[LOGICIEL] [Centralisation] .:::: Hijackthis ::::.

[DelOrio]

@ DelOrio :

donc Docteur qu'ai je comme solution pour sécuriser mon PC

Pas compliqué ... suffit de réinstaller Antivir puis voir si le pc se comporte bien .

Vivement un retour d'expérience heureux :

ok Docteur

Merci encore pour ton aide

[steve419]

@ steve419 :

Applique ceci :

http://support.kaspersky.com/faq/?qid=208279756

hello,

je n'ai pas d'accès pour l'instant sur la machine,

la mise à jour s'est déjà bien faite.

Le problème c'est le module d'analyse qui ne se lance pas...

Mais bon, je dois essayer à nouveau l'analyse rapide.

Je te donne des news dès que je peux :)

Merci

[steve419]

capture d'écran de la page " Ménaces détectées "

http://www.casimages.com/img.php?i=081104031810899836.jpg

http://www.casimages.com/img.php?i=081104055145834467.jpg

http://www.casimages.com/img.php?i=081104055229131311.jpg

[snooky]

Ca ne sont pas des virus , mais des vulnérabilités , c'est à dite des applications qui ne sont pas les dernières en date .

Lance Update checker !

[steve419]

d'autres info :

lancement de l'antivirus en mode sans echec :

http://www.casimages.com/img.php?i=081104055145834467.jpg

http://www.casimages.com/img.php?i=081104055229131311.jpg

le log d'analyse :

04/11/2008 12:06:51 Lancement de la tâche

04/11/2008 12:07:02 Détectés: http://www.viruslist.com/fr/advisories/23138 c:\program files\adobe\acrobat 5.0\reader\acrord32.exe

04/11/2008 12:07:02 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\javaws.exe

04/11/2008 12:07:08 Détectés: http://www.viruslist.com/fr/advisories/29293 c:\program files\quicktime\quicktimeplayer.exe

04/11/2008 12:07:08 Détectés: http://www.viruslist.com/fr/advisories/27361 c:\program files\real\realplayer\realplay.exe

04/11/2008 12:07:09 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\java.exe

04/11/2008 12:10:14 Détectés: Virus.Win32.KME c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP440\A0137732.exe

04/11/2008 12:10:14 Non réparés: Virus.Win32.KME c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP440\A0137732.exe Reporté

04/11/2008 12:11:06 Détectés: Trojan-Spy.Win32.Delf.wh c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP454\A0140972.EXE/300.exe/ASPack

04/11/2008 12:11:07 Non réparés: Trojan-Spy.Win32.Delf.wh c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP454\A0140972.EXE/300.exe/ASPack Reporté

04/11/2008 12:12:40 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134708.exe/CryptFF

04/11/2008 12:12:40 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134708.exe/CryptFF Reporté

04/11/2008 12:12:40 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134707.bat/CryptFF

04/11/2008 12:12:40 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134707.bat/CryptFF Reporté

04/11/2008 12:12:41 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134706.exe/CryptFF/PE_Patch/UPack

04/11/2008 12:12:41 Non réparés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134706.exe/CryptFF/PE_Patch/UPack Reporté

04/11/2008 12:12:41 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134710.exe/CryptFF/PE_Patch/UPack

04/11/2008 12:12:41 Non réparés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134710.exe/CryptFF/PE_Patch/UPack Reporté

04/11/2008 12:12:41 Détectés: Email-Worm.Win32.Warezov.h D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134711.cmd/CryptFF

04/11/2008 12:12:41 Non réparés: Email-Worm.Win32.Warezov.h D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134711.cmd/CryptFF Reporté

04/11/2008 12:12:41 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134709.pif/CryptFF/PE_Patch/MewBundle/MEW

04/11/2008 12:12:41 Non réparés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134709.pif/CryptFF/PE_Patch/MewBundle/MEW Reporté

04/11/2008 12:12:41 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134712.bat/CryptFF

04/11/2008 12:12:41 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134712.bat/CryptFF Reporté

04/11/2008 12:12:41 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134713.exe/CryptFF

04/11/2008 12:12:41 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134713.exe/CryptFF Reporté

04/11/2008 12:12:41 Détectés: Virus.Win32.Sality.q D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134715.exe/CryptFF

04/11/2008 12:12:41 Non réparés: Virus.Win32.Sality.q D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134715.exe/CryptFF Reporté

04/11/2008 12:12:41 Détectés: Email-Worm.Win32.Warezov.e D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134714.dll/CryptFF

04/11/2008 12:12:41 Non réparés: Email-Worm.Win32.Warezov.e D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134714.dll/CryptFF Reporté

04/11/2008 12:15:01 Détectés: Trojan-Spy.Win32.Delf.wh c:\APPS\OFFICE_1\All\oonepdf\SETUP.EXE/300.exe/ASPack

04/11/2008 12:15:07 Non réparés: Trojan-Spy.Win32.Delf.wh c:\APPS\OFFICE_1\All\oonepdf\SETUP.EXE/300.exe/ASPack Reporté

04/11/2008 12:15:36 Détectés: http://www.viruslist.com/fr/advisories/23138 c:\program files\adobe\acrobat 5.0\reader\acrord32.exe

04/11/2008 12:15:56 Détectés: http://www.viruslist.com/fr/advisories/26027 c:\program files\Fichiers communs\AOL\Flasha.ocx

04/11/2008 12:16:31 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\java.exe

04/11/2008 12:16:31 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\javaws.exe

04/11/2008 12:17:04 Détectés: Virus.Win32.KME c:\program files\Navilog1\Backupnavi\mkjyvdy.exe

04/11/2008 12:17:06 Non réparés: Virus.Win32.KME c:\program files\Navilog1\Backupnavi\mkjyvdy.exe Reporté

04/11/2008 12:17:37 Détectés: http://www.viruslist.com/fr/advisories/29293 c:\program files\quicktime\quicktimeplayer.exe

