bonjour je pense avoir un virus car microsoft ma averti

lolodi63

1 Novembre 2007 09:56:06

bonjour ,
avant tout je souhaiterais remercier tout ceux qui pourront m'aider car j'ai deja eu un probleme similaire et je sais que vous etes des rois de l'aide!!!
Alors je vous explique mon probleme:
J'ai depuis quelques jours des pubs sans arret quand j'ouvre un lien ou ma boite emails par exemple a la place sa m'ouvre une pub ou des fois je veux allé sur un site et sa m'ouvre une pub alors que l'adresse es correcte.
tout a l'heure microsoft m'a prevenu que mon pc etait peut etre infecté donc si c'est le cas comment dois je faire pour le savoir et pour l'enlevé si c'est le cas? Je vous remercie de votre aide!

Autres pages sur : bonjour pense virus microsoft averti

| Etre averti des réponses
| Alerter

Répondre à lolodi63

lolodi63

1 Novembre 2007 10:17:37

bon donc j'ai bel et bien un virus car c'est une catastrophe mon pc es tout mou et j'ai meme du mal a venir jusqu'ici pour vous dire ce qui se passe car internet se ferme tout seule sans arret et ne m'ouvre pas du tout les bonnes pages a chaque fois c'est une veritable galère !!
merci beaucoup pour ceux qui m'aideront !!

| Alerter

Répondre à lolodi63

XmichouX

1 Novembre 2007 10:40:23

Bonjour,

Télécharge Hijackthis
Poste un rapport en suivant ce tuto.

| Alerter

Répondre à XmichouX

lolodi63

1 Novembre 2007 10:52:48

ok merci!!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53:34, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\puequavo.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\spupdsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spnpinst.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Sysocmgr.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\AdobeR.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\system32\ctfmon.exe
C:\themeGold55\CursorXP\CursorXP.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Azureus\Azureus.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\claude\Bureau\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O1 - Hosts: 66.98.148.65 auto.search.msn.com
O1 - Hosts: 66.98.148.65 auto.search.msn.es
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [RavAV] C:\WINDOWS\AdobeR.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [f0937c49] rundll32.exe "C:\WINDOWS\system32\pvauktyk.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\themeGold55\CursorXP\CursorXP.exe -s
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Cont...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0065BA.dat
O23 - Service: DomainService - - C:\WINDOWS\system32\puequavo.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 6804 bytes

voila merci encore!

| Alerter

Répondre à lolodi63

XmichouX

1 Novembre 2007 10:59:16

Plusieurs infections, un scan antivir en mode sans échec à la fin ne fera pas de mal.

1 / Télécharge Flash Disinfector sur ton Bureau

Connecte tous les périphériques externes ( DD , USB , ..... )

Double clique sur Flash Disinfector et laisse toi guider.

2 / Télécharge VundoFix.exe :

Double-clique VundoFix.exe .
Clique sur Scan for Vundo.
Lorsque le scan est complété, clique sur le bouton Remove Vundo.
Ensuite clique sur YES
Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers.
Tu auras un message comme quoi l%u2019ordinateur va s%u2019éteindre, fais ok

Poste le rapport qui se trouve dans C:\vundofix.txt

3 / / Télécharge Combofix (par sUBs) sur ton Bureau. (Tuto)
Double clique combofix.exe.
Tape sur la touche 1 (Yes) pour démarrer le scan.
Lorsque le scan sera complété, un rapport apparaîtra. Poste ce rapport dans ta prochaine réponse.

Le rapport se trouve ici : C:\Combofix.txt

4 / Poste un nouveau rapport HiJackThis (en ayant renommé HiJackthis.exe en SCANNER.EXE)

| Alerter

Répondre à XmichouX

lolodi63

1 Novembre 2007 11:42:15

VundoFix V6.5.4

Checking Java version...

Scan started at 12:17:45 1/11/2007

Listing files found while scanning....

No infected files were found.

Beginning removal...
voila le rapport vundo fix par contre le bureau s'est effacé apres flash desinfector mais pas apres vundofix donc je sais pas si c'est normal...

| Alerter

Répondre à lolodi63

XmichouX

1 Novembre 2007 11:52:39

Continue

| Alerter

Répondre à XmichouX

lolodi63

1 Novembre 2007 13:00:36

ComboFix 07-11-01.1 - claude 2007-11-01 12:47:17.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.260 [GMT 1:00]
Running from: C:\Documents and Settings\claude\Bureau\ComboFix.exe
* Created a new restore point
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c0065BA.dat
C:\WINDOWS\system32\gebyy.dll
C:\WINDOWS\system32\install.exe
C:\WINDOWS\system32\kytkuavp.ini
C:\WINDOWS\system32\puequavo.exe
C:\WINDOWS\system32\pvauktyk.dll
C:\WINDOWS\system32\sysdl132.exe
C:\WINDOWS\system32\vohvluxe.dll
C:\WINDOWS\system32\ygjbckna.dll
C:\WINDOWS\system32\yybeg.bak1
C:\WINDOWS\system32\yybeg.bak2
C:\WINDOWS\system32\yybeg.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService

((((((((((((((((((((((((((((( Fichiers créés 2007-10-01 to 2007-11-01 ))))))))))))))))))))))))))))))))))))
.

