Bonjour,
 
Mon PC est infecté par un Trojan.Vundo d'après Norton Antivirus.
 
Pouvez-vous m'aider à m'en débarasser ?
 
Merci d'avance.

Bonjour,
 
Télécharge Hijackthis (de Merjin).
Dézippe-le dans un dossier ou sur ton Bureau.
 
Lance l'application (Hijackthis.exe) :
- Choisis l'option "Do a system scan and save a logfile"
- Le Bloc-Notes s'ouvre, poste son contenu :
 
-> Edition / Sélectionner tout
-> Edition / Copier
-> Clique-Droit / Coller dans ta réponse
 
AIDE : Tuto en vidéo sur Hijackthis

Bonjour,
 
Voici le log Hijackthis.
 
Logfile of HijackThis v1.99.1
Scan saved at 14:23:14, on 05/06/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\Installation\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Installation\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
D:\Installation\lotus\notes\ntmulti.exe
D:\Installation\NavNT\rtvscan.exe
D:\Installation\OCS Inventory Agent\ocsservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
D:\Installation\NavNT\vptray.exe
D:\Installation\Java\jre1.6.0_01\bin\jusched.exe
D:\Installation\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\internat.exe
D:\Installation\KO Approach\Approach.exe
D:\Installation\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
E:\Mes documents\HijackThis.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =  
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =  
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {27291151-855C-43B8-8971-03177B8AEB1F} - C:\WINNT\system32\sstqq.dll
O2 - BHO: (no name) - {73BA12CB-F801-41F7-B199-0474FB66D090} - C:\WINNT\system32\yaywttr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {CD3447D4-CA39-4377-8084-30E86331D74C} - C:\WINNT\system32\yueplfpl.dll (file missing)
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] D:\Installation\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Installation\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Installation\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Genuine] rundll32.exe "C:\WINNT\system32\ktpdwmrp.dll",realset
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [KO Approach] D:\Installation\KO Approach\Approach.exe
O4 - Startup: KO Approach.lnk = D:\Installation\KO Approach\Approach.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Installation\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Installation\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Rechercher avec Google... - D:\Installation\Avant Browser\Search.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: YellowPen - {357dfe3b-3a62-11d5-86c1-0010b544d453} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: YellowPen - {357dfe3b-3a62-11d5-86c1-0010b544d453} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - (no file)
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Installation\IrfanView\Ebay\Ebay.htm
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/g [...] er_gmn.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 4289624992
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/micros [...] 5400838297
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharge [...] 2&version=
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CS2\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O20 - AppInit_DLLs:  C:\WINNT\system32\spoolsv.dll
O20 - Winlogon Notify: sstqq - C:\WINNT\system32\sstqq.dll
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O20 - Winlogon Notify: winrnt32 - C:\WINNT\SYSTEM32\winrnt32.dll
O20 - Winlogon Notify: yaywttr - C:\WINNT\SYSTEM32\yaywttr.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Installation\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - D:\Installation\NavNT\defwatch.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - D:\Installation\lotus\notes\ntmulti.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Installation\NavNT\rtvscan.exe
O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - D:\Installation\OCS Inventory Agent\ocsservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe

D'après Norton Antivirus, un fichier incriminé est : sstqq.dll

Re,
 
Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

• Double-clique VundoFix.exe afin de le lancer
• Clique sur le bouton Scan for Vundo
• Lorsque le scan est complété, clique sur le bouton Remove Vundo
• Une invite te demandera si tu veux supprimer les fichiers, clique YES
• Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers
• Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK
• Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse

Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

Re,
 
Ci-après le rapport VundoFix :
 
VundoFix V6.4.2
 
Checking Java version...
 
Sun Java not detected
Scan started at 14:36:55 05/06/2007
 
Listing files found while scanning....
 
C:\WINNT\system32\ktpdwmrp.dll
C:\WINNT\system32\prmwdptk.ini
C:\WINNT\system32\qqtss.bak1
C:\WINNT\system32\qqtss.bak2
C:\WINNT\system32\qqtss.ini
C:\WINNT\system32\sstqq.dll
C:\WINNT\system32\tuvuvwv.dll
C:\WINNT\system32\yaywttr.dll
C:\WINNT\system32\yueplfpl.dll
 
Beginning removal...
 
 Attempting to delete C:\WINNT\system32\ktpdwmrp.dll
C:\WINNT\system32\ktpdwmrp.dll Has been deleted!
 
 Attempting to delete C:\WINNT\system32\prmwdptk.ini
C:\WINNT\system32\prmwdptk.ini Has been deleted!
 