04/11/2008 12:17:37 Détectés: http://www.viruslist.com/fr/advisories/27361 c:\program files\real\realplayer\realplay.exe

04/11/2008 12:27:13 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\java.exe

04/11/2008 12:27:13 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\javaws.exe

04/11/2008 12:27:57 Détectés: http://www.viruslist.com/fr/advisories/19218 c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll

04/11/2008 12:44:21 Détectés: Trojan.Win32.Inject.itt D:\Documents and Settings\manu.117734180318\Mes documents\Emmanuel MARTIN\azada-setup.exe/data0000/UPX/PRE/data\{37CBEC2F-C1EA-4E7A-84AC-A3BE7D2F309A}\8\Launch.exe/Armadillo

04/11/2008 12:44:21 Non réparés: Trojan.Win32.Inject.itt D:\Documents and Settings\manu.117734180318\Mes documents\Emmanuel MARTIN\azada-setup.exe/data0000/UPX/PRE/data\{37CBEC2F-C1EA-4E7A-84AC-A3BE7D2F309A}\8\Launch.exe/Armadillo Reporté

04/11/2008 12:46:32 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134707.bat/CryptFF

04/11/2008 12:46:32 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134706.exe/CryptFF/PE_Patch/UPack

04/11/2008 12:46:32 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134708.exe/CryptFF

04/11/2008 12:46:32 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134707.bat/CryptFF Reporté

04/11/2008 12:46:32 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134708.exe/CryptFF Reporté

04/11/2008 12:46:32 Non réparés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134706.exe/CryptFF/PE_Patch/UPack Reporté

04/11/2008 12:46:33 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134709.pif/CryptFF/PE_Patch/MewBundle/MEW

04/11/2008 12:46:33 Détectés: Email-Worm.Win32.Warezov.h D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134711.cmd/CryptFF

04/11/2008 12:46:33 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134710.exe/CryptFF/PE_Patch/UPack

04/11/2008 12:46:33 Non réparés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134709.pif/CryptFF/PE_Patch/MewBundle/MEW Reporté

04/11/2008 12:46:33 Non réparés: Email-Worm.Win32.Warezov.h D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134711.cmd/CryptFF Reporté

04/11/2008 12:46:33 Non réparés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134710.exe/CryptFF/PE_Patch/UPack Reporté

04/11/2008 12:46:33 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134712.bat/CryptFF

04/11/2008 12:46:33 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134712.bat/CryptFF Reporté

04/11/2008 12:46:33 Détectés: Email-Worm.Win32.Warezov.e D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134714.dll/CryptFF

04/11/2008 12:46:33 Non réparés: Email-Worm.Win32.Warezov.e D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134714.dll/CryptFF Reporté

04/11/2008 12:46:33 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134713.exe/CryptFF

04/11/2008 12:46:33 Détectés: Virus.Win32.Sality.q D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134715.exe/CryptFF

04/11/2008 12:46:33 Non réparés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134713.exe/CryptFF Reporté

04/11/2008 12:46:33 Non réparés: Virus.Win32.Sality.q D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134715.exe/CryptFF Reporté

04/11/2008 12:49:03 Détectés: Trojan-Spy.Win32.Delf.wh c:\APPS\OFFICE_1\All\oonepdf\SETUP.EXE/300.exe/ASPack

04/11/2008 12:50:25 Supprimés: Trojan-Spy.Win32.Delf.wh c:\APPS\OFFICE_1\All\oonepdf\setup.exe

04/11/2008 12:50:25 Détectés: Virus.Win32.KME c:\program files\Navilog1\Backupnavi\mkjyvdy.exe

04/11/2008 12:50:25 Supprimés: Virus.Win32.KME c:\program files\Navilog1\Backupnavi\mkjyvdy.exe

04/11/2008 12:50:25 Détectés: Virus.Win32.KME c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP440\A0137732.exe

04/11/2008 12:50:25 Supprimés: Virus.Win32.KME c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP440\A0137732.exe

04/11/2008 12:50:43 Détectés: Trojan-Spy.Win32.Delf.wh c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP454\A0140972.EXE/300.exe/ASPack

04/11/2008 12:51:50 Supprimés: Trojan-Spy.Win32.Delf.wh c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP454\a0140972.exe

04/11/2008 12:52:00 Détectés: Trojan.Win32.Inject.itt D:\Documents and Settings\manu.117734180318\Mes documents\Emmanuel MARTIN\azada-setup.exe/data0000/UPX/PRE/data\{37CBEC2F-C1EA-4E7A-84AC-A3BE7D2F309A}\8\Launch.exe/Armadillo

04/11/2008 12:52:01 Supprimés: Trojan.Win32.Inject.itt D:\Documents and Settings\manu.117734180318\Mes documents\Emmanuel MARTIN\azada-setup.exe

04/11/2008 12:52:01 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134706.exe/CryptFF/PE_Patch/UPack

04/11/2008 12:52:01 Supprimés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134706.exe

04/11/2008 12:52:01 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134707.bat/CryptFF

04/11/2008 12:52:01 Supprimés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134707.bat

04/11/2008 12:52:01 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134708.exe/CryptFF

04/11/2008 12:52:01 Supprimés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134708.exe

04/11/2008 12:52:01 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134709.pif/CryptFF/PE_Patch/MewBundle/MEW

04/11/2008 12:52:01 Supprimés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134709.pif

04/11/2008 12:52:01 Détectés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134710.exe/CryptFF/PE_Patch/UPack

04/11/2008 12:52:01 Supprimés: Email-Worm.Win32.Warezov.gen D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134710.exe

04/11/2008 12:52:01 Détectés: Email-Worm.Win32.Warezov.h D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134711.cmd/CryptFF

04/11/2008 12:52:01 Supprimés: Email-Worm.Win32.Warezov.h D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134711.cmd

04/11/2008 12:52:01 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134712.bat/CryptFF

04/11/2008 12:52:01 Supprimés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134712.bat