2007-11-01 12:17 <REP> d-------- C:\VundoFix Backups
2007-11-01 12:04 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-10-31 16:18 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-10-31 16:18 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2007-10-31 16:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-31 16:18 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-31 16:16 1,966,312 --a------ C:\WINDOWS\system32\drivers\VX1000.sys
2007-10-31 16:16 709,992 --a------ C:\WINDOWS\vVX1000.exe
2007-10-31 16:16 476,520 --a------ C:\WINDOWS\vVX1000.dll
2007-10-31 16:16 202,088 --a------ C:\WINDOWS\system32\LCCoin14.dll
2007-10-31 16:16 185,704 --a------ C:\WINDOWS\system32\cVX1000.dll
2007-10-31 16:16 116,072 --a------ C:\WINDOWS\VX1000.dll
2007-10-31 16:14 <REP> d-------- C:\Program Files\Microsoft LifeCam
2007-10-31 15:54 <REP> d-------- C:\WINDOWS\system32\drivers\umdf
2007-10-31 14:44 <REP> d-------- C:\WINDOWS\Sun
2007-10-31 14:43 <REP> d-------- C:\Program Files\Java
2007-10-31 14:43 <REP> d-------- C:\Program Files\Fichiers communs\Java
2007-10-31 09:17 <REP> d--h----- C:\Program Files\System-A
2007-10-31 09:17 33,792 --a------ C:\WINDOWS\system32\hgggged.dll
2007-10-31 09:16 8,704 --a------ C:\syszgoq.exe
2007-10-30 18:04 <REP> d-------- C:\Team17
2007-10-30 11:36 <REP> d-------- C:\Program Files\Photo DVD Maker Professional
2007-10-29 10:19 <REP> d-------- C:\Program Files\DAEMON Tools
2007-10-29 10:16 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-24 17:34 <REP> d-------- C:\Program Files\Securitoo
2007-10-24 03:35 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2007-10-24 03:15 <REP> d-------- C:\Documents and Settings\claude\Application Data\Leadertech
2007-10-23 20:52 <REP> d-------- C:\Documents and Settings\claude\Application Data\Azureus
2007-10-23 20:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2007-10-23 20:51 <REP> d-------- C:\Program Files\Azureus
2007-10-23 20:10 <REP> d-------- C:\Program Files\DVD Shrink
2007-10-23 20:10 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-10-23 18:20 <REP> d-------- C:\Documents and Settings\claude\Contacts
2007-10-23 18:15 <REP> d-------- C:\Program Files\MSN Messenger
2007-10-23 18:05 <REP> d-------- C:\Program Files\Windows Live
2007-10-23 18:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-23 18:02 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-10-23 18:00 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-10-23 17:59 <REP> d---s---- C:\Documents and Settings\claude\UserData
2007-10-23 17:39 94,208 --a------ C:\WINDOWS\system32\W32n50.dll
2007-10-23 17:39 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2007-10-23 17:39 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS
2007-10-23 17:37 <REP> d-------- C:\Program Files\Wanadoo
2007-10-20 00:01 <REP> d-------- C:\Documents and Settings\claude\Application Data\Steinberg
2007-10-19 23:56 <REP> d-------- C:\Program Files\Fichiers communs\Fellowes
2007-10-19 23:53 <REP> d-------- C:\Program Files\Pinnacle
2007-10-19 23:53 1,867,373 --a------ C:\WINDOWS\Recorder.reg
2007-10-19 23:53 2,423 --a------ C:\WINDOWS\NewRecorder.reg
2007-10-17 16:56 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2007-10-17 16:56 228,648 --a------ C:\WINDOWS\OptChecker.exe
2007-10-17 16:56 163,120 --a------ C:\WINDOWS\OptRemove.exe
2007-10-10 14:05 <REP> d-------- C:\Documents and Settings\claude\Application Data\AdobeUM
2007-10-10 13:49 <REP> d-------- C:\Documents and Settings\claude\Application Data\Teleca
2007-10-10 13:49 <REP> d-------- C:\Documents and Settings\claude\Application Data\Sony Ericsson
2007-10-10 13:48 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-10-10 13:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-10-10 13:47 <REP> d-------- C:\WINDOWS\Downloaded Installations
2007-10-10 13:47 <REP> d-------- C:\Program Files\Sony Ericsson
2007-10-10 13:47 <REP> d-------- C:\Program Files\Fichiers communs\Teleca Shared
2007-10-10 13:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Teleca
2007-10-10 13:44 90,768 -ra------ C:\WINDOWS\system32\drivers\se26unic.sys
2007-10-10 13:44 88,688 -ra------ C:\WINDOWS\system32\drivers\SE26mgmt.sys
2007-10-10 13:44 18,704 -ra------ C:\WINDOWS\system32\drivers\se26nd5.sys
2007-10-10 13:44 4,128 -ra------ C:\WINDOWS\system32\drivers\se26cr.sys
2007-10-10 13:43 97,184 -ra------ C:\WINDOWS\system32\drivers\SE26mdm.sys
2007-10-10 13:43 86,560 -ra------ C:\WINDOWS\system32\drivers\SE26obex.sys
2007-10-10 13:43 9,360 -ra------ C:\WINDOWS\system32\drivers\SE26mdfl.sys
2007-10-10 13:43 6,240 -ra------ C:\WINDOWS\system32\drivers\SE26cmnt.sys
2007-10-10 13:43 6,240 -ra------ C:\WINDOWS\system32\drivers\SE26cm.sys
2007-10-10 13:42 61,600 -ra------ C:\WINDOWS\system32\drivers\SE26bus.sys
2007-10-10 13:42 5,872 -ra------ C:\WINDOWS\system32\drivers\SE26whnt.sys
2007-10-10 13:42 5,872 -ra------ C:\WINDOWS\system32\drivers\se26wh.sys
2007-10-05 21:13 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-30 17:04 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-10-30 13:57 1,786 ----a-w C:\Documents and Settings\claude\Application Data\wklnhst.dat
2007-10-29 09:15 --------- d-----w C:\Program Files\D-Tools
2007-10-23 20:35 --------- d-----w C:\Program Files\Google
2007-10-14 10:50 --------- d-----w C:\Program Files\Picture It! Premium 10
2007-10-05 20:13 --------- d-----w C:\Program Files\EA GAMES
1999-08-18 14:36 135,168 -c--a-w C:\WINDOWS\inf\AGFA\message.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{563D9576-840E-13DC-8324-0900201C9A61}]
2007-10-31 09:17 95232 --a------ C:\Program Files\System-A\ie-improver.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-08-02 15:35]
"nwiz"="nwiz.exe" [2005-08-02 15:35 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-08-02 15:35]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 14:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-09-10 17:29 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-09-15 10:20 C:\WINDOWS\ALCWZRD.EXE]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 19:33]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-11-10 15:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 22:45]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2007-04-10 22:46]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09]
"CursorXP"="C:\themeGold55\CursorXP\CursorXP.exe" [2001-12-13 19:00]
"InstantTray"="C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe" [2004-09-02 09:37]
"IW_Drop_Icon"="C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2004-07-30 14:10]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-25 20:01]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoLowDiskSpaceCheck"=1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"=1 (0x1)
"NoLowDiskSpaceCheck"=1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 nwprovau C:\WINDOWS\system32\gebyy.dll

