	C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    SynTPEnh	REG_SZ	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    TouchED	REG_SZ	C:\Program Files\TOSHIBA\TouchED\TouchED.exe
    PadTouch	REG_SZ	C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    AGRSMMSG	REG_SZ	AGRSMMSG.exe
    TosHKCW.exe	REG_SZ	"C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
    NDSTray.exe	REG_SZ	NDSTray.exe
    TPSODDCtl	REG_SZ	TPSODDCtl.exe
    TPSMain	REG_SZ	TPSMain.exe
    Kraidman	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
    DDWMon	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
    TFncKy	REG_SZ	TFncKy.exe
    IntelZeroConfig	REG_SZ	"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    IntelWireless	REG_SZ	"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    DAEMON Tools-1033	REG_SZ	"C:\Program Files\D-Tools\daemon.exe"  -lang 1033
    avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
    SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    msnmsgr	REG_SZ	"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

g!rly · Answer

re,

fais ceci :

Fix.reg

Ouvre le bloc-notes (click droit sur le bureau > dans l´arborescence choisie nouveau et nouveau fichier texte) et fais un copier coller de ce qui est en citation ci-dessous (copie tout d'un trait-sans les barres(X)) :

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0133fa 14-06c4-11dc-b453-0018de6ea026}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{418ab0 46-a339-11dc-ae5a-0018de6ea026}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54ad99 6e-0635-11dc-b44f-806d6172696f}]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Note : regedit 4 est sur la premiere ligne et il y a une ligne blanche a la fin
Puis click sur "fichier"/"enregistrer sous" :
dans : sur le bureau
Nom du fichier : fix.reg
Type de fichier : "tous les fichiers"
clique sur "enregistrer"

ca doit ressembler a ca une fois enrregistré :

http://img520.imageshack.us/img520/4251/screenshot005ps2.png

quitte internet et double clique sur fix.reg => tu dois obligatoirement avoir un message "voulez-vous vraiment ajouter les informations contenues dans ce fichier .reg au registre ?"
Si c'est bien le cas, clique sur "oui"

repost un combofix apres la manip`

@+

g!rly · Answer

...

bobs · Answer

ComboFix 08-02.02.5 - Boris 2008-02-02 19:15:42.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1266 [GMT 1:00]
Endroit: C:\Documents and Settings\Boris\Bureau\ComboFix.exe

[color=red][b]AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !![/b][/color]
.

((((((((((((((((((((((((((((( Fichiers créés 2008-01-02 to 2008-02-02 ))))))))))))))))))))))))))))))))))))
.

2008-01-15 14:19 . 2008-01-15 14:19 <REP> d-------- C:\Documents and Settings\Boris\Application Data\GeoVid
2008-01-15 14:18 . 2008-01-15 14:18 <REP> d-------- C:\Program Files\GeoVid
2008-01-15 14:18 . 2008-01-15 14:18 <REP> d-------- C:\Program Files\Fichiers communs\GeoVid
2008-01-15 14:18 . 2008-01-15 14:18 <REP> d-------- C:\Documents and Settings\All Users\Application Data\GeoVid
2008-01-15 14:18 . 2004-08-18 15:00 1,712,128 --a------ C:\WINDOWS\system32\gdiplus.dll
2008-01-15 14:18 . 2005-06-07 15:11 60,416 --a------ C:\WINDOWS\system32\dsetup.dll
2008-01-12 00:09 . 2008-01-12 00:42 470 --a------ C:\WINDOWS\cdplayer.ini
2008-01-07 01:59 . 2008-01-07 01:59 49,152 --a------ C:\WINDOWS\outlook.pst
2008-01-07 01:59 . 2008-01-07 01:59 8,655 --a------ C:\WINDOWS\extend.dat
2008-01-05 03:03 . 2008-01-05 03:03 <REP> d-------- C:\Program Files\Fichiers communs\Eltima Shared
2008-01-05 03:03 . 2008-01-05 03:03 <REP> d-------- C:\Program Files\Eltima Software
2008-01-05 03:03 . 2008-01-05 03:03 <REP> d-------- C:\Documents and Settings\Boris\Application Data\Eltima Software
2008-01-05 03:03 . 2008-01-14 19:02 <REP> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-05 03:03 . 2007-12-02 14:14 3,345,408 --a------ C:\WINDOWS\system32\avcodec-51.dll
2008-01-05 03:03 . 2007-12-02 14:14 448,512 --a------ C:\WINDOWS\system32\avformat-50.dll
2008-01-05 03:03 . 2007-12-02 14:13 40,960 --a------ C:\WINDOWS\wavdest.ax
2008-01-05 03:03 . 2007-12-02 14:14 19,968 --a------ C:\WINDOWS\system32\avutil-49.dll
2008-01-05 02:35 . 2008-01-05 02:35 <REP> d-------- C:\Program Files\Flash Movie Player
2008-01-05 02:09 . 2001-03-08 12:30 233,472 --a------ C:\WINDOWS\esellerateEngine.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-02 15:29 --------- d-----w C:\Program Files\Wanadoo
2008-02-02 15:29 --------- d-----w C:\Documents and Settings\Boris\Application Data\OpenOffice.org2
2008-01-16 17:48 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-16 17:48 --------- d-----w C:\Program Files\InterVideo
2007-12-29 16:36 --------- d-----w C:\Documents and Settings\Boris\Application Data\AdobeUM
2007-12-29 16:35 --------- d-----w C:\Program Files\Fichiers communs\xing shared
2007-12-29 16:34 --------- d-----w C:\Program Files\Real
2007-12-29 16:34 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-12-20 18:50 --------- d-----w C:\Program Files\directx
2007-12-11 18:03 --------- d-----w C:\Program Files\Crouzet Automatismes
2007-12-09 13:31 --------- d-----w C:\Program Files\Java
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AvastSS.scr
2007-11-07 09:28 728,576 ----a-w C:\WINDOWS\system32\lsasrv.dll
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 13:00 15360]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 15:55 32768]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 12:34 64512]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-07-25 15:32 7340032]
"SigmatelSysTrayApp"="stsystra.exe" []
"00THotkey"="C:\WINDOWS\system32\[u]0[/u]0THotkey.exe" [2006-08-11 06:52 253952]
"000StTHK"="000StTHK.exe" [2001-06-23 03:28 24576 C:\WINDOWS\system32\[u]0[/u]00StTHK.exe]
"TFNF5"="TFNF5.exe" [2006-02-14 02:24 593920 C:\WINDOWS\system32\TFNF5.exe]
"SmoothView"="C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe" [2005-05-17 08:24 118784]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-08 17:58 761947]
"TouchED"="C:\Program Files\TOSHIBA\TouchED\TouchED.exe" [2005-09-07 13:25 98304]
"PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-12-22 12:19 1077329]
"AGRSMMSG"="AGRSMMSG.exe" [2005-12-13 15:50 88204 C:\WINDOWS\agrsmmsg.exe]
"TosHKCW.exe"="C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2005-05-17 10:42 49152]
"NDSTray.exe"="NDSTray.exe" []
"TPSODDCtl"="TPSODDCtl.exe" [2006-08-09 10:57 102400 C:\WINDOWS\system32\TPSODDCtl.exe]
"TPSMain"="TPSMain.exe" [2006-08-09 10:57 299008 C:\WINDOWS\system32\TPSMain.exe]
"Kraidman"="C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe" [2006-08-21 10:46 1097804]
"DDWMon"="C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2006-04-28 10:38 262144]
"TFncKy"="TFncKy.exe" []
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-07-03 00:07 802816]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-07-02 20:50 700416]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 16:05 81920]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 13:49 20480]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe" [2007-12-29 17:34 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 13:00 15360]