04/11/2008 12:52:02 Détectés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134713.exe/CryptFF

04/11/2008 12:52:02 Supprimés: Email-Worm.Win32.Warezov.aj D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134713.exe

04/11/2008 12:52:02 Détectés: Email-Worm.Win32.Warezov.e D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134714.dll/CryptFF

04/11/2008 12:52:02 Supprimés: Email-Worm.Win32.Warezov.e D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\a0134714.dll

04/11/2008 12:52:02 Détectés: Virus.Win32.Sality.q D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134715.exe/CryptFF

04/11/2008 12:52:02 Réparés: Virus.Win32.Sality.q D:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP436\A0134715.exe/CryptFF

04/11/2008 12:52:02 Fin de la tâche

Analyse rapide: terminée le 30/10/2008 23:50:08 (événements : 2, objets : 2888, durée : 00:01:43)

04/11/2008 13:56:11 Fin de la tâche

04/11/2008 13:43:44 Détectés: http://www.viruslist.com/fr/advisories/19218 c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll

04/11/2008 13:42:57 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\java.exe

04/11/2008 13:42:57 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\javaws.exe

04/11/2008 13:30:59 Détectés: http://www.viruslist.com/fr/advisories/29293 c:\program files\quicktime\quicktimeplayer.exe

04/11/2008 13:30:59 Détectés: http://www.viruslist.com/fr/advisories/27361 c:\program files\real\realplayer\realplay.exe

04/11/2008 13:29:51 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\javaws.exe

04/11/2008 13:29:51 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\java.exe

04/11/2008 13:29:24 Détectés: http://www.viruslist.com/fr/advisories/26027 c:\program files\Fichiers communs\AOL\Flasha.ocx

04/11/2008 13:29:11 Détectés: http://www.viruslist.com/fr/advisories/23138 c:\program files\adobe\acrobat 5.0\reader\acrord32.exe

04/11/2008 13:26:33 Supprimés: Trojan-Spy.Win32.Delf.wh c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP463\A0142067.EXE

04/11/2008 13:25:46 Supprimés: Virus.Win32.KME c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP463\A0142068.exe

04/11/2008 13:25:44 Détectés: Trojan-Spy.Win32.Delf.wh c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP463\A0142067.EXE/300.exe/ASPack

04/11/2008 13:25:26 Détectés: Virus.Win32.KME c:\System Volume Information\_restore{B3BF5352-B406-412E-936E-A9436F19C528}\RP463\A0142068.exe

04/11/2008 13:20:45 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\java.exe

04/11/2008 13:20:44 Détectés: http://www.viruslist.com/fr/advisories/29293 c:\program files\quicktime\quicktimeplayer.exe

04/11/2008 13:20:44 Détectés: http://www.viruslist.com/fr/advisories/27361 c:\program files\real\realplayer\realplay.exe

04/11/2008 13:20:23 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\javaws.exe

04/11/2008 13:20:22 Détectés: http://www.viruslist.com/fr/advisories/23138 c:\program files\adobe\acrobat 5.0\reader\acrord32.exe

04/11/2008 13:20:00 Lancement de la tâche

je dois y aller

@+

je pense que la machine est propre la non ?

[snooky]

Désactive la restauration système.

Dans Kaspersky , coche " Riskware " dans Configuratiion / Menaces / Configuration .

Redémarre le pc et lance une analyse complète .

Poste le rapport.

Réactive la restauration système.

[bob63]

Yop Une copine a des problemes de deconnection asser souvent (surtout msn) Elle a installé msn 9 la derniere beta et voudrait l'enlever mais quand elle a essayé apres internet ne marchait plus donc restauration..

Voila son rapport

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 18:53:49, on 05/11/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Belkin\Logiciel Bluetooth\bin\btwdins.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\igfxtray.exe

C:\WINDOWS\System32\hkcmd.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Belkin\Logiciel Bluetooth\BTTray.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\Program Files\Windows Live\Contacts\wlcomm.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\MonPC\Bureau\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: (no name) - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - (no file)

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: Click-to-Call BHO - {5C255C8A-E604-49b4-9D64-90988571CECB} - C:\Program Files\Windows Live\Messenger\wlchtc.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\System32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe

O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Envoyer à &Bluetooth - C:\Program Files\Belkin\Logiciel Bluetooth\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Logiciel Bluetooth\btsendto_ie.htm

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Belkin\Logiciel Bluetooth\bin\btwdins.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--

End of file - 7599 bytes

[snooky]

@ bob63 :

1 ) Coche et fixe toutes les lignes 04 avec Hijackthis .

2 ) Désinstalle Avast et Spybot .

3 ) Redémarre le pc .

4 ) Lance MBAM et poste le rapport créé.

[bob63]

Bon elle a desinstallé Spybot (elle redemarre l'ordi) et la son internet ne marche plus, c'est asser genant si a chaque fois qu'elle redemarre internet ne marche plus.. Elle va restauré puis on verra bien

[steve419]

le log :

Analyse complète: terminée le 04/11/2008 18:15:28 (événements : 16, objets : 118325, durée : 00:21:01)

04/11/2008 17:54:27 Lancement de la tâche

04/11/2008 17:54:43 Détectés: http://www.viruslist.com/fr/advisories/23138 c:\program files\adobe\acrobat 5.0\reader\acrord32.exe

04/11/2008 17:54:45 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\javaws.exe

04/11/2008 17:54:54 Détectés: http://www.viruslist.com/fr/advisories/27361 c:\program files\real\realplayer\realplay.exe

04/11/2008 17:54:54 Détectés: http://www.viruslist.com/fr/advisories/29293 c:\program files\quicktime\quicktimeplayer.exe

04/11/2008 17:54:54 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\java.exe

04/11/2008 17:55:52 Détectés: http://www.viruslist.com/fr/advisories/23138 c:\program files\adobe\acrobat 5.0\reader\acrord32.exe