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe"
R3 Cap713x;Cap713x Video Capture;C:\WINDOWS\system32\DRIVERS\Cap713x.sys
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys
R3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys
S3 A_USBETHMP;USB PowerPacket Network Adapter;C:\WINDOWS\system32\Drivers\usbethmp.sys
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4fa9427-4600-11dc-afbd-000fea541fdd}]
\Shell\AutoRun\command - L:\LaunchU3.exe -a

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-01 11:50:32 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\WINDOWS\vVX1000.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 13:58:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-01 13:59:18 - machine was rebooted
.
--- E O F ---

voila le rapport combofix
je fai l rapport hijackthis mai je dois renommé quoi exactement?
merci

| Alerter

Répondre à lolodi63

XmichouX

1 Novembre 2007 13:23:32

Tu renommes :
C:\Documents and Settings\claude\Bureau\HijackThis.exe
Tu dois obtenir C:\Documents and Settings\claude\Bureau\Scanner.exe

| Alerter

Répondre à XmichouX

lolodi63

1 Novembre 2007 13:46:52

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:46:35, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\WINDOWS\system32\ctfmon.exe
C:\themeGold55\CursorXP\CursorXP.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\claude\Bureau\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: System-A - {563D9576-840E-13DC-8324-0900201C9A61} - C:\Program Files\System-A\ie-improver.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\themeGold55\CursorXP\CursorXP.exe -s
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Cont...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 6876 bytes

voila le rapport hijackthis j'ai renommédanc c:/...bureau hijackthis.exe en Scanner.exe c'est bien sa?

merci encore!

| Alerter

Répondre à lolodi63

XmichouX

1 Novembre 2007 14:16:49

Télécharge ZebRestore
Dézippe-le. Ouvre le dossier, lance le en double cliquant sur l’exe.
Coche :
- Policies
- Sites de confiance et sensibles
- Préfixes et Protocoles Internet :
- Réinitialiser Fichier Hosts
Clique sur Restaurer. Ferme le programme.

Copie le texte se situant dans le cadre ci-dessous :

File::
C:\syszgoq.exe

Folder::
C:\Program Files\System-A
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{563D9576-840E-13DC-8324-0900201C9A61}]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

Ouvre le Bloc-Notes puis colle le texte copié.
(Démarrer\Tous les programmes\Accessoires\Bloc notes.)
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :

Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
S'il n'y a pas de rédémarrage, poste quand même les rapports.

| Alerter

Répondre à XmichouX

lolodi63

1 Novembre 2007 14:34:12

voila le rapport combofix:

ComboFix 07-11-01.1 - claude 2007-11-01 15:28:21.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.248 [GMT 1:00]
Running from: C:\Documents and Settings\claude\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\claude\Bureau\CFScript.txt
* Created a new restore point

FILE::
C:\syszgoq.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\System-A
C:\Program Files\System-A\bho.dat
C:\Program Files\System-A\er.dat
C:\Program Files\System-A\ie-improver.dll
C:\Program Files\System-A\uninstall.exe
C:\syszgoq.exe
C:\VundoFix Backups

.
((((((((((((((((((((((((((((( Fichiers créés 2007-10-01 to 2007-11-01 ))))))))))))))))))))))))))))))))))))
.

