Spywares.

Bonjour,

Pas complet le rapport  

Pardon:

SmitFraudFix v2.253

Rapport fait à 16:45:32,15, 15/11/2007
Executé à partir de C:\Documents and Settings\JrmY\Bureau\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [version 5.1.2600] - Windows_NT
Le type du système de fichiers est NTFS
Fix executé en mode normal

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Fichiers communs\BestsellerAntivirus\bm.exe
C:\WINDOWS\system32\wdigqitp.exe
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\AutoCAD 2006\acad.exe
C:\DOCUME~1\JrmY\LOCALS~1\Temp\AdskCleanup.0001
C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Fichiers communs\Autodesk Shared\WSCommCntr1.exe
C:\Program Files\Adobe\Photoshop CS\Photoshop.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts


»»»»»»»»»»»»»»»»»»»»»»»» C:\


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\JrmY


»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\JrmY\Application Data


»»»»»»»»»»»»»»»»»»»»»»»» Menu Démarrer


»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\JrmY\Favoris


»»»»»»»»»»»»»»»»»»»»»»»» Bureau


»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


»»»»»»»»»»»»»»»»»»»»»»»» Clés corrompues


»»»»»»»»»»»»»»»»»»»»»»»» Eléments du bureau

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Ma page d'accueil"


»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\WINDOWS\\system32\\__c009E341.dat"
"LoadAppInit_DLLs"=dword:00000001


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, les clés qui suivent ne sont pas forcément infectées!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Rustock



»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/100 VE Network Connection - Miniport d'ordonnancement de paquets
DNS Server Search Order: 192.168.1.200
DNS Server Search Order: 194.117.200.10

HKLM\SYSTEM\CCS\Services\Tcpip\..\{B0C4D5D9-89E6-4072-9D69-78284C3F0E34}: NameServer=192.168.1.200,194.117.200.10
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B0C4D5D9-89E6-4072-9D69-78284C3F0E34}: NameServer=192.168.1.200,194.117.200.10
HKLM\SYSTEM\CS3\Services\Tcpip\..\{B0C4D5D9-89E6-4072-9D69-78284C3F0E34}: NameServer=192.168.1.200,194.117.200.10


»»»»»»»»»»»»»»»»»»»»»»»» Recherche infection wininet.dll


»»»»»»»»»»»»»»»»»»»»»»»» Fin

C'est une infection Vundo  

Télécharge combofix.exe (par sUBs) sur ton Bureau.

Double clique combofix.exe.

Tape sur la touche 1 (Yes) pour démarrer le scan.

Lorsque le scan sera complété, un rapport apparaîtra. Copie/colle ce rapport dans ta prochaine réponse.

NOTE : Le rapport se trouve également ici : C:\Combofix.txt

ComboFix 07-11-08.1 - JrmY 2007-11-15 17:17:54.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1297 [GMT 1:00]
Running from: C:\Documents and Settings\JrmY\Bureau\ComboFix.exe
* Created a new restore point
.

Incapable d'obtenir les privilèges Système

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
C:\Documents and Settings\JrmY\Application Data\BestsellerAntivirus
C:\Documents and Settings\JrmY\Application Data\BestsellerAntivirus\avtasks.dat
C:\Documents and Settings\JrmY\Application Data\BestsellerAntivirus\Logs\av.log
C:\Documents and Settings\JrmY\Application Data\BestsellerAntivirus\Logs\ga6Support.log
C:\Documents and Settings\JrmY\Application Data\BestsellerAntivirus\Logs\update.log
C:\Documents and Settings\JrmY\Bureau\Live Safety Center.lnk
C:\Documents and Settings\JrmY\Bureau\Online Security Guide.lnk
C:\Documents and Settings\JrmY\Favoris\Online Security Guide.lnk
C:\Program Files\BestsellerAntivirus
C:\Program Files\BestsellerAntivirus\Tools\IEFWBHO.old
C:\Program Files\Fichiers communs\BestsellerAntivirus
C:\Program Files\Fichiers communs\BestsellerAntivirus\bm.exe
C:\Program Files\Fichiers communs\Yazzle1848OinUninstaller.exe
C:\UGA6P
C:\WINDOWS\system32\__c009E341.dat
C:\WINDOWS\system32\__c00FBF31.dat
C:\WINDOWS\system32\_000111_.tmp.dll
C:\WINDOWS\system32\aaandrhh.dllbox
C:\WINDOWS\system32\cvpmuino.dll
C:\WINDOWS\system32\eykyiuvi.dll
C:\WINDOWS\system32\jkkll.dll
C:\WINDOWS\system32\llkkj.bak1
C:\WINDOWS\system32\llkkj.bak2
C:\WINDOWS\system32\llkkj.ini
C:\WINDOWS\system32\lsuugfyt.dll
C:\WINDOWS\system32\ystem~1
C:\WINDOWS\system32\ystem~1\w?nspool.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-15 to 2007-11-15 ))))))))))))))))))))))))))))))))))))
.

2007-11-15 17:16 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-15 12:57 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-15 12:57 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-11-15 12:57 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-11-15 12:57 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-15 12:57 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-15 12:57 3,314 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-15 09:55 85,056 --a------ C:\WINDOWS\system32\jwlydbmp.dll
2007-11-15 09:55 79,936 --a------ C:\WINDOWS\system32\keemkauw.dll
2007-11-15 09:52 71,232 --a------ C:\WINDOWS\system32\wdigqitp.exe
2007-11-15 09:46 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-14 09:31 144,480 --a------ C:\WINDOWS\system32\aaandrhh.dll
2007-11-14 09:30 144,480 --a------ C:\WINDOWS\system32\sstmcbcj.dll
2007-11-14 09:24 81,472 --a------ C:\WINDOWS\system32\aytyetuf.dll
2007-11-14 09:18 71,232 --a------ C:\WINDOWS\system32\fhfbckdf.exe
2007-11-14 03:06 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-14 03:02 <REP> d-------- C:\Program Files\MSXML 4