C:\Documents and Settings\Boris\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-12-16 23:00:00 51984]
Microsoft Recherche acc‚l‚r‚e.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-12-16 23:00:00 111376]
OpenOffice.org 2.2.lnk - C:\Program Files\OpenOffice.org 2.2\program\quickstart.exe [2007-02-02 16:54:56 393216]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2007-09-23 16:10:29 110592]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-08-21 17:01:07 962661]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Windows Desktop Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2006-03-26 21:44:08 257752]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2006-03-13 12:11 233472]

R0 KR10N;KR10N;C:\WINDOWS\system32\drivers\KR10N.sys [2006-02-14 17:41]
R2 tdudf;TOSHIBA UDF File System Driver;C:\WINDOWS\system32\DRIVERS\tdudf.sys [2006-06-28 10:50]
R2 thdudf;TOSHIBA UDF2.5 Reader File System Driver;C:\WINDOWS\system32\DRIVERS\thdudf.sys [2006-09-13 10:15]
R2 TNaviSrv;TOSHIBA Navi Support Service;C:\Program Files\Toshiba\TOSHIBA HD DVD PLAYER\TNaviSrv.exe [2006-07-27 21:02]
R2 TOS_SPS;TOSHIBA SPS Driver;C:\Program Files\Fichiers communs\Toshiba Shared\tos_sps.sys [2006-07-31 18:12]
R3 tdcmdpst;TOSHIBA Writing Engine Filter Driver;C:\WINDOWS\system32\DRIVERS\tdcmdpst.sys [2006-03-02 17:49]
R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 13:47]
R3 ttv400x;TOSHIBA PCI DVB-T/Analog Hybrid Tuner;C:\WINDOWS\system32\drivers\ttv400x.sys [2006-07-11 22:44]
R3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]
R3 X10Hid;X10 Hid Device;C:\WINDOWS\system32\Drivers\x10hid.sys [2005-11-28 09:45]

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2008-01-31 12:38:11 C:\WINDOWS\Tasks\avast! Antivirus.job"
- C:\PROGRA~1\ALWILS~1\Avast4\ashAvast.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 19:16:13
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès
Les fichiers cachés: 0

**************************************************************************
.
Temps d'accomplissement: 2008-02-02 19:16:35
ComboFix-quarantined-files.txt 2008-02-02 18:16:27
ComboFix2.txt 2008-02-02 17:41:57
.
2008-01-11 18:56:31 --- E O F ---

g!rly · Answer

ok cool ;-)

refais ceci maintenant :

ouvre le bloc note et copie colle les commandes ci dessous :

@echo on
taskkill /im explorer.exe /f
taskkill /im wscript.exe
start reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\EXplorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1 /f
start reg import kill.reg
del c:\autorun.* /f /q /as
del %SYSTEMROOT%\system32\autorun.* /f /q /as
del d:\autorun.* /f /q /as
del e:\autorun.* /f /q /as
del f:\autorun.* /f /q /as
del g:\autorun.* /f /q /as
del h:\autorun.* /f /q /as
del i:\autorun.* /f /q /as
del j:\autorun.* /f /q /as
del k:\autorun.* /f /q /as
del l:\autorun.* /f /q /as
start explorer.exe

ferme le bloc et enregistre le sur le bureau sous le nom de kill_autorun_vbs.bat

va sur le bureau et double clik sur kill_autorun_vbs.bat et laisse le faire son boulot

repost en suite le resultat de g!rly.bat

@+

bobs · Answer

C:\autorun.inf Non trouvé
C:\MS32DLL.dll.vbs Non trouvé
D:\autorun.inf Non trouvé
D:\MS32DLL.dll.vbs Non trouvé
E:\autorun.inf Présent
E:\MS32DLL.dll.vbs Non trouvé
F:\autorun.inf Présent
F:\MS32DLL.dll.vbs Non trouvé
G:\autorun.inf Non trouvé
G:\MS32DLL.dll.vbs Non trouvé
H:\autorun.inf Présent
H:\MS32DLL.dll.vbs Non trouvé
I:\autorun.inf Non trouvé
I:\MS32DLL.dll.vbs Non trouvé
C:\WINDOWS\MS32DLL.dll.vbs non trouvé 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    ehTray	REG_SZ	C:\WINDOWS\ehome\ehtray.exe
    NvCplDaemon	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    SigmatelSysTrayApp	REG_SZ	stsystra.exe
    00THotkey	REG_SZ	C:\WINDOWS\system32\00THotkey.exe
    000StTHK	REG_SZ	000StTHK.exe
    TFNF5	REG_SZ	TFNF5.exe
    SmoothView	REG_SZ	C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    SynTPEnh	REG_SZ	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    TouchED	REG_SZ	C:\Program Files\TOSHIBA\TouchED\TouchED.exe
    PadTouch	REG_SZ	C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    AGRSMMSG	REG_SZ	AGRSMMSG.exe
    TosHKCW.exe	REG_SZ	"C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
    NDSTray.exe	REG_SZ	NDSTray.exe
    TPSODDCtl	REG_SZ	TPSODDCtl.exe
    TPSMain	REG_SZ	TPSMain.exe
    Kraidman	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
    DDWMon	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
    TFncKy	REG_SZ	TFncKy.exe
    IntelZeroConfig	REG_SZ	"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    IntelWireless	REG_SZ	"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    DAEMON Tools-1033	REG_SZ	"C:\Program Files\D-Tools\daemon.exe"  -lang 1033
    avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
    SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    msnmsgr	REG_SZ	"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

bobs · Answer

Les disque E: F: H: sont un lecteur/graveur CD et deux émulations de lecteur.