2007-11-01 15:21 <REP> d-------- C:\Program Files\Eidos Interactive
2007-11-01 15:18 <REP> d-------- C:\Program Files\PowerISO
2007-11-01 12:04 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-10-31 16:18 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2007-10-31 16:18 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2007-10-31 16:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-10-31 16:18 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-10-31 16:16 1,966,312 --a------ C:\WINDOWS\system32\drivers\VX1000.sys
2007-10-31 16:16 709,992 --a------ C:\WINDOWS\vVX1000.exe
2007-10-31 16:16 476,520 --a------ C:\WINDOWS\vVX1000.dll
2007-10-31 16:16 202,088 --a------ C:\WINDOWS\system32\LCCoin14.dll
2007-10-31 16:16 185,704 --a------ C:\WINDOWS\system32\cVX1000.dll
2007-10-31 16:16 116,072 --a------ C:\WINDOWS\VX1000.dll
2007-10-31 16:14 <REP> d-------- C:\Program Files\Microsoft LifeCam
2007-10-31 15:54 <REP> d-------- C:\WINDOWS\system32\drivers\umdf
2007-10-31 14:44 <REP> d-------- C:\WINDOWS\Sun
2007-10-31 14:43 <REP> d-------- C:\Program Files\Java
2007-10-31 14:43 <REP> d-------- C:\Program Files\Fichiers communs\Java
2007-10-31 09:17 33,792 --a------ C:\WINDOWS\system32\hgggged.dll
2007-10-30 18:04 <REP> d-------- C:\Team17
2007-10-30 11:36 <REP> d-------- C:\Program Files\Photo DVD Maker Professional
2007-10-29 10:19 <REP> d-------- C:\Program Files\DAEMON Tools
2007-10-29 10:16 685,816 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-24 17:34 <REP> d-------- C:\Program Files\Securitoo
2007-10-24 03:35 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2007-10-24 03:15 <REP> d-------- C:\Documents and Settings\claude\Application Data\Leadertech
2007-10-23 20:52 <REP> d-------- C:\Documents and Settings\claude\Application Data\Azureus
2007-10-23 20:52 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2007-10-23 20:51 <REP> d-------- C:\Program Files\Azureus
2007-10-23 20:10 <REP> d-------- C:\Program Files\DVD Shrink
2007-10-23 20:10 <REP> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-10-23 18:20 <REP> d-------- C:\Documents and Settings\claude\Contacts
2007-10-23 18:15 <REP> d-------- C:\Program Files\MSN Messenger
2007-10-23 18:05 <REP> d-------- C:\Program Files\Windows Live
2007-10-23 18:05 <REP> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-10-23 18:02 <REP> d--h----- C:\WINDOWS\$hf_mig$
2007-10-23 18:00 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2007-10-23 17:59 <REP> d---s---- C:\Documents and Settings\claude\UserData
2007-10-23 17:39 94,208 --a------ C:\WINDOWS\system32\W32n50.dll
2007-10-23 17:39 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2007-10-23 17:39 16,128 --------- C:\WINDOWS\system32\PCANDIS5.SYS
2007-10-23 17:37 <REP> d-------- C:\Program Files\Wanadoo
2007-10-20 00:01 <REP> d-------- C:\Documents and Settings\claude\Application Data\Steinberg
2007-10-19 23:56 <REP> d-------- C:\Program Files\Fichiers communs\Fellowes
2007-10-19 23:53 <REP> d-------- C:\Program Files\Pinnacle
2007-10-19 23:53 1,867,373 --a------ C:\WINDOWS\Recorder.reg
2007-10-19 23:53 2,423 --a------ C:\WINDOWS\NewRecorder.reg
2007-10-17 16:56 <REP> d--h----- C:\Program Files\InstallShield Installation Information
2007-10-17 16:56 228,648 --a------ C:\WINDOWS\OptChecker.exe
2007-10-17 16:56 163,120 --a------ C:\WINDOWS\OptRemove.exe
2007-10-10 14:05 <REP> d-------- C:\Documents and Settings\claude\Application Data\AdobeUM
2007-10-10 13:49 <REP> d-------- C:\Documents and Settings\claude\Application Data\Teleca
2007-10-10 13:49 <REP> d-------- C:\Documents and Settings\claude\Application Data\Sony Ericsson
2007-10-10 13:48 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-10-10 13:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-10-10 13:47 <REP> d-------- C:\WINDOWS\Downloaded Installations
2007-10-10 13:47 <REP> d-------- C:\Program Files\Sony Ericsson
2007-10-10 13:47 <REP> d-------- C:\Program Files\Fichiers communs\Teleca Shared
2007-10-10 13:47 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Teleca
2007-10-10 13:44 90,768 -ra------ C:\WINDOWS\system32\drivers\se26unic.sys
2007-10-10 13:44 88,688 -ra------ C:\WINDOWS\system32\drivers\SE26mgmt.sys
2007-10-10 13:44 18,704 -ra------ C:\WINDOWS\system32\drivers\se26nd5.sys
2007-10-10 13:44 4,128 -ra------ C:\WINDOWS\system32\drivers\se26cr.sys
2007-10-10 13:43 97,184 -ra------ C:\WINDOWS\system32\drivers\SE26mdm.sys
2007-10-10 13:43 86,560 -ra------ C:\WINDOWS\system32\drivers\SE26obex.sys
2007-10-10 13:43 9,360 -ra------ C:\WINDOWS\system32\drivers\SE26mdfl.sys
2007-10-10 13:43 6,240 -ra------ C:\WINDOWS\system32\drivers\SE26cmnt.sys
2007-10-10 13:43 6,240 -ra------ C:\WINDOWS\system32\drivers\SE26cm.sys
2007-10-10 13:42 61,600 -ra------ C:\WINDOWS\system32\drivers\SE26bus.sys
2007-10-10 13:42 5,872 -ra------ C:\WINDOWS\system32\drivers\SE26whnt.sys
2007-10-10 13:42 5,872 -ra------ C:\WINDOWS\system32\drivers\se26wh.sys
2007-10-05 21:13 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-01 14:22 28,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 17:04 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-10-30 13:57 1,786 ----a-w C:\Documents and Settings\claude\Application Data\wklnhst.dat
2007-10-29 09:15 --------- d-----w C:\Program Files\D-Tools
2007-10-23 20:35 --------- d-----w C:\Program Files\Google
2007-10-14 10:50 --------- d-----w C:\Program Files\Picture It! Premium 10
2007-10-05 20:13 --------- d-----w C:\Program Files\EA GAMES
1999-08-18 14:36 135,168 -c--a-w C:\WINDOWS\inf\AGFA\message.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-01_13.58.54.68 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-01 14:22:08 36,864 ----a-r C:\WINDOWS\Installer\{735D1B9F-A9A4-4FF2-A830-96C150883B97}\_81E4513.exe
+ 2006-05-20 10:15:25 30,588 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 09:50]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-08-02 15:35]
"nwiz"="nwiz.exe" [2005-08-02 15:35 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-08-02 15:35]
"Raccourci vers la page des propriétés de High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 14:10 C:\WINDOWS\system32\Hdaudpropshortcut.exe]
"SoundMan"="SOUNDMAN.EXE" [2004-09-10 17:29 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2004-09-15 10:20 C:\WINDOWS\ALCWZRD.EXE]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 16:17]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe" [2005-06-23 19:33]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2003-11-10 15:06]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 22:45]
"VX1000"="C:\WINDOWS\vVX1000.exe" [2007-04-10 22:46]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-05-20 11:13]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:09]
"CursorXP"="C:\themeGold55\CursorXP\CursorXP.exe" [2001-12-13 19:00]
"InstantTray"="C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe" [2004-09-02 09:37]
"IW_Drop_Icon"="C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe" [2004-07-30 14:10]
"WOOKIT"="C:\PROGRA~1\Wanadoo\Shell.exe" []
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:55]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-25 20:01]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 12:24]