 Attempting to delete C:\WINNT\system32\qqtss.bak1
C:\WINNT\system32\qqtss.bak1 Has been deleted!
 
 Attempting to delete C:\WINNT\system32\qqtss.bak2
C:\WINNT\system32\qqtss.bak2 Has been deleted!
 
 Attempting to delete C:\WINNT\system32\qqtss.ini
C:\WINNT\system32\qqtss.ini Has been deleted!
 
 Attempting to delete C:\WINNT\system32\sstqq.dll
C:\WINNT\system32\sstqq.dll Has been deleted!
 
 Attempting to delete C:\WINNT\system32\tuvuvwv.dll
C:\WINNT\system32\tuvuvwv.dll Has been deleted!
 
 Attempting to delete C:\WINNT\system32\yaywttr.dll
C:\WINNT\system32\yaywttr.dll Has been deleted!
 
Performing Repairs to the registry.
Done!
 
 
Et ci-après le nouveau log Hijackthis :
 
Logfile of HijackThis v1.99.1
Scan saved at 17:15:00, on 05/06/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\Installation\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Installation\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
D:\Installation\lotus\notes\ntmulti.exe
D:\Installation\NavNT\rtvscan.exe
D:\Installation\OCS Inventory Agent\ocsservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\hkcmd.exe
D:\Installation\NavNT\vptray.exe
D:\Installation\Java\jre1.6.0_01\bin\jusched.exe
D:\Installation\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\internat.exe
D:\Installation\KO Approach\Approach.exe
D:\Installation\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
D:\Installation\Mozilla Firefox\firefox.exe
E:\Mes documents\HijackThis.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =  
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =  
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {27291151-855C-43B8-8971-03177B8AEB1F} - C:\WINNT\system32\sstqq.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [vptray] D:\Installation\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Installation\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Installation\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [KO Approach] D:\Installation\KO Approach\Approach.exe
O4 - Startup: KO Approach.lnk = D:\Installation\KO Approach\Approach.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Installation\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Installation\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Rechercher avec Google... - D:\Installation\Avant Browser\Search.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: YellowPen - {357dfe3b-3a62-11d5-86c1-0010b544d453} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: YellowPen - {357dfe3b-3a62-11d5-86c1-0010b544d453} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - (no file)
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Installation\IrfanView\Ebay\Ebay.htm
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/g [...] er_gmn.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 4289624992
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/micros [...] 5400838297
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharge [...] 2&version=
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CS2\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O20 - AppInit_DLLs:  C:\WINNT\system32\spoolsv.dll
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O20 - Winlogon Notify: winrnt32 - C:\WINNT\SYSTEM32\winrnt32.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Installation\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - D:\Installation\NavNT\defwatch.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - D:\Installation\lotus\notes\ntmulti.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Installation\NavNT\rtvscan.exe
O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - D:\Installation\OCS Inventory Agent\ocsservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
 
 

Re,
 

 
Télécharge Combofix
Sauvegarde-le sur ton Bureau et pas ailleurs !
 
Clique sur le menu Démarrer puis Executer, copie/colle ceci :
"%userprofile%\Bureau\combofix.exe" /v winrnt32
Clique sur [OK]. Suis les invites.
 
Attends que Combofix ait terminé, un rapport sera créé. Poste le rapport.  

Re,
 
Et voici le rapport de ComboFix :
 
"OLE" - 05/06/2007 17:28:25    Service Pack 4  NTFS  
ComboFix 07-06-3 - Running from: "C:\Documents and Settings\ole\Bureau\"
Command switches used :: "/v winrnt32"
 
 
((((((((((((((((((((((((((((((((((((((((((((   V Log   )))))))))))))))))))))))))))))))))))))))))))))))))))))))
 
 
C:\WINNT\system32\winrnt32.dll  
C:\WINNT\system32\winrnt32.dll  
 
 
* * *  POST RUN FILES/FOLDERS  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
 
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
 
 
 
-- Purity Folders:
C:\DOCUME~1\ole\APPLIC~1\CROSOF~1
C:\WINNT\system32\drivers\npf.sys
C:\WINNT\system32\packet.dll
C:\WINNT\system32\pthreadVC.dll
C:\WINNT\system32\wpcap.dll
C:\WINNT\system32\wtscc.exe
 
 
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
 
 
-------\LEGACY_NPF
-------\NPF
 
 
(((((((((((((((((((((((((   Files Created from 2007-05-05 to 2007-06-05  )))))))))))))))))))))))))))))))
 