g!rly · Answer

re,

peux tu desactiver les lecteurs virtuels de demon tool.

et recommence girly bat et poster le resultat ici 

@+

gorBobs · Answer

C:\autorun.inf Non trouvé
C:\MS32DLL.dll.vbs Non trouvé
D:\autorun.inf Non trouvé
D:\MS32DLL.dll.vbs Non trouvé
G:\autorun.inf Non trouvé
G:\MS32DLL.dll.vbs Non trouvé
I:\autorun.inf Non trouvé
I:\MS32DLL.dll.vbs Non trouvé
C:\WINDOWS\MS32DLL.dll.vbs non trouvé 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    ehTray	REG_SZ	C:\WINDOWS\ehome\ehtray.exe
    NvCplDaemon	REG_SZ	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    SigmatelSysTrayApp	REG_SZ	stsystra.exe
    00THotkey	REG_SZ	C:\WINDOWS\system32\00THotkey.exe
    000StTHK	REG_SZ	000StTHK.exe
    TFNF5	REG_SZ	TFNF5.exe
    SmoothView	REG_SZ	C:\Program Files\TOSHIBA\Utilitaire de zoom TOSHIBA\SmoothView.exe
    SynTPEnh	REG_SZ	C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    TouchED	REG_SZ	C:\Program Files\TOSHIBA\TouchED\TouchED.exe
    PadTouch	REG_SZ	C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    AGRSMMSG	REG_SZ	AGRSMMSG.exe
    TosHKCW.exe	REG_SZ	"C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
    NDSTray.exe	REG_SZ	NDSTray.exe
    TPSODDCtl	REG_SZ	TPSODDCtl.exe
    TPSMain	REG_SZ	TPSMain.exe
    Kraidman	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA RAID\Console\Kraidman.exe
    DDWMon	REG_SZ	C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
    TFncKy	REG_SZ	TFncKy.exe
    IntelZeroConfig	REG_SZ	"C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
    IntelWireless	REG_SZ	"C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    DAEMON Tools-1033	REG_SZ	"C:\Program Files\D-Tools\daemon.exe"  -lang 1033
    avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
    SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
    TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    ctfmon.exe	REG_SZ	C:\WINDOWS\system32\ctfmon.exe
    WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    msnmsgr	REG_SZ	"C:\Program Files\MSN Messenger\msnmsgr.exe" /background

g!rly · Answer

re,

bon il y a l´air d´avoir un probleme avec demon tool et tes lecteurs virtuels...

essaie peut etre de desinstaller completement demon tool et de le reinstaller?!

et refais g!rlybat avec demon tool activé

@+

gorBobs · Answer

je n'ai plus le logiciel, donc je ferais ça plus tard.

g!rly · Answer

re,

moi je le voie sur ton pc

C:\Program Files\D-Tools\daemon.exe

gorBobs · Answer

Sur le pc de mes parents:


C:\autorun.inf Présent 
C:\MS32DLL.dll.vbs Non trouvé 
D:\autorun.inf Présent 
D:\MS32DLL.dll.vbs Non trouvé 
C:\WINDOWS\MS32DLL.dll.vbs non trouvé 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    hpsysdrv	REG_SZ	c:\windows\system\hpsysdrv.exe
    ATIPTA	REG_SZ	C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    HPHUPD08	REG_SZ	c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    iTunesHelper	REG_SZ	"C:\Program Files\iTunes\iTunesHelper.exe"
    Recguard	REG_SZ	C:\WINDOWS\SMINST\RECGUARD.EXE
    PCDrProfiler	REG_SZ	
    AlcxMonitor	REG_SZ	ALCXMNTR.EXE
    HP Software Update	REG_EXPAND_SZ	C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    Easy-PrintToolBox	REG_SZ	C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    QuickTime Task	REG_SZ	"C:\Program Files\QuickTime\qttask.exe" -atboottime
    TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
    avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    EoEngine	REG_SZ	
    EoSudoku	REG_SZ	
    KBD	REG_SZ	C:\HP\KBD\KBD.EXE
    WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
    WOOTASKBARICON	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
    xjflhapn	REG_SZ	c:\windows\system32\xjflhapn.exe xjflhapn

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    updateMgr	REG_SZ	C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    MSNCleaner	REG_SZ	C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
    amva	REG_SZ	C:\WINDOWS\system32\amvo.exe

g!rly · Answer

salut,

ouvre le bloc note et copie colle les commandes en gras :

@echo on
taskkill /im explorer.exe /f
taskkill /im wscript.exe
start reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\EXplorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 1 /f
start reg import kill.reg
del c:\autorun.* /f /q /as
del %SYSTEMROOT%\system32\autorun.* /f /q /as
del d:\autorun.* /f /q /as
del e:\autorun.* /f /q /as
del f:\autorun.* /f /q /as
del g:\autorun.* /f /q /as
del h:\autorun.* /f /q /as
del i:\autorun.* /f /q /as
del j:\autorun.* /f /q /as
del k:\autorun.* /f /q /as
del l:\autorun.* /f /q /as
start explorer.exe

ferme le bloc et enregistre le sur le bureau sous le nom de kill_autorun_vbs.bat

va sur le bureau et double clik sur kill_autorun_vbs.bat et laisse le faire son boulot

repost le rapport de g!rly.bat

@+

gorBobs · Answer

Combo Fix sur le même ordinateur:


ComboFix 08-02.05.3 - HP_Propriétaire 2008-02-09 13:24:16.1 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.1.1036.18.98 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\QROTCDAT\ComboFix[1].exe
 * Création d'un nouveau point de restauration
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner
C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner\Userdata\defaultPack.cab
C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner\Userdata\languages.xml
C:\Documents and Settings\HP_Propriétaire\Application Data\MessengerSkinner\Userdata\pack1.cab
C:\Program Files\instant access
C:\Program Files\instant access\Center\NoCreditCard.lnk
C:\Program Files\instant access\DesktopIcons\NoCreditCard.lnk
C:\Program Files\instant access\Multi\20070302170330\Common\module.php
C:\Program Files\instant access\Multi\20070302170330\dialerexe.ini
C:\Program Files\instant access\Multi\20070302170330\js\js_api_dialer.php
C:\Program Files\instant access\Multi\20070302170330\medias\button1.gif
C:\Program Files\instant access\Multi\20070302170330\medias\button2.gif
C:\Program Files\instant access\Multi\20070302170330\medias\button3.gif
C:\Program Files\instant access\Multi\20070302170330\medias\button4.gif
C:\Program Files\instant access\Multi\20070302170330\medias\dialer.ico
C:\Program Files\messengerskinner
C:\WINDOWS\dialerexe.ini
C:\WINDOWS\pack.epk
C:\WINDOWS\setup.exe
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\amvo1.dll
C:\WINDOWS\system32
vs2.inf
C:\WINDOWS\system32xcqfvkli_navtmp.dat
C:\WINDOWS\system32\xjflhapn.dat
C:\WINDOWS\system32\xjflhapn.exe
c:\WINDOWS\system32\xjflhapn_nav.dat
C:\WINDOWS\system32\xjflhapn_navps.dat
D:\Autorun.inf

.
(((((((((((((((((((((((((((((   Fichiers créés 2008-01-09 to 2008-02-09  ))))))))))))))))))))))))))))))))))))
.

2008-02-03 17:07 . 2008-02-03 17:06	103,870	-r-hs----	C:\2ifetri.cmd
2008-02-03 17:05 . 2008-02-02 16:59	104,644	-r-hs----	C:\i.cmd
2008-01-27 15:17 . 2008-01-21 12:45	106,358	-r-hs----	C:\xn1i9x.com

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-09 12:11	---------	d-----w	C:\Program Files\Wanadoo
2008-01-27 15:12	---------	d-----w	C:\Program Files\Fichiers communs\Sandlot Shared
2008-01-27 15:11	---------	d--h--w	C:\Program Files\Fichiers communs\Carlson
2007-12-04 13:04	837,496	----a-w	C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54	95,608	----a-w	C:\WINDOWS\system32\AVASTSS.scr
2007-11-14 07:28	450,560	----a-w	C:\WINDOWS\system32\dllcache\jscript.dll
2006-09-24 09:33	208	----a-w	C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2005-05-12 05:36	12,288	----a-w	C:\WINDOWS\Fonts\RandFont.dll
.

(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]
"MSNCleaner"="C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-08 04:05 344064]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 07:35 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-05-05 00:21 278528]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
"PCDrProfiler"="" []
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 21:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 06:12 49152]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-03 03:23 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" [2006-06-26 21:36 180269]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"EoEngine"="" []
"EoSudoku"="" []
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]

C:\Documents and Settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-12-16 23:00:00 51984]
Microsoft Recherche acc‚l‚r‚e.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-12-16 23:00:00 111376]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
Contr“leur de calendrier Ulead.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2006-06-16 16:35:04 69632]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-02-24 18:31:12 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 06:23:26 282624]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe [2005-09-23 21:05:26 29696]

S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e32ec91-1431-11dc-af3c-4d6564696130}]
\Shell\AutoRun\command - G:\LaunchU3.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 13:28:34
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès 
Les fichiers cachés: 0 

**************************************************************************
.
Temps d'accomplissement: 2008-02-09 13:29:33
ComboFix-quarantined-files.txt  2008-02-09 12:29:18
.
2008-01-09 00:21:17	--- E O F ---

gorBobs · Answer

C:\autorun.inf Non trouvé 
C:\MS32DLL.dll.vbs Non trouvé 
D:\autorun.inf Non trouvé 
D:\MS32DLL.dll.vbs Non trouvé 
C:\WINDOWS\MS32DLL.dll.vbs non trouvé 

! REG.EXE VERSION 3.0

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
    SunJavaUpdateSched	REG_SZ	"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    hpsysdrv	REG_SZ	c:\windows\system\hpsysdrv.exe
    ATIPTA	REG_SZ	C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    HPHUPD08	REG_SZ	c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
    iTunesHelper	REG_SZ	"C:\Program Files\iTunes\iTunesHelper.exe"
    Recguard	REG_SZ	C:\WINDOWS\SMINST\RECGUARD.EXE
    PCDrProfiler	REG_SZ	
    AlcxMonitor	REG_SZ	ALCXMNTR.EXE
    HP Software Update	REG_EXPAND_SZ	C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
    Easy-PrintToolBox	REG_SZ	C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
    QuickTime Task	REG_SZ	"C:\Program Files\QuickTime\qttask.exe" -atboottime
    TkBellExe	REG_SZ	"C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
    avast!	REG_SZ	C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    EoEngine	REG_SZ	
    EoSudoku	REG_SZ	
    KBD	REG_SZ	C:\HP\KBD\KBD.EXE
    WOOWATCH	REG_SZ	C:\PROGRA~1\Wanadoo\Watch.exe
    WOOTASKBARICON	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents

! REG.EXE VERSION 3.0

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
    WOOKIT	REG_SZ	C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
    updateMgr	REG_SZ	C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    MSNCleaner	REG_SZ	C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe

g!rly · Answer

ok

Télécharge HijackThis ici : 

-> http://www.commentcamarche.net/telecharger/telecharger 159 hijackthis

Tutoriel d´instalation : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol.fr/balltrap34/Hijenr.gif 

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

Post le rapport généré ici stp...