C:\Documents and Settings\All Users\Menu Démarrer\Programmes\Démarrage\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 11:01:04]

R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys
R1 vobiw;vobiw;C:\WINDOWS\system32\drivers\vobiw.sys
R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe"
R3 Cap713x;Cap713x Video Capture;C:\WINDOWS\system32\DRIVERS\Cap713x.sys
R3 cdrdrv;Cdrdrv;C:\WINDOWS\system32\Drivers\Cdrdrv.sys
R3 VX1000;VX-1000;C:\WINDOWS\system32\DRIVERS\VX1000.sys
S3 A_USBETHMP;USB PowerPacket Network Adapter;C:\WINDOWS\system32\Drivers\usbethmp.sys
S3 PCASp50;PCASp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\PCASp50.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e4fa9427-4600-11dc-afbd-000fea541fdd}]
\Shell\AutoRun\command - L:\LaunchU3.exe -a

.
Contenu du dossier 'Scheduled Tasks/Tâches planifiées'
"2007-11-01 11:50:32 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_vVX1000_exe.job"
- C:\WINDOWS\vVX1000.exe
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-01 15:31:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-01 15:32:11 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-01 13:59
.
--- E O F ---

effectivement sa a redemarré!lol! puis voici le rapport hijackthis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:34:45, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\themeGold55\CursorXP\CursorXP.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\claude\Bureau\Scanner.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\themeGold55\CursorXP\CursorXP.exe -s
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [WOOKIT] C:\PROGRA~1\Wanadoo\Shell.exe appLaunchClientZone.shl|PARAM= cnx
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Cont...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 6917 bytes

voila!! je vous remercie pour toute cette aide que serai devenu mon pc sans vous.... mort!!! mdr merci !

| Alerter

Répondre à lolodi63

XmichouX

1 Novembre 2007 14:54:37

Comment se comprte ton pc ?

Télécharge sur ton bureau : Clean
Dézippe le sur ton bureau. Double-clic sur ce dossier clean.
Double-clic sur clean.cmd. Cela va ouvrir une fenêtre noire.
Un menu va apparaître, choisis l'option 1 puis entrée. Ensuite appuies sur une touche comme il te sera demandé et poste le rapport ici.
Le rapport se trouve ici : C:\rapport_clean.txt
Tuto

| Alerter

Répondre à XmichouX

lolodi63

1 Novembre 2007 15:20:37

jeu. 01/11/2007 a 16:19:22,65

*** Recherche des fichiers dans C:

*** Recherche des fichiers dans C:\WINDOWS\

*** Recherche des fichiers dans C:\WINDOWS\system32

*** Recherche des fichiers dans C:\Program Files
*** Fin du rapport !

voila le rappport ! sa va mieux j'ai plus de pub !!il es gueri? non pas deja si? merci encore en tout cas!

| Alerter

Répondre à lolodi63

XmichouX

1 Novembre 2007 19:25:59

Télécharge ccleaner (>>tuto à lire !<<), tu download «the latest version » puis installe le en décochant - Ajouter la Barre d'Outils Yahoo! CCleaner
Puis lance le nettoyage, puis fais chercher des erreurs et sauvegardes si tu le souhaites.