04/11/2008 17:56:08 Détectés: http://www.viruslist.com/fr/advisories/26027 c:\program files\Fichiers communs\AOL\Flasha.ocx

04/11/2008 17:56:49 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\java.exe

04/11/2008 17:56:49 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\program files\java\jre1.5.0_04\bin\javaws.exe

04/11/2008 17:57:37 Détectés: http://www.viruslist.com/fr/advisories/29293 c:\program files\quicktime\quicktimeplayer.exe

04/11/2008 17:57:37 Détectés: http://www.viruslist.com/fr/advisories/27361 c:\program files\real\realplayer\realplay.exe

04/11/2008 18:05:34 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\javaws.exe

04/11/2008 18:05:34 Détectés: http://www.viruslist.com/fr/advisories/31010 c:\windows\system32\java.exe

04/11/2008 18:06:15 Détectés: http://www.viruslist.com/fr/advisories/19218 c:\windows\system32\Macromed\Shockwave 10\SwOnce.dll

04/11/2008 18:15:28 Fin de la tâche

@+

[snooky]

Tout ça , ce sont des programmes pas à jour . ( je te l'ai déjà dit plus haut ! )

Désinstalle ce que tu peux via ajout/suppr des programmes et installe les dernières versions en date des tes logiciels.

Tu peux t'aider de Update Checker ( vise ma signature ) pour télécharger directement la dernière version de la plupart de tes programmes

PS : Sinon , c'était quoi déjà ton problème ? je ne suis plus où on en est , là ...

[steve419]

ok ok

Les programmes qui ne sont pas à jour ce n'est pas mon problème...

il n'y a plus de problème alors

machine propre :)

Encore merci pour ton aide !

[bob63]

@ bob63 :

1 ) Coche et fixe toutes les lignes 04 avec Hijackthis .

2 ) Désinstalle Avast et Spybot .

3 ) Redémarre le pc .

4 ) Lance MBAM et poste le rapport créé.

Re

Comme dit precedement elle a essayé de desinstaller Spybot mais au redemarrage impossible d'avoir internet.

MBAM:

Malwarebytes' Anti-Malware 1.30

Version de la base de données: 1368

Windows 5.1.2600 Service Pack 3

06/11/2008 06:08:21

mbam-log-2008-11-06 (06-08-21).txt

Type de recherche: Examen complet (C:\|D:\|G:\|H:\|)

Eléments examinés: 306447

Temps écoulé: 4 hour(s), 37 minute(s), 44 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

[snooky]

Lance ComboFix et poste le raport céé :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

[bob63]

Voila:

ComboFix 08-11-05.02 - MonPC 2008-11-06 22:00:28.1 - NTFSx86

Microsoft Windows XP Édition familiale 5.1.2600.3.1252.1.1036.18.263 [GMT 1:00]

Lancé depuis: c:\documents and settings\MonPC\Bureau\ComboFix.exe

* Un nouveau point de restauration a été créé

.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\_000110_.tmp.dll

H:\Autorun.inf

.

((((((((((((((((((((((((((((( Fichiers créés du 2008-10-06 au 2008-11-06 ))))))))))))))))))))))))))))))))))))

.

2008-11-05 23:56 . 2008-11-05 23:56 <REP> d-------- c:\windows\LastGood

2008-11-05 21:12 . 2008-11-05 21:12 <REP> d-------- c:\program files\Malwarebytes' Anti-Malware

2008-11-05 21:12 . 2008-11-05 21:12 <REP> d-------- c:\documents and settings\MonPC\Application Data\Malwarebytes

2008-11-05 21:12 . 2008-11-05 21:12 <REP> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2008-11-05 21:12 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2008-11-05 21:12 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2008-11-05 21:00 . 2008-11-05 21:00 236 --a------ C:\sqmdata11.sqm

2008-11-05 21:00 . 2008-11-05 21:00 200 --a------ C:\sqmnoopt11.sqm

2008-11-05 20:49 . 2008-11-05 20:49 236 --a------ C:\sqmdata10.sqm

2008-11-05 20:49 . 2008-11-05 20:49 200 --a------ C:\sqmnoopt10.sqm

2008-11-05 18:20 . 2008-11-05 18:20 3,218 --a------ c:\windows\system32\PerfStringBackup.TMP

2008-11-05 18:19 . 2008-11-05 18:19 236 --a------ C:\sqmdata09.sqm

2008-11-05 18:19 . 2008-11-05 18:19 200 --a------ C:\sqmnoopt09.sqm

2008-11-05 18:17 . 2008-11-05 18:17 236 --a------ C:\sqmdata08.sqm

2008-11-05 18:17 . 2008-11-05 18:17 200 --a------ C:\sqmnoopt08.sqm

2008-11-05 18:13 . 2008-11-05 18:13 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition

2008-11-05 18:09 . 2008-11-05 18:09 <REP> d-------- c:\windows\ServicePackFiles

2008-11-05 16:45 . 2008-11-05 16:45 236 --a------ C:\sqmdata07.sqm

2008-11-05 16:45 . 2008-11-05 16:45 200 --a------ C:\sqmnoopt07.sqm

2008-11-05 15:32 . 2008-11-05 15:32 236 --a------ C:\sqmdata06.sqm

2008-11-05 15:32 . 2008-11-05 15:32 200 --a------ C:\sqmnoopt06.sqm

2008-11-05 15:29 . 2008-11-05 18:08 <REP> d-------- c:\program files\Microsoft SQL Server Compact Edition(2)

2008-11-05 15:25 . 2008-11-05 18:08 <REP> d-------- c:\program files\MessengerPlus! 3(2)

2008-11-05 12:11 . 2008-09-04 22:03 56,344 --a------ c:\windows\system32\drivers\fssfltr.sys

2008-11-05 11:45 . 2008-11-05 11:45 236 --a------ C:\sqmdata05.sqm

2008-11-05 11:45 . 2008-11-05 11:45 200 --a------ C:\sqmnoopt05.sqm

2008-11-05 10:57 . 2006-12-28 12:01 19,569 --a------ c:\windows\000001_.tmp

2008-11-05 10:28 . 2008-04-13 19:33 221,184 --a------ c:\windows\system32\wmpns.dll