@+

gorBobs · Answer

Le rapport du logiciel:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:53:53, on 09/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [MSNCleaner] C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bobo-lescargot.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E193F24-B422-4704-8286-3B9086AB0417}: NameServer = 80.10.246.1 81.253.149.2
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

g!rly · Answer

re,

Copie le texte ci-dessous :

File::
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
C:\2ifetri.cmd
C:\i.cmd
C:\xn1i9x.com

Folder::


Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EoEngine"=-
"EoSudoku"=-
"PCDrProfiler"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSNCleaner"=-

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

http://serveur1.archive-host.com/membres/up/1366464061/CFScript.gif

Cela va relancer Combofix, 

Une fenêtre bleue va apparaître: au message qui apparaît ( Type 1 to continue, or 2 to abort) , tape 1 puis valide.

Patiente le temps du scan.Le bureau va disparaître à plusieurs reprises: c'est normal!

Ne touche à rien tant que le scan n'est pas terminé.

Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.

S'il n'y a pas de rédémarrage, poste quand même les rapports.

installes un par feu :

par feu : kerio

http://www.malekal.com/kerio_firewall.php#mozTocId721480

https://www.vulgarisation-informatique.com/kerio.php

https://kerio.probb.fr/f2-sunbelt-kerio-personal-firewall

ou zone alarm plus facil a configurer mais moins performant

https://www.malekal.com/tutoriel-zonealarm-firewall/

puis

regarde ceci concernant avast :

antivir vs avast :

-> http://forum.malekal.com/ftopic3528.php

alors je te conseille de le desinstaller et d´installer antivir a la place

Telecharge et instal l'antivirus Antivir Personal Edition Classic :

->https://www.malekal.com/avira-free-security-antivirus-gratuit/

https://www.avira.com/en/prime

http://mickael.barroux.free.fr/securite/antivir.php 
http://speedweb1.free.fr/frames2.php?page=tuto5
<- tutoriel configuration du scanner...

une fois antivir ouvert click surconfiguration et coche la case "expert mode" puis sur l´onglet scanner dans la fenetre du dessous tu va voir : rootkit search click sur le petit + pour deployer et coche la case a coté de ton disk dur
puis click sur configuration en haut a droite; dans la nouvelle fenetre a gauche >scanner > coche "scan all files" et en dessous >scanner priority = High
coche : allow stopping the scanner, comme cela tu peux faire une pause pendant le scan si tu le desir.
puis sur la droite coche les case suivantes : 
scan boot sectors of selected drives
scan master boot sectors
scan memory
search foe rootkit before scan
decoche :
ignore off line files
toujours a gauche > scan > deploie > heuristique > macrovirus heuristic = coché et en dessous > win32 heuristic la case coché et high detection level

Je te dis tous ca par rapport a antivir car j´aimerais que tu fasse un scan complet de ta machine a l´aide de ce dernier avec les reglages stipulés ci dessus

Donc post le rapport de combofix, celui de hijack this et celui d´antivir dans ta prochaine reponse

bon courrage 

@+

gorBobs · Answer

ComboFix 08-02.05.3 - HP_Propriétaire 2008-02-09 15:34:31.2 - NTFSx86
Microsoft Windows XP Édition familiale  5.1.2600.2.1252.1.1036.18.92 [GMT 1:00]
Endroit: C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Propriétaire\Bureau\CFScript.txt
 * Création d'un nouveau point de restauration

FILE
C:\2ifetri.cmd
C:\Documents and Settings\HP_Propriétaire\Local Settings\Temporary Internet Files\Content.IE5\O9UNCXYZ\MSNCleaner.exe
C:\i.cmd
C:\xn1i9x.com
.

((((((((((((((((((((((((((((((((((((   Autres suppressions   ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\2ifetri.cmd
C:\i.cmd
C:\xn1i9x.com

.
(((((((((((((((((((((((((((((   Fichiers créés 2008-01-09 to 2008-02-09  ))))))))))))))))))))))))))))))))))))
.

2008-02-09 13:51 . 2008-02-09 13:51	<REP>	d--------	C:\Program Files\Trend Micro
2008-02-09 13:22 . 2004-08-05 19:00	400,896	--a------	C:\kmd.exe

.
((((((((((((((((((((((((((((((((((   Compte-rendu de Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-09 12:33	---------	d-----w	C:\Program Files\Wanadoo
2008-01-27 15:12	---------	d-----w	C:\Program Files\Fichiers communs\Sandlot Shared
2008-01-27 15:11	---------	d--h--w	C:\Program Files\Fichiers communs\Carlson
2007-12-04 13:04	837,496	----a-w	C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54	95,608	----a-w	C:\WINDOWS\system32\AVASTSS.scr
2007-11-14 07:28	450,560	----a-w	C:\WINDOWS\system32\dllcache\jscript.dll
2006-09-24 09:33	208	----a-w	C:\Documents and Settings\HP_Propriétaire\Application Data\wklnhst.dat
2005-05-12 05:36	12,288	----a-w	C:\WINDOWS\Fonts\RandFont.dll
.

(((((((((((((((((((((((((((((((((   Point de chargement Reg   )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WOOKIT"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00 132496]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 17:04 52736]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-06-08 04:05 344064]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 07:35 49152]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-05-05 00:21 278528]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 21:43 233472]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 21:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPwuSchd2.exe" [2005-05-12 06:12 49152]
"Easy-PrintToolBox"="C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe" [2004-01-14 02:10 409600]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-01-03 03:23 98304]
"TkBellExe"="C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe" [2006-06-26 21:36 180269]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 14:00 79224]
"KBD"="C:\HP\KBD\KBD.EXE" [2005-02-02 16:44 61440]
"WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2004-08-23 14:49 20480]
"WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\GestMaj.exe" [2004-10-14 16:55 32768]

C:\Documents and Settings\HP_Propri‚taire\Menu D‚marrer\Programmes\D‚marrage\
D‚marrage d'Office.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [1996-12-16 23:00:00 51984]
Microsoft Recherche acc‚l‚r‚e.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [1996-12-16 23:00:00 111376]

C:\Documents and Settings\All Users\Menu D‚marrer\Programmes\D‚marrage\
Adobe Gamma Loader.exe.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
Adobe Gamma Loader.lnk - C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe [2006-04-23 14:02:20 98304]
Contr“leur de calendrier Ulead.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe [2006-06-16 16:35:04 69632]
DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2007-02-24 18:31:12 962661]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 06:23:26 282624]
Lancement rapide d'Adobe Reader.lnk - C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe [2005-09-23 21:05:26 29696]

S3 usbscan;Pilote de scanneur USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 22:58]
S3 USBSTOR;Pilote de stockage de masse USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 22:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e32ec91-1431-11dc-af3c-4d6564696130}]
\Shell\AutoRun\command - G:\LaunchU3.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-09 15:38:09
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cachés ...