Télécharge et installe Antivir. (tuto)
Pourquoi changer ? Avast vs Antivir
Vérifie qu’il soit bien à jour ! Fais une analyse complète, poste le rapport

| Alerter

Répondre à XmichouX

lolodi63

3 Novembre 2007 17:47:38

bonjour,
desolé du temps j'etais pas chez moi depuis hier voila la raison du temps entre mon dernier post et celui ci!
donc je suis en train de telecherger antivir et je voudrai savoir comment faire pour poster le rapport une fois mon analyse faite?
merci beaucoup de votre aide!!

| Alerter

Répondre à lolodi63

XmichouX

3 Novembre 2007 18:13:12

Tu posteras le rapport

Copier coller, tu verras

| Alerter

Répondre à XmichouX

lolodi63

3 Novembre 2007 19:34:00

AntiVir PersonalEdition Classic
Report file date: samedi 3 novembre 2007 20:00

Scanning for 913479 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: CLAUDE

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 18:57:56
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 18:57:57
ANTIVIR2.VDF : 7.0.0.140 940544 Bytes 26/10/2007 18:57:57
ANTIVIR3.VDF : 7.0.0.165 129536 Bytes 2/11/2007 18:57:57
AVEWIN32.DLL : 7.6.0.30 3056128 Bytes 3/11/2007 18:57:57
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 3/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 8/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 7/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: D:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: off
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: samedi 3 novembre 2007 20:00

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'WLLoginProxy.exe' - '1' Module(s) have been scanned
Scan process 'iexplore.exe' - '1' Module(s) have been scanned
Scan process 'gain_trickler_3202.exe' - '1' Module(s) have been scanned
Scan process 'usnsvc.exe' - '1' Module(s) have been scanned
Scan process 'wscntfy.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'slserv.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'MSCamS32.exe' - '1' Module(s) have been scanned
Scan process 'epmworker.exe' - '1' Module(s) have been scanned
Scan process 'Generic.exe' - '1' Module(s) have been scanned
Scan process 'CapabilityManager.exe' - '1' Module(s) have been scanned
Scan process 'daemon.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'iwctrl.exe' - '1' Module(s) have been scanned
Scan process 'PCLETray.exe' - '1' Module(s) have been scanned
Scan process 'CursorXP.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'vVX1000.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'apdproxy.exe' - '1' Module(s) have been scanned
Scan process 'Application Launcher.exe' - '1' Module(s) have been scanned
Scan process 'ALCWZRD.EXE' - '1' Module(s) have been scanned
Scan process 'SOUNDMAN.EXE' - '1' Module(s) have been scanned
Scan process 'rundll32.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
44 processes with 44 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!
Boot sector 'D:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '33' files ).

Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\upload_moi_CLAUDE.tar.gz
[0] Archive type: GZ
--> upload_moi.tar
[1] Archive type: TAR (tape archiver)
--> qoobox/Quarantine/C/syszgoq.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.BHO.A.1.A
--> qoobox/Quarantine/C/WINDOWS/system32/gebyy.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
--> qoobox/Quarantine/C/WINDOWS/system32/puequavo.exe.vir
[DETECTION] Is the Trojan horse TR/Fotomoto.E
--> qoobox/Quarantine/C/WINDOWS/system32/sysdl132.exe.vir
[DETECTION] Is the Trojan horse TR/Drop.BHO.A.1
--> qoobox/Quarantine/C/WINDOWS/system32/ygjbckna.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
--> qoobox/Quarantine/C/WINDOWS/system32/__c0065BA.dat.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
--> qoobox/Quarantine/catchme2007-11-01_135826.17.zip
[2] Archive type: ZIP
--> __c0065BA.dat
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
--> gebyy.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
--> WINDOWS/System32/hgggged.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was deleted!
C:\qoobox\Quarantine\catchme2007-11-01_135826.17.zip
[0] Archive type: ZIP
--> __c0065BA.dat
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
--> gebyy.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was deleted!
C:\qoobox\Quarantine\C\syszgoq.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.BHO.A.1.A
[INFO] The file was deleted!
C:\qoobox\Quarantine\C\WINDOWS\system32\gebyy.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was deleted!
C:\qoobox\Quarantine\C\WINDOWS\system32\puequavo.exe.vir
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[INFO] The file was moved to '4791c885.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\sysdl132.exe.vir
[DETECTION] Is the Trojan horse TR/Drop.BHO.A.1
[INFO] The file was moved to '479fc88c.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\ygjbckna.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '4796c87c.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\__c0065BA.dat.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '478fc876.qua'!
C:\System Volume Information\_restore{112D0E54-EDD9-4447-BF32-466807F8C151}\RP2\A0000005.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.E
[INFO] The file was moved to '475cc85f.qua'!
C:\System Volume Information\_restore{112D0E54-EDD9-4447-BF32-466807F8C151}\RP2\A0000008.dll
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '475cc861.qua'!
C:\System Volume Information\_restore{112D0E54-EDD9-4447-BF32-466807F8C151}\RP2\A0000012.exe
[DETECTION] Is the Trojan horse TR/Drop.BHO.A.1
[INFO] The file was moved to '475cc864.qua'!
C:\System Volume Information\_restore{112D0E54-EDD9-4447-BF32-466807F8C151}\RP2\A0000016.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '475cc866.qua'!
C:\System Volume Information\_restore{112D0E54-EDD9-4447-BF32-466807F8C151}\RP4\A0000079.exe
[DETECTION] Is the Trojan horse TR/Dldr.BHO.A.1.A
[INFO] The file was moved to '475cc86d.qua'!
C:\Team17\Worms World Party\wwp-nocd-sp1-fr.exe
[DETECTION] Is the Trojan horse TR/Dldr.Small.bws.20
[INFO] The file was moved to '479cc8c0.qua'!
C:\Team17\Worms World Party\data\wwp-nocd-sp1-fr.zip
[0] Archive type: ZIP
--> wwp-nocd-sp1-fr.exe
[DETECTION] Is the Trojan horse TR/Dldr.Small.bws.20
[INFO] The file was moved to '479cc8ce.qua'!
C:\WINDOWS\system32\hgggged.dll
[DETECTION] Is the Trojan horse TR/Vundo.Gen
[INFO] The file was moved to '4793caa3.qua'!
C:\WINDOWS\system32\drivers\sptd.sys
[WARNING] The file could not be opened!
Begin scan in 'D:\'
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0001636.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbaf.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0001644.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbb2.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003007.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbba.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003010.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbbe.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003018.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbc1.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003019.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbc4.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003021.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbc8.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003022.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbcb.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003025.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbce.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003026.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbd2.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003032.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbd5.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003033.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbd7.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003039.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbe0.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003040.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbe3.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003043.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbe6.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003047.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbe8.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003255.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbf1.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003256.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbf4.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003261.EXE
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbf6.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003268.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbf8.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003271.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbfb.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003275.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbfe.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003280.EXE
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccbff.qua'!
D:\System Volume Information\_restore{BAEBC347-EE44-4FCB-A31A-EE2333B68D49}\RP5\A0003312.exe
[DETECTION] Contains detection pattern of the Windows virus W32/Sality.L
[INFO] The file was moved to '475ccc01.qua'!