 
2007-06-05 14:36 <DIR> d-------- C:\VundoFix Backups
2007-05-31 17:05 <DIR> d-------- C:\DOCUME~1\ole\APPLIC~1\Microsoft Web Folders
2007-05-30 17:01 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-05-29 09:06 <DIR> d-------- C:\DOCUME~1\ole\APPLIC~1\U3
2007-05-15 17:59 11,824 --a------ C:\WINNT\system32\drivers\mouhid.sys
 
 
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
 
2007-06-05 07:43:57 -------- d-----w D:\Installation\OCS Inventory Agent
2007-06-01 16:32:05 -------- d-----w C:\DOCUME~1\ole\APPLIC~1\Canon
2007-05-30 13:50:43 -------- d-----w C:\DOCUME~1\ole\APPLIC~1\Avant Browser
2007-05-22 12:50:08 -------- d-----w D:\Installation\PersonalBrain 3.0
2007-05-22 12:38:37 -------- d-----w D:\Installation\Fichiers communs
2007-05-22 08:54:58 -------- d-----w D:\Installation\Replisting
2007-05-22 08:54:56 -------- d--h--w D:\Installation\InstallShield Installation Information
2007-05-09 14:56:24 -------- d-----w D:\Installation\WS_FTP
2007-04-05 10:13:33 -------- d-----w D:\Installation\ABC Amber Lotus 1-2-3 Converter
2004-11-16 11:42:04 108 --sha-r C:\WINNT\neoqaz2.dll
2004-10-20 09:45:06 0 --sha-w C:\WINNT\winee32.exe
 
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown  
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{27291151-855C-43B8-8971-03177B8AEB1F}=C:\WINNT\system32\sstqq.dll []
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=D:\Installation\Java\jre1.6.0_01\bin\ssv.dll [07-03-14 03:43 ]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vptray"="D:\Installation\NavNT\vptray.exe" [01-09-26 18:06 ]
"SunJavaUpdateSched"="D:\Installation\Java\jre1.6.0_01\bin\jusched.exe" [07-03-14 03:43 ]
"Tweak UI"="TWEAKUI.CPL" [02-01-06 01:53  C:\WINNT\system32\TWEAKUI.CPL]
"!AVG Anti-Spyware"="D:\Installation\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06-10-07 14:20 ]
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"internat.exe"="internat.exe" [02-08-21 22:44  C:\WINNT\system32\internat.exe]
"KO Approach"="D:\Installation\KO Approach\Approach.exe" [07-02-01 22:10 ]
 
[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=
 
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"internat.exe"=internat.exe
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"=0 (0x0)
 
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\WINNT\Web\Wallpaper\afrika-start-wallpaper-6.jpg
FriendlyName=  
 
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\1]
Source= C:\WINNT\Web\Wallpaper\mamady.jpg
FriendlyName=  
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="D:\Installation\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [06-09-28 16:13 ]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"System"=dword:00000000
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winhdn32]
winhdn32.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"= C:\WINNT\system32\spoolsv.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"HPHmon05"=C:\WINNT\system32\hphmon05.exe
"HP Software Update"="D:\Installation\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"
"HP Component Manager"="D:\Installation\HP\hpcoretech\hpcmpmgr.exe"
"HPHUPD05"=D:\Installation\Hewlett-Packard\{D946675D-1D6C-4dc8-9E0D-B4B8EAA30EAA}\hphupd05.exe
 
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
 
 
Contents of the 'Scheduled Tasks' folder
2007-06-05 15:37:19  C:\WINNT\tasks\a-squared StartCenter.job
2007-06-05 15:21:00  C:\WINNT\tasks\HP Usg Daily.job
 
**************************************************************************
 
catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-05 17:37:16
Windows 5.0.2195 Service Pack 4 NTFS
 
scanning hidden processes ...
 
scanning hidden autostart entries ...
 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  System = 63
 
scanning hidden files ...
 
scan completed successfully
hidden files: 0
 
**************************************************************************
 
Completion time: 2007-06-05 17:39:22 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-06-05 17:39  
 
 --- E O F ---

J'arrive à voir les rapports en entier
 
Reposte un rapport Hijackthis.