2008-11-05 03:27 . 2008-04-13 19:34 294,912 -----c--- c:\windows\system32\dllcache\dlimport.exe

2008-11-05 03:23 . 2008-04-13 11:36 42,240 --------- c:\windows\system32\drivers\viaagp.sys

2008-11-05 03:23 . 2008-04-13 09:34 25,471 --------- c:\windows\system32\drivers\watv10nt.sys

2008-11-05 03:23 . 2008-04-13 09:34 22,271 --------- c:\windows\system32\drivers\watv06nt.sys

2008-11-05 03:23 . 2008-04-13 11:43 14,208 --------- c:\windows\system32\drivers\wacompen.sys

2008-11-05 03:23 . 2008-04-13 09:34 11,935 --------- c:\windows\system32\drivers\wadv11nt.sys

2008-11-05 03:23 . 2008-04-13 09:34 11,871 --------- c:\windows\system32\drivers\wadv09nt.sys

2008-11-05 03:23 . 2008-04-13 09:34 11,807 --------- c:\windows\system32\drivers\wadv07nt.sys

2008-11-05 03:23 . 2008-04-13 09:34 11,295 --------- c:\windows\system32\drivers\wadv08nt.sys

2008-11-05 03:21 . 2006-12-28 12:01 19,569 --a------ c:\windows\002803_.tmp

2008-11-05 03:18 . 2008-04-13 11:53 264,832 --a------ c:\windows\system32\drivers\http.sys

2008-11-05 03:18 . 2008-04-13 11:36 79,232 --a------ c:\windows\system32\drivers\sdbus.sys

2008-11-05 03:18 . 2008-04-13 18:54 41,856 --a------ c:\windows\system32\drivers\amdk7.sys

2008-11-05 03:18 . 2008-04-13 19:03 40,576 --a------ c:\windows\system32\drivers\intelppm.sys

2008-11-05 03:18 . 2008-04-13 11:45 30,208 --a------ c:\windows\system32\drivers\usbehci.sys

2008-11-05 03:18 . 2008-04-13 11:36 15,488 --a------ c:\windows\system32\drivers\mssmbios.sys

2008-11-05 03:18 . 2008-04-13 11:56 12,288 --a------ c:\windows\system32\drivers\tunmp.sys

2008-11-05 03:18 . 2008-04-13 11:40 11,904 --a------ c:\windows\system32\drivers\sffdisk.sys

2008-11-05 03:18 . 2008-04-13 11:40 11,008 --a------ c:\windows\system32\drivers\sffp_sd.sys

2008-11-05 03:17 . 2008-04-13 19:33 409,088 --a------ c:\windows\system32\qmgr.dll

2008-11-05 03:17 . 2008-04-13 11:33 129,792 --a------ c:\windows\system32\drivers\fltmgr.sys

2008-11-05 03:17 . 2006-03-02 13:00 83,906 --a------ c:\windows\system32\dllcache\apps.chm

2008-11-05 03:17 . 2008-04-13 11:53 36,608 --a------ c:\windows\system32\drivers\ip6fw.sys

2008-11-05 03:13 . 2008-11-05 10:57 <REP> d-------- c:\windows\EHome

2008-11-05 02:35 . 2008-11-05 11:16 <REP> d-------- c:\program files\adslTV

2008-11-05 02:35 . 2008-11-05 11:14 <REP> d-------- c:\documents and settings\MonPC\Application Data\vlc

2008-11-04 23:50 . 2008-11-04 23:50 <REP> d-------- c:\program files\Shareaza

2008-11-04 23:50 . 2008-11-04 23:50 <REP> d-------- c:\documents and settings\MonPC\Application Data\Shareaza

2008-10-29 21:46 . 2008-10-29 21:47 <REP> d-------- C:\d33f07e99628ab7c3daf0fc4

2008-10-24 10:49 . 2008-10-15 17:35 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll

2008-10-20 21:47 . 2008-10-20 21:47 <REP> d-------- C:\Downloads

2008-10-20 21:46 . 2008-10-27 23:07 <REP> d-------- c:\program files\BitComet

2008-10-18 14:22 . 2008-10-18 14:22 <REP> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2

2008-10-18 10:06 . 2007-07-30 18:19 271,224 --a------ c:\windows\system32\mucltui.dll

2008-10-18 10:06 . 2007-07-30 18:19 207,736 --a------ c:\windows\system32\muweb.dll

2008-10-18 10:06 . 2007-07-30 18:18 30,072 --a------ c:\windows\system32\mucltui.dll.mui

2008-10-17 21:09 . 2008-10-17 21:09 <REP> d-------- c:\program files\MSXML 4.0

2008-10-17 06:06 . 2008-10-17 11:19 <REP> d--hsc--- c:\program files\Fichiers communs\WindowsLiveInstaller

2008-10-17 05:55 . 2008-11-05 14:38 <REP> d-------- c:\documents and settings\All Users\Application Data\WLInstaller

2008-10-17 05:46 . 2008-11-06 20:02 <REP> d-------- c:\documents and settings\MonPC\Tracing

2008-10-17 05:46 . 2008-10-17 05:46 236 --a------ C:\sqmdata04.sqm

2008-10-17 05:46 . 2008-10-17 05:46 200 --a------ C:\sqmnoopt04.sqm

2008-10-17 05:44 . 2006-11-29 12:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll

2008-10-17 05:39 . 2008-10-17 05:39 <REP> d-------- c:\program files\Microsoft

2008-10-17 05:35 . 2008-10-17 05:35 <REP> d-------- c:\program files\Fichiers communs\Windows Live

2008-10-17 05:29 . 2008-10-17 05:29 <REP> d-------- C:\MSNCleaner

2008-10-17 05:21 . 2008-10-17 05:21 <REP> d-------- c:\documents and settings\MonPC\Application Data\MSNInstaller