End of the scan: samedi 3 novembre 2007 20:28
Used time: 28:06 min

The scan has been done completely.

2765 Scanning directories
166980 Files were scanned
49 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
4 files were deleted
0 files were repaired
36 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
166931 Files not concerned
1033 Archives were scanned
2 Warnings
15 Notes

voila le rapport de antivir si sé sa mé il ma demandé plusieur fois des trucs je sais pas si ce qe j'ai fait es bon...

| Alerter

Répondre à lolodi63

XmichouX

3 Novembre 2007 21:04:12

Vide la quarantaine.
Où en sont tes problèmes ?

| Alerter

Répondre à XmichouX

lolodi63

4 Novembre 2007 18:12:41

bonjour
ok mon pc ralenti et la il etait alumé toute la journée et jai voulu m'en servir une page bleue s'est affichée et g du carrement debranché le pc pour pouvoir le redemarré g cru qil allait pas s'allumé...

| Alerter

Répondre à lolodi63

XmichouX

4 Novembre 2007 18:33:40

Reposte un hIjackthis.

| Alerter

Répondre à XmichouX

lolodi63

4 Novembre 2007 18:53:48

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:55:02, on 4/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\program files\divx\divx pro codec\gain_trickler_3202.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\themeGold55\CursorXP\CursorXP.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\windows media player\wmplayer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Trickler] "c:\program files\divx\divx pro codec\gain_trickler_3202.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\themeGold55\CursorXP\CursorXP.exe -s
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Fichiers communs\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Cont...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 7704 bytes

voila et merci encore!

| Alerter

Répondre à lolodi63

XmichouX

4 Novembre 2007 19:25:23

Pourtant c'est bon.

Relance HiJackThis, do a system scan only, coche ces lignes :

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

Puis Fix Checked !

Fais une analyse antivirus en ligne sur Kaspersky avec Internet Explorer. (Tuto)
Autorise les active x.
Clique sur Démarrer Online Scanner.
Sélectionne le poste de travail comme analyse. Enregistres sous le rapport en format .txt.
Colle son rapport ici.

Puis reposte un Hijackthis.

| Alerter

Répondre à XmichouX

lolodi63

4 Novembre 2007 22:30:31

-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Sunday, November 04, 2007 11:29:22 PM
Système d'exploitation : Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version : 5.0.83.0
Dernière mise à jour de la base antivirus Kaspersky : 4/11/2007
Enregistrements dans la base antivirus Kaspersky : 423706
-------------------------------------------------------------------------------

Paramètres d'analyse:
Analyser avec la base antivirus suivante: standard
Analyser les archives: vrai
Analyser les bases de messagerie: vrai

Cible de l'analyse - Poste de travail:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\
M:\
N:\

Statistiques de l'analyse:
Total d'objets analysés: 45243
Nombre de virus trouvés: 1
Nombre d'objets infectés: 2 / 0
Nombre d'objets suspects: 0
Durée de l'analyse: 01:34:24