Balayage caché autostart entries ...

Balayage des fichiers cachés ...

Scan terminé avec succès 
Les fichiers cachés: 0 

**************************************************************************
.
Temps d'accomplissement: 2008-02-09 15:38:58
ComboFix-quarantined-files.txt  2008-02-09 14:38:43
ComboFix2.txt  2008-02-09 12:29:34
.
2008-01-09 00:21:17	--- E O F ---  










Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:42:39, on 09/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32
otepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OBealsched.exe"  -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Lancement rapide d'Adobe Reader.lnk = C:\Program Files\Adobe\Acrobat 7.0\Readereader_sl.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bobo-lescargot.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E193F24-B422-4704-8286-3B9086AB0417}: NameServer = 81.253.149.9 80.10.246.132
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

g!rly · Answer

en attendanrt le rapport d´antivir ou apres

tu pourras cocher ces lignes superflues et les fixer a l´aide de hijack this

O2 - BHO: EoRezoBHO - {64F56FC1-1272-44CD-BA6E-39723696E350} - C:\PROGRA~1\eoRezo\EoAdv\EOREZO~1.DLL (file missing)
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O9 - Extra button: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra 'Tools' menuitem: Messager Wanadoo - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\PROGRA~1\WANADO~1\Wanadoo Messager.exe (file missing)
O9 - Extra button: Wanadoo - {1462651F-F4BA-4C76-A001-C4284D0FE16E} - https://www.orange.fr/portail (file missing) (HKCU)

comment fixer :

Tutoriel d´utilisation (video) : (Merci a Balltrap34 pour cette réalisation)

-> http://pageperso.aol.fr/balltrap34/demohijack.htm

ta version de acrobat reader n´est pas a jour, tu veux la version 8.1 derniere en date alors desinstale ta version par le panneau de configuration / ajoue et suppression de programme

et instale la derniere :

https://get2.adobe.com/reader/otherversions/

ou foxit plus léger :

https://www.clubic.com/telecharger-fiche13808-foxit-reader.html

puis regarde ce tutorial pour mettre ta console java a jour :

https://www.malekal.com/maintenir-java-adobe-reader-et-le-player-flash-a-jour/
@+

gorBobs · Answer

AntiVir PersonalEdition Classic Report file date: dimanche 10 février 2008 14:03 Scanning for 1096761 virus strains and unwanted programs. Licensed to: Avira AntiVir PersonalEdition Classic Serial number: 0000149996-ADJIE-0001 Platform: Windows XP Windows version: (Service Pack 2) [5.1.2600] Username: SYSTEM Computer name: LE-SEUL Version information: BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00 AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29 AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51 LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47 LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20 ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15 ANTIVIR1.VDF : 7.0.1.95 3367424 Bytes 14/12/2007 12:50:37 ANTIVIR2.VDF : 7.0.2.113 1673728 Bytes 08/02/2008 12:50:37 ANTIVIR3.VDF : 7.0.2.114 2048 Bytes 08/02/2008 12:50:37 AVEWIN32.DLL : 7.6.0.62 3240448 Bytes 10/02/2008 12:50:38 AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26 AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17 AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24 AVPACK32.DLL : 7.6.0.3 360488 Bytes 10/02/2008 12:50:40 AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06 AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33 AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18 NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42 RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13 RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37 SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21 Configuration settings for the scan: Jobname..........................: Complete system scan Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp Logging..........................: low Primary action...................: interactive Secondary action.................: ignore Scan master boot sector..........: on Scan boot sector.................: on Boot sectors.....................: D:, Scan memory......................: on Process scan.....................: on Scan registry....................: on Search for rootkits..............: on Scan all files...................: All files Scan archives....................: on Recursion depth..................: 20 Smart extensions.................: on Macro heuristic..................: on File heuristic...................: high Start of the scan: dimanche 10 février 2008 14:03 Starting search for hidden objects. '48948' objects were checked, '0' hidden objects were found. The scan of running processes will be started Scan process 'avscan.exe' - '1' Module(s) have been scanned Scan process 'sched.exe' - '1' Module(s) have been scanned Scan process 'avgnt.exe' - '1' Module(s) have been scanned Scan process 'avguard.exe' - '1' Module(s) have been scanned Scan process 'firefox.exe' - '1' Module(s) have been scanned Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned Scan process 'Watch.exe' - '1' Module(s) have been scanned Scan process 'kpf4gui.exe' - '1' Module(s) have been scanned Scan process 'alg.exe' - '1' Module(s) have been scanned Scan process 'CALMAIN.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'kpf4ss.exe' - '1' Module(s) have been scanned Scan process 'FTRTSVC.exe' - '1' Module(s) have been scanned Scan process 'ALERTM~1.EXE' - '1' Module(s) have been scanned Scan process 'PollingModule.exe' - '1' Module(s) have been scanned Scan process 'Inactivity.exe' - '1' Module(s) have been scanned Scan process 'Toaster.exe' - '1' Module(s) have been scanned Scan process 'FINDFAST.EXE' - '1' Module(s) have been scanned Scan process 'ComComp.exe' - '1' Module(s) have been scanned Scan process 'OSA.EXE' - '1' Module(s) have been scanned Scan process 'hpqtra08.exe' - '1' Module(s) have been scanned Scan process 'dslmon.exe' - '1' Module(s) have been scanned Scan process 'CalCheck.exe' - '1' Module(s) have been scanned Scan process 'EspaceWanadoo.exe' - '1' Module(s) have been scanned Scan process 'jusched.exe' - '1' Module(s) have been scanned Scan process 'TaskBarIcon.exe' - '1' Module(s) have been scanned Scan process 'kbd.exe' - '1' Module(s) have been scanned Scan process 'realsched.exe' - '1' Module(s) have been scanned Scan process 'hpwuSchd2.exe' - '1' Module(s) have been scanned Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned Scan process 'hpsysdrv.exe' - '1' Module(s) have been scanned Scan process 'explorer.exe' - '1' Module(s) have been scanned Scan process 'spoolsv.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'svchost.exe' - '1' Module(s) have been scanned Scan process 'ati2evxx.exe' - '1' Module(s) have been scanned Scan process 'lsass.exe' - '1' Module(s) have been scanned Scan process 'services.exe' - '1' Module(s) have been scanned Scan process 'winlogon.exe' - '1' Module(s) have been scanned Scan process 'csrss.exe' - '1' Module(s) have been scanned Scan process 'smss.exe' - '1' Module(s) have been scanned 45 processes with 45 modules were scanned Starting master boot sector scan: Master boot sector HD0 [NOTE] No virus was found! Start scanning boot sectors: Boot sector 'C:\' [NOTE] No virus was found! Boot sector 'D:\' [NOTE] No virus was found! Starting to scan the registry. The registry was scanned ( '42' files ). Starting the file scan: Begin scan in 'C:\' C:\hiberfil.sys [WARNING] The file could not be opened! C:\pagefile.sys [WARNING] The file could not be opened! C:\QooBox\Quarantine\C\2ifetri.cmd.vir [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '4814fe06.qua'! C:\QooBox\Quarantine\C\i.cmd.vir [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '4811fdd2.qua'! C:\QooBox\Quarantine\C\WINDOWS\system32\amvo.exe.vir [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '4824fe17.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP270\A0048152.exe [DETECTION] Is the Trojan horse TR/Dropper.Gen [INFO] The file was moved to '47defe16.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP275\A0051881.exe [DETECTION] Contains detection pattern of the dial-up program DIAL/170041.A [INFO] The file was moved to '47defe3e.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051882.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe43.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051896.dll [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe48.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051897.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe4d.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051902.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe51.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051922.dll [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe55.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051926.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe58.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051939.exe [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe5b.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051960.exe [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe5f.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051974.dll [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe62.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051975.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe66.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051993.dll [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe6e.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051994.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe75.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0052005.dll [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe7a.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0052006.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe7d.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP278\A0052010.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe81.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP278\A0052022.dll [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe84.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP279\A0052027.dll [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe88.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP279\A0052035.exe [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe8a.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP280\A0052118.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe91.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP280\A0052119.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe93.qua'! C:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP280\A0052120.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47defe96.qua'! Begin scan in 'D:\' D:\xn1i9x.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47e003d5.qua'! D:\i.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '4812039b.qua'! D:\2ifetri.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '481503da.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051904.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df07f8.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051928.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df07fb.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051977.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df07fe.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0051996.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df0801.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP277\A0052008.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df0805.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP278\A0052012.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df0807.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051884.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df0809.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP276\A0051899.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df080b.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP287\A0052991.com [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df080e.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP287\A0052992.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df0810.qua'! D:\System Volume Information\_restore{F75EEC69-6E97-419B-93B4-6A3A275301C4}\RP287\A0052993.cmd [DETECTION] Is the Trojan horse TR/Crypt.NSPM.Gen [INFO] The file was moved to '47df0812.qua'! End of the scan: dimanche 10 février 2008 15:19 Used time: 1:16:10 min The scan has been done completely. 7417 Scanning directories 405147 Files were scanned 40 viruses and/or unwanted programs were found 0 Files were classified as suspicious: 0 files were deleted 0 files were repaired 40 files were moved to quarantine 0 files were renamed 2 Files cannot be scanned 405107 Files not concerned 14002 Archives were scanned 2 Warnings 0 Notes 48948 Objects were scanned with rootkit scan 0 Hidden objects were found