Logfile of HijackThis v1.99.1
Scan saved at 18:23, on 2007-06-05
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
 
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
D:\Installation\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Installation\NavNT\defwatch.exe
C:\WINNT\System32\svchost.exe
D:\Installation\lotus\notes\ntmulti.exe
D:\Installation\NavNT\rtvscan.exe
D:\Installation\OCS Inventory Agent\ocsservice.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
D:\Installation\NavNT\vptray.exe
D:\Installation\Java\jre1.6.0_01\bin\jusched.exe
D:\Installation\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINNT\system32\internat.exe
D:\Installation\KO Approach\Approach.exe
D:\Installation\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
D:\Installation\Mozilla Firefox\firefox.exe
E:\Mes documents\HijackThis.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.fr/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =  
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =  
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: (no name) - {27291151-855C-43B8-8971-03177B8AEB1F} - C:\WINNT\system32\sstqq.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - (no file)
O4 - HKLM\..\Run: [vptray] D:\Installation\NavNT\vptray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Installation\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Installation\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [internat.exe] internat.exe
O4 - HKCU\..\Run: [KO Approach] D:\Installation\KO Approach\Approach.exe
O4 - Startup: KO Approach.lnk = D:\Installation\KO Approach\Approach.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Installation\Adobe\Acrobat 4.0\Distillr\AcroTray.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Installation\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Rechercher avec Google... - D:\Installation\Avant Browser\Search.htm
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Installation\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: YellowPen - {357dfe3b-3a62-11d5-86c1-0010b544d453} - C:\WINNT\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: YellowPen - {357dfe3b-3a62-11d5-86c1-0010b544d453} - C:\WINNT\system32\shdocvw.dll
O9 - Extra button: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - (no file)
O9 - Extra 'Tools' menuitem: Corel Network monitor worker - {8F5212A5-8009-448D-95B4-B5900A419135} - (no file)
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Fichiers communs\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - D:\Installation\IrfanView\Ebay\Ebay.htm
O15 - Trusted IP range: 206.161.125.149
O15 - ProtocolDefaults: 'http' protocol is in Trusted Zone, should be Internet Zone
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/g [...] er_gmn.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/window [...] 4289624992
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/micros [...] 5400838297
O16 - DPF: {867E13F2-7F31-44FB-AC97-CD38E0DC46EF} (HardwareDetection Control) - http://drivers1.free.fr/telecharge [...] 2&version=
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CCS\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CS1\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = PAR.fr
O17 - HKLM\System\CS2\Services\Tcpip\..\{4F86CF66-1916-415F-B341-42DC89EF7B4E}: NameServer = 192.9.201.250
O20 - AppInit_DLLs:  C:\WINNT\system32\spoolsv.dll
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - D:\Installation\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DefWatch - Symantec Corporation - D:\Installation\NavNT\defwatch.exe
O23 - Service: Service d'administration du Gestionnaire de disque logique (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Multi-user Cleanup Service - IBM Corp - D:\Installation\lotus\notes\ntmulti.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Installation\NavNT\rtvscan.exe
O23 - Service: OCS INVENTORY SERVICE (OCS INVENTORY) - http://ocsinventory.sourceforge.net - D:\Installation\OCS Inventory Agent\ocsservice.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
 

Re,
 
Re,
 
- Lance Hijackthis ->Do a system scan only
->Coche les lignes ci-dessous :
 
O2 - BHO: (no name) - {27291151-855C-43B8-8971-03177B8AEB1F} - C:\WINNT\system32\sstqq.dll (file missing)
O2 - BHO: (no name) - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - (no file)  
O20 - AppInit_DLLs:  C:\WINNT\system32\spoolsv.dll
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)  
 
Clique sur Fix checked (en bas à gauche)
 
Télécharge OTMoveIt (d'OldTimer). Sauvegarde-le sur ton Bureau.
Sélectionne l'emplacement en gras ci-dessous :
 
C:\WINNT\system32\spoolsv.dll
 
---> Clique-droit puis Copier (ou Ctrl+C)
 
Double-clique sur OTMoveIt.exe afin de le lancer.
Fais un Clique-droit sur le cadre de gauche puis choisis Coller (ou Ctrl+V).
Clique maintenant sur MoveIt!
 
Si un fichier ou dossier ne peut pas être supprimé immédiatement, le logiciel te demandera de redémarrer.  
Accepte en cliquant sur YES.
 
Poste le rapport situé dans ce dossier : C:\_OTMoveIt\MovedFiles\
Le nom du rapport correspond au moment de sa création : date_heure.log

Re,
 
 
MoveIt! indique qu'il ne trouve pas C:\WINNT\system32\spoolsv.dll.
 
Je ne trouve pas de rapport dans C:\_OTMoveIt\MovedFiles\   ou ailleurs