Nom de l'objet infecté / Nom du virus / Dernière action
C:\Documents and Settings\claude\Application Data\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Cookies\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Messenger\lolodi63@hotmail.fr\SharingMetadata\Logs\Dfsr00005.log L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Messenger\lolodi63@hotmail.fr\SharingMetadata\pending.dat L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Messenger\lolodi63@hotmail.fr\SharingMetadata\Working\database_98F0_939A_F093_7CE6\dfsr.db L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Messenger\lolodi63@hotmail.fr\SharingMetadata\Working\database_98F0_939A_F093_7CE6\fsr.log L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Messenger\lolodi63@hotmail.fr\SharingMetadata\Working\database_98F0_939A_F093_7CE6\fsrtmp.log L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Messenger\lolodi63@hotmail.fr\SharingMetadata\Working\database_98F0_939A_F093_7CE6\tmp.edb L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Windows Live Contacts\lolodi63@hotmail.fr\real\members.stg L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Application Data\Microsoft\Windows Live Contacts\lolodi63@hotmail.fr\shadow\members.stg L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Historique\History.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Temp\~DF504D.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Temp\~DF545E.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Temp\~DF5EE3.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Temp\~DF5F0E.tmp L'objet est verrouillé ignoré
C:\Documents and Settings\claude\Local Settings\Temporary Internet Files\Content.IE5\index.dat L'objet est verrouillé ignoré
C:\Documents and Settings\claude\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\claude\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\LocalService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\NTUSER.DAT L'objet est verrouillé ignoré
C:\Documents and Settings\NetworkService\ntuser.dat.LOG L'objet est verrouillé ignoré
C:\qoobox\Quarantine\C\Program Files\System-A\ie-improver.dll.vir Infecté : Trojan-Downloader.Win32.BHO.bo ignoré
C:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré
C:\System Volume Information\_restore{112D0E54-EDD9-4447-BF32-466807F8C151}\RP4\A0000077.dll Infecté : Trojan-Downloader.Win32.BHO.bo ignoré
C:\System Volume Information\_restore{112D0E54-EDD9-4447-BF32-466807F8C151}\RP8\change.log L'objet est verrouillé ignoré
C:\WINDOWS\Debug\PASSWD.LOG L'objet est verrouillé ignoré
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log L'objet est verrouillé ignoré
C:\WINDOWS\Sti_Trace.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\edb.log L'objet est verrouillé ignoré
C:\WINDOWS\system32\CatRoot2\tmp.edb L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\AppEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\default.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SAM.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SecEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SECURITY.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\software.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\SysEvent.Evt L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system L'objet est verrouillé ignoré
C:\WINDOWS\system32\config\system.LOG L'objet est verrouillé ignoré
C:\WINDOWS\system32\drivers\sptd.sys L'objet est verrouillé ignoré
C:\WINDOWS\system32\h323log.txt L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA L'objet est verrouillé ignoré
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP L'objet est verrouillé ignoré
C:\WINDOWS\wiadebug.log L'objet est verrouillé ignoré
C:\WINDOWS\wiaservc.log L'objet est verrouillé ignoré
C:\WINDOWS\WindowsUpdate.log L'objet est verrouillé ignoré
D:\System Volume Information\MountPointManagerRemoteDatabase L'objet est verrouillé ignoré

Analyse terminée.

voila le rapport kaspersky

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:31:23, on 4/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\vVX1000.exe
C:\program files\divx\divx pro codec\gain_trickler_3202.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\themeGold55\CursorXP\CursorXP.exe
C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe
C:\Program Files\Fichiers communs\Teleca Shared\CapabilityManager.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Fichiers communs\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.orange.fr
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Fichiers communs\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Raccourci vers la page des propriétés de High Definition Audio] HDAudPropShortcut.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Edition Découverte\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [Trickler] "c:\program files\divx\divx pro codec\gain_trickler_3202.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CursorXP] C:\themeGold55\CursorXP\CursorXP.exe -s
O4 - HKCU\..\Run: [InstantTray] C:\Program Files\Pinnacle\Shared Files\InstantCDDVD\PCLETray.exe
O4 - HKCU\..\Run: [IW_Drop_Icon] C:\Program Files\Pinnacle\InstantCDDVD\InstantWrite\iwctrl.exe /DropDisc
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://webscanner.kaspersky.fr/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1FF43AD5-2262-4C2F-81D4-26D710C3F305} (VB2S Mannequin Virtuel Control) - http://mannequin.redoute.fr/activex/Mannequin.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Cont...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Co...
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Windows Live Setup Service (WLSetupSvc) - Unknown owner - C:\Program Files\Windows Live\installer\WLSetupSvc.exe

--
End of file - 7155 bytes
et le rapport kaspersky

voila merci ecore !!!

| Alerter

Répondre à lolodi63

XmichouX

4 Novembre 2007 22:38:54

Désactive-réactive la restauration système

Désinstalle, supprime tous les logiciels utilisés pour la désinfection ainsi que les dossiers créés correspondants.. Garde ccleaner, avg et antivir si nous les avons installé..
Rapporte ton infection sur Malware Complaints
Tuto
Ton infection :Vundo

Tojours des problèmes ?

| Alerter

Répondre à XmichouX

lolodi63

5 Novembre 2007 01:13:28

non je ne crois pas avoir encore des problemes mais je pensais sa lautre fois et aujordui c'est revenu...
merci de votre aide sinon il es gueri ? lol!
merci encore