2008-10-17 05:06 . 2008-08-14 14:23 2,191,232 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe

2008-10-17 05:06 . 2008-08-14 14:23 2,147,328 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe

2008-10-17 05:06 . 2008-08-14 14:23 2,068,096 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe

2008-10-17 05:06 . 2008-08-14 14:23 2,025,984 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe

2008-10-17 05:06 . 2008-09-15 16:26 1,846,528 -----c--- c:\windows\system32\dllcache\win32k.sys

2008-10-17 05:06 . 2008-09-08 11:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys

2008-10-17 05:06 . 2008-06-14 18:33 272,768 --------- c:\windows\system32\drivers\bthport.sys

2008-10-17 05:06 . 2008-06-14 18:33 272,768 -----c--- c:\windows\system32\dllcache\bthport.sys

2008-10-17 05:05 . 2008-05-08 15:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys

2008-10-17 05:04 . 2008-04-11 20:05 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll

2008-10-16 23:03 . 2008-11-05 20:31 <REP> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-10-16 23:02 . 2008-10-16 23:02 <REP> d-------- c:\program files\CCleaner

2008-10-16 22:53 . 2008-10-16 22:53 <REP> d-------- c:\program files\RegCleaner

2008-10-10 18:12 . 2008-10-10 18:12 <REP> d-------- c:\documents and settings\MonPC\Application Data\Lavasoft

2008-10-10 17:36 . 2008-10-10 17:36 <REP> d-------- c:\windows\Sun

2008-10-10 17:36 . 2008-10-10 17:36 <REP> d-------- c:\program files\Sun

2008-10-10 17:35 . 2008-06-10 01:32 73,728 --a------ c:\windows\system32\javacpl.cpl

2008-10-10 17:34 . 2008-10-10 17:35 <REP> d-------- c:\program files\Java

2008-10-10 17:32 . 2008-10-10 17:32 <REP> d-------- c:\program files\Fichiers communs\Java

2008-10-08 14:03 . 2008-10-28 22:59 54,156 --ah----- c:\windows\QTFont.qfn

2008-10-08 14:03 . 2008-10-08 14:03 1,409 --a------ c:\windows\QTFont.for

.

(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-05 17:08 --------- d-----w c:\program files\Windows Live

2008-11-05 17:08 --------- d-----w c:\program files\Messenger Plus! Live

2008-11-05 00:56 --------- d--h--w c:\program files\InstallShield Installation Information

2008-10-17 04:24 --------- d-----w c:\documents and settings\MonPC\Application Data\Sony

2008-10-17 04:20 --------- d-----w c:\program files\ma-config.com

2008-10-17 04:20 --------- d-----w c:\program files\DivX

2008-10-15 16:35 337,408 ----a-w c:\windows\system32\netapi32(4).dll

2008-10-15 16:35 337,408 ----a-w c:\windows\system32\netapi32(3).dll

2008-09-28 21:56 --------- d-----w c:\program files\eMule

2008-09-28 19:28 --------- d-----w c:\program files\PhotoFiltre

2008-09-27 11:37 --------- d-----w c:\documents and settings\Alain\Application Data\Apple Computer

2008-09-15 15:26 1,846,528 ----a-w c:\windows\system32\win32k.sys

2008-09-08 23:03 51,712 ----a-w c:\windows\system32\sirenacm.dll

2008-09-08 10:41 333,824 ----a-w c:\windows\system32\drivers\srv.sys

2008-09-05 15:04 288,768 ----a-w c:\windows\WLXPGSS.SCR

2008-08-20 05:10 670,208 ----a-w c:\windows\system32\wininet.dll

2008-08-20 05:10 670,208 ----a-w c:\windows\system32\wininet(4).dll

2008-08-20 05:10 670,208 ----a-w c:\windows\system32\wininet(3).dll

2008-08-20 05:10 620,544 ----a-w c:\windows\system32\urlmon(4).dll

2008-08-20 05:10 620,544 ----a-w c:\windows\system32\urlmon(3).dll

2008-08-14 13:23 2,191,232 ----a-w c:\windows\system32\ntoskrnl.exe

2008-08-14 13:23 2,068,096 ----a-w c:\windows\system32\ntkrnlpa.exe

.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

"ares"="c:\program files\Ares\Ares.exe" [2008-02-20 963072]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2008-09-09 3513344]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]

"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]

"NeroFilterCheck"="c:\program files\Fichiers communs\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]

"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-10-19 286720]

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

"AlcxMonitor"="ALCXMNTR.EXE" [2003-04-03 c:\windows\ALCXMNTR.EXE]

"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-13 15360]

"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

c:\documents and settings\All Users\Menu D‚marrer\Programmes\D‚marrage\

BTTray.lnk - c:\program files\Belkin\Logiciel Bluetooth\BTTray.exe [2005-08-24 577597]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"VIDC.VP40"= vp4vfw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Ares\\Ares.exe"=

"g:\\Program Files\\Ares\\Ares.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"18757:TCP"= 18757:TCP:BitComet 18757 TCP

"18757:UDP"= 18757:UDP:BitComet 18757 UDP

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-07-19 78416]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]

R2 fssfltr;FssFltr;c:\windows\system32\DRIVERS\fssfltr.sys [2008-09-04 56344]

R3 SG760_XP;SAGEM 802.11g XG760 1211 Driver;c:\windows\system32\DRIVERS\WlanUZXP.sys [2005-06-01 260608]

S3 fsssvc;Windows Live Contrôle parental;c:\program files\Windows Live\Family Safety\fsssvc.exe [2008-09-04 512536]

S3 s916bus;Sony Ericsson Device 916 driver (WDM);c:\windows\system32\DRIVERS\s916bus.sys [2007-11-02 83496]

S3 s916mgmt;Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM);c:\windows\system32\DRIVERS\s916mgmt.sys [2007-11-02 103976]

*Newly Created Service* - PROCEXP90

.