g!rly · Answer

salut,

bon c´est pas trop mal.

fais encore ce scan stp

A.V.G :

-> Télécharger AVG Anti-Spyware (ewido)

   http://www.commentcamarche.net/telecharger/telecharger 218 avg anti spyware

-> L´installer.

-> lancer AVG Anti-Spyware et clicker sur le bouton Mise à jour. Patienter...
   
   p.s : si les mises a jours ne se font pas, elles sont telechargable ici :

   http://downloads.ewido.net/avgas-signatures-full-current.exe

-> Sur la page "analyse":

   choisir d´abord l'onglet "paramètres".
   
   sous « Comment réagir » clicker sur « Actions recommandées » et dans le menu déroulant, choisir « Supprimer ».

-> Lancer le scan, (c´est long...).

-> A la fin du scan copier Et coller le rapport ici. 

-> Une aide en image au cas ou :

   Tutoriel d´installation et de parametrages :

   http://www.kachouri.com/tuto/tuto-161-avg-anti-spyware-75-pour-votre-securite.html 

Note : supprime bien tout ce qui va etre trouvé et post le rapport ici 

@++

gorBobs · Answer

---------------------------------------------------------
AVG Anti-Spyware - Rapport d'analyse
---------------------------------------------------------

 + Créé à:	19:49:20 11/02/2008

 + Résultat de l'analyse:	



:mozilla.565:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.566:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.567:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.568:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.247realmedia : Aucune action entreprise.
:mozilla.132:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.133:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.134:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.135:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.403:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.926:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.2o7 : Aucune action entreprise.
:mozilla.283:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adbrite : Aucune action entreprise.
:mozilla.284:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adbrite : Aucune action entreprise.
:mozilla.159:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.160:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.161:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.162:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.163:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.164:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.165:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.166:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adrevolver : Aucune action entreprise.
:mozilla.354:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
:mozilla.355:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Adtech : Aucune action entreprise.
:mozilla.417:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.418:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.419:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.420:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.421:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Advertising : Aucune action entreprise.
:mozilla.340:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Atdmt : Aucune action entreprise.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@atdmt[2].txt -> TrackingCookie.Atdmt : Aucune action entreprise.
:mozilla.156:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@bluestreak[2].txt -> TrackingCookie.Bluestreak : Aucune action entreprise.
:mozilla.886:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Burstnet : Aucune action entreprise.
:mozilla.887:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Burstnet : Aucune action entreprise.
:mozilla.329:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.330:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.331:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.332:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.333:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casalemedia : Aucune action entreprise.
:mozilla.250:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
:mozilla.251:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Casinotropez : Aucune action entreprise.
:mozilla.414:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.415:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.416:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Comclick : Aucune action entreprise.
:mozilla.10:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@doubleclick[1].txt -> TrackingCookie.Doubleclick : Aucune action entreprise.
:mozilla.223:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Estat : Aucune action entreprise.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@estat[1].txt -> TrackingCookie.Estat : Aucune action entreprise.
:mozilla.809:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Fastclick : Aucune action entreprise.
:mozilla.810:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Fastclick : Aucune action entreprise.
:mozilla.572:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Gemius : Aucune action entreprise.
:mozilla.573:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Gemius : Aucune action entreprise.
:mozilla.405:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.406:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.871:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.872:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.873:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.919:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Hitbox : Aucune action entreprise.
:mozilla.157:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Imrworldwide : Aucune action entreprise.
:mozilla.158:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Imrworldwide : Aucune action entreprise.
:mozilla.822:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Ivwbox : Aucune action entreprise.
:mozilla.54:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
:mozilla.59:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
:mozilla.60:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@mediaplex[1].txt -> TrackingCookie.Mediaplex : Aucune action entreprise.
:mozilla.603:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Onestat : Aucune action entreprise.
:mozilla.604:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Onestat : Aucune action entreprise.
:mozilla.92:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Overture : Aucune action entreprise.
:mozilla.93:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Overture : Aucune action entreprise.
:mozilla.323:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Revenue : Aucune action entreprise.
:mozilla.191:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.192:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.193:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.194:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.195:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.196:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.197:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Serving-sys : Aucune action entreprise.
:mozilla.91:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.94:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.95:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.96:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.97:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Smartadserver : Aucune action entreprise.
:mozilla.714:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Statcounter : Aucune action entreprise.
:mozilla.47:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.48:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.49:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.50:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
C:\Documents and Settings\HP_Propriétaire\Cookies\hp_propriétaire@tradedoubler[2].txt -> TrackingCookie.Tradedoubler : Aucune action entreprise.
:mozilla.839:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
:mozilla.840:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Trafficmp : Aucune action entreprise.
:mozilla.806:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Vegasred : Aucune action entreprise.
:mozilla.807:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Vegasred : Aucune action entreprise.
:mozilla.13:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.14:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Weborama : Aucune action entreprise.
:mozilla.145:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Webtrendslive : Aucune action entreprise.
:mozilla.325:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.326:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.327:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.328:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Yieldmanager : Aucune action entreprise.
:mozilla.247:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
:mozilla.248:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.
:mozilla.249:C:\Documents and Settings\HP_Propriétaire\Application Data\Mozilla\Firefox\Profiles\m72h3g1x.default\cookies.txt -> TrackingCookie.Zedo : Aucune action entreprise.


Fin du rapport

g!rly · Answer

Salut,

repost un nouveau hijack this stp

@+

gorBobs · Answer

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:57:18, on 11/02/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\Wanadoo\TaskBarIcon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\PROGRA~1\Wanadoo\EspaceWanadoo.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\PROGRA~1\Wanadoo\ComComp.exe
C:\PROGRA~1\Wanadoo\Toaster.exe
C:\PROGRA~1\Wanadoo\Inactivity.exe
C:\PROGRA~1\Wanadoo\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\PROGRA~1\Wanadoo\Watch.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.fr/?gws_rd=ssl
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\Wanadoo\SEARCH~1.DLL
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Fichiers communs\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\GestMaj.exe EspaceWanadoo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - Startup: Démarrage d'Office.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Startup: Microsoft Recherche accélérée.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Contrôleur de calendrier Ulead.lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: Easy-WebPrint Ajouter à la liste d'impressions - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint Impression rapide - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Imprimer - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Easy-WebPrint Prévisualiser - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Aide à la connexion - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://bobo-lescargot.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - https://www.trendmicro.com/en_us/forHome/products/housecall.html
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E193F24-B422-4704-8286-3B9086AB0417}: NameServer = 81.253.149.1 80.10.246.3
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Fichiers communs\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

g!rly · Answer

Re,

fais ceci :

demarrer / executer tape sc stop FTRTSVC puis valide par ok

demarrer/ executer tape sc delete FTRTSVC puis valide par ok"

C´est un parsite/ espion de france telecom...

comment va ton pc?

@+

gorBobs · Answer

Il a l'aire d'aller bien... 


Merci

g!rly · Answer

Ok

Fais ceci :

Désactive ta restauration système:
pour cela :
Click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration système;
coche la case désactiver la restauration systèm et applique.
puis redemarre le pc et click droit sur poste de travail, dans l´arborescence sur propriétés; 
dans la nouvelle fenettre click sur l´onglet restauration systèm
décoche la case désactiver la restauration systèm et applique. 

puis

Télécharge ToolsCleaner sur ton bureau.
--> http://www.commentcamarche.net/telecharger/telechargement 34055291 toolsclean(...)
# Clique sur Recherche et laisse le scan agir ...
# Clique sur Suppression pour finaliser.
# Tu peux, si tu le souhaites, te servir des Options facultatives.
# Clique sur Quitter pour obtenir le rapport.
# Poste le rapport (TCleaner.txt) qui se trouve à la racine de ton disque dur (C:\). 

@+

gorBobs · Answer

-->- Recherche: 

C:\Qoobox: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: trouvé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe: trouvé !
C:\Documents and Settings\HP_Propriétaire\Bureau\Divers\HijackThis.lnk: trouvé !
C:\Program Files\Trend Micro\HijackThis: trouvé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: trouvé !
C:\QooBox\Quarantine\C\Combofix: trouvé !

---------------------------------
-->- Suppression: 

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis\HijackThis.lnk: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\ComboFix.exe: supprimé !
C:\Documents and Settings\HP_Propriétaire\Bureau\Divers\HijackThis.lnk: supprimé !
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe: supprimé !
C:\Qoobox: supprimé !
C:\Documents and Settings\All Users\Menu Démarrer\Programmes\HijackThis: supprimé !
C:\Program Files\Trend Micro\HijackThis: supprimé !

g!rly · Answer

salut  gorBobs,

bien joué ;-)

dis moi quoi

@+

gorBobs · Answer

Merci de m'avoir aider à résoudre ces problèmes...

g!rly · Answer

De rien ;-)
Bonne continuation`
Bye`

Un virus me dérange

40 réponses

Discussions similaires

Newsletters