Contenu du dossier 'Tâches planifiées'

2008-11-05 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

.

- - - - ORPHELINS SUPPRIMES - - - -

HKLM-Run-NWEReboot - (no file)

.

------- Examen supplémentaire -------

.

FireFox -: Profile - c:\documents and settings\MonPC\Application Data\Mozilla\Firefox\Profiles\wrufo0bg.default\

FF -: plugin - c:\documents and settings\MonPC\Application Data\Mozilla\Firefox\Profiles\wrufo0bg.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-06 22:07:53

Windows 5.1.2600 Service Pack 3 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès

Fichiers cachés: 0

**************************************************************************

.

Heure de fin: 2008-11-06 22:11:27

ComboFix-quarantined-files.txt 2008-11-06 21:11:14

Avant-CF: 133 084 323 840 octets libres

Après-CF: 133,231,054,848 octets libres

WindowsXP-KB310994-SP2-Home-BootDisk-FRA.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /noexecute=optin /fastdetect

223 --- E O F --- 2008-11-05 09:45:28

[Mace Windu]

Bonsoir,

Voilà mon PC est instable....

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:38:35, on 06/11/2008

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Normal

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\system32\taskeng.exe

C:\Windows\Explorer.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe

C:\Program Files\HP\HP Software Update\hpwuSchd2.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Program Files\HP\QuickPlay\QPService.exe

C:\Program Files\IDT\WDM\sttray.exe

C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Windows\ehome\ehtray.exe

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE

C:\Windows\ehome\ehmsas.exe

C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Opera\opera.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...ion&pf=cnnb

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [uCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\2.0"

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"

O4 - HKLM\..\Run: [sysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O13 - Gopher Prefix:

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_030ac640\aestsrv.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: HP Service (hpsrv) - Hewlett-Packard Corporation - C:\Windows\system32\Hpservice.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe

O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe

O23 - Service: Recovery Service for Windows - Unknown owner - C:\Windows\SMINST\BLService.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_a7e996cd\STacSV.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--

End of file - 9966 bytes

[snooky]

@ bob63 :

Supprime ComboFix.

Lance PureRA > chek all > clean .

http://raproducts.org/click/click.php?id=1

Lance Update checker et mets à jour les programmes > signature )

Lance Clean v2.0 , bu FRUiT , procédure 1 > signature )

Redémarre le pc .

Installe Antivir > signature )

[snooky]

@ Mace Windu :

Désinstalle Ad-Aware et Avast .

Coche et fixe toutes les lignes04 avec Hijackthis .

Lance une analyse complète avec MBAM et poste le rapport créé .

[snooky]

^^

[Aoren]

Hello Snooky !

me voilà sur l'ordi portable d'un ami, et celui-ci m'a l'air bien mal en point, je t'envois donc son rapport HijackThis :

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:37:28, on 17/11/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ewido anti-spyware 4.0\guard.exe

C:\WINDOWS\system32\ifxspmgt.exe

C:\WINDOWS\system32\ifxtcs.exe

C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\PDF Complete\pdfsvc.exe

C:\WINDOWS\system32\IfxPsdSv.exe

C:\Novadigm\ManagementAgent\nvdkit.exe

C:\Program Files\Sprint-HP\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

C:\Program Files\Hewlett-Packard\IAM\bin\asghost.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE

C:\WINDOWS\system32\AccelerometerSt.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\Embedded Security Software\PSDrt.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\Program Files\PDF Complete\pdfsty.exe

C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\HPQ\HP Connection Manager\WaHelper.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe

C:\Program Files\ewido anti-spyware 4.0\ewido.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DAEMON Tools Pro\DTProAgent.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Windows Live Toolbar\msn_sl.exe

C:\Documents and Settings\Administrateur\Bureau\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS02

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sfr.fr/kit/adsl/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

R3 - URLSearchHook: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

F3 - REG:win.ini: load=System

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,System

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: (no name) - {A12D780A-5BA0-4418-AD5E-380DD70A7215} - C:\WINDOWS\system32\cbXrRKCU.dll (file missing)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O2 - BHO: Credential Manager for HP ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [soundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray

O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start

O4 - HKLM\..\Run: [iFXSPMGT] C:\WINDOWS\system32\ifxspmgt.exe /NotifyLogon

O4 - HKLM\..\Run: [CognizanceTS] rundll32.exe C:\PROGRA~1\HEWLET~1\IAM\Bin\ASTSVCC.dll,RegisterModule

O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"

O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe

O4 - HKLM\..\Run: [AT&T Communication Manager] "C:\Program Files\AT&T\Communication Manager\ATTCM.exe" -a

O4 - HKLM\..\Run: [WatcherHelper] "C:\Program Files\HPQ\HP Connection Manager\WaHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Fichiers communs\LogiShrd\LComMgr\Communications_Helper.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [{9284C590-2364-B640-A982-E205A23DFC68}] "C:\Documents and Settings\Administrateur\Local Settings\Temporary Internet Files\Content.IE5\NK7Y3TKT\MSCodec.1408.13[1].exe" /r

O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Fichiers communs\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [steam] "C:\Program Files\Valve\Steam\Steam.exe" -silent

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Startup: CCC.lnk = ?

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Envoyer au périphérique &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Ajout Direct - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &Ajout Direct dans Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1220457044593

O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O20 - AppInit_DLLs: APSHook.dll

O20 - Winlogon Notify: cbXrRKCU - cbXrRKCU.dll (file missing)

O20 - Winlogon Notify: OneCard - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Fichiers communs\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Service Bonjour (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Drive Encryption Service (HpFkCryptService) - SafeBoot International - C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\ifxspmgt.exe

O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\ifxtcs.exe

O23 - Service: Service de l'iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Fichiers communs\InterVideo\RegMgr\iviRegMgr.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe

O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVCOMSER\LVComSer.exe

O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\LVMVFM\LVPrcSrv.exe

O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Fichiers communs\LogiShrd\SrvLnch\SrvLnch.exe

O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe

O23 - Service: Personal Secure Drive service for encrypted drives (PersonalSecureDriveService) - Infineon Technologies AG - C:\WINDOWS\system32\IfxPsdSv.exe

O23 - Service: Radia Management Agent (rma) - Unknown owner - C:/Novadigm/ManagementAgent/nvdkit.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Fichiers communs\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: SPCSUtilityService - Sprint Spectrum, L.L.C - C:\Program Files\Sprint-HP\Sierra Wireless\Sprint PCS Connection Manager\SPCSUtilityService.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Fichiers communs\SureThing Shared\stllssvr.exe

O23 - Service: SWIHPWMI - Sierra Wireless Inc. - C:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe

O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 15202 bytes

[snooky]

@ Aoren :

Coche et fixe toutes les lignes 04 sauf AntiVir .

Redémarre le pc .

Lance Clean v2.0 by FRUiT , procédure 1 .

Vise ma signature ...

Redémarre le pc .

Lance une analyse complète avec MBAM , supprime tout ce qu'il trouve et poste le rapport créé.

Vise ma signature ...

[Aoren]

En tout cas, merci de ta précieuse aide

voici le rapport MBAM :

Malwarebytes' Anti-Malware 1.30

Version de la base de données: 1403

Windows 5.1.2600 Service Pack 3

17/11/2008 15:26:26

mbam-log-2008-11-17 (15-26-26).txt

Type de recherche: Examen complet (C:\|)

Eléments examinés: 121664

Temps écoulé: 35 minute(s), 36 second(s)

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 10

Valeur(s) du Registre infectée(s): 1

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 1

Fichier(s) infecté(s): 9

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

Clé(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a12d780a-5ba0-4418-ad5e-380dd70a7215} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbxrrkcu (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{a12d780a-5ba0-4418-ad5e-380dd70a7215} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{a12d780a-5ba0-4418-ad5e-380dd70a7215} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valeur(s) du Registre infectée(s):

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{a12d780a-5ba0-4418-ad5e-380dd70a7215} (Trojan.Vundo) -> Quarantined and deleted successfully.

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

Dossier(s) infecté(s):

C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.

Fichier(s) infecté(s):

C:\WINDOWS\system32\cbXrRKCU.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\foo.txt (Trojan.Fakealert) -> Quarantined and deleted successfully.

C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.

[snooky]

Lance VundoFix et clique sur Remove , si découvertes ...

http://vundofix.atribune.org/

Analyse le pc en mode san échec avec Antivir.

Garde MBAM , à lancer de temps à autres ...

[Aoren]

Merci Snooky, t'es un chef

[zygomatikdan]

Hello Snooky!

J'ai un petit probleme sur un ordi sous Vista que j'utilise au taf,il rame anormalement,voici le rapport Hijackthis.

Je te remercie d'avance pour ton aide.

Logfile of HijackThis v1.99.1

Scan saved at 17:41:28, on 20/11/2008

Platform: Unknown Windows (WinNT 6.00.1904)

MSIE: Internet Explorer v7.00 (7.00.6000.16681)

Running processes:

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Windows\system32\taskeng.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Windows\System32\SysMonitor.exe

C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

C:\Program Files\OrangeHSS\Systray\SystrayApp.exe

C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe

C:\Program Files\Alwil Software\Avast4\ashDisp.exe

C:\Windows\vsnpstd3.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

C:\Acer\Empowering Technology\ACER.EMPOWERING.FRAMEWORK.SUPERVISOR.EXE

C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe

C:\Acer\Empowering Technology\eRecovery\ERAGENT.EXE

C:\Windows\System32\mobsync.exe

J:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://fr.fr.acer.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://fr.fr.acer.yahoo.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.fr/0SEFRFR/SAOS01?FORM=TOOLBR

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\OrangeHSS\SearchURLHook\SearchPageURL.dll

O1 - Hosts: ::1 localhost

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: ShowBarObj Class - {83A2F9B1-01A2-4AA5-87D1-45B6B8505E96} - C:\Windows\system32\ActiveToolBand.dll

O2 - BHO: Programme d'aide de l'Assistant de connexion Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Yahoo! Toolbar avec bloqueur de fenêtres pop-up - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\system32\eDStoolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe

O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\Windows\system32\SysMonitor.exe

O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe

O4 - HKLM\..\Run: [WarReg_PopUp] C:\Acer\WR_PopUp\WarReg_PopUp.exe

O4 - HKLM\..\Run: [systrayORAHSS] "C:\Program Files\OrangeHSS\Systray\SystrayApp.exe"

O4 - HKLM\..\Run: [PCMService] "C:\Acer\Empowering Technology\eMode\PCM\PCMService.exe"

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [snpstd3] C:\Windows\vsnpstd3.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [?????????] ??????????????e

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Empowering Technology Launcher.lnk = ?

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Recherche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\nlaapi.dll

O10 - Unknown file in Winsock LSP: c:\windows\system32\napinsp.dll

O11 - Options group: [iNTERNATIONAL] International*

O13 - Gopher Prefix:

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL

O23 - Service: ePerformance Service (AcerMemUsageCheckService) - Unknown owner - C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)

O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)

O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLCapSvc.exe

O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Acer\Empowering Technology\eMode\PCM\Kernel\TV\CLSched.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)

O23 - Service: eDSService.exe (eDataSecurity Service) - HiTRSUT - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe

O23 - Service: eRecovery Service (eRecoveryService) - Acer Inc. - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe

O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom SA - C:\PROGRA~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: @%SystemRoot%\system32\qwave.dll,-1 (QWAVE) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe

O23 - Service: @%SystemRoot%\system32\seclogon.dll,-7001 (seclogon) - Unknown owner - %windir%\system32\svchost.exe (file missing)

O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - %ProgramFiles%\Windows Media Player\wmpnetwk.exe (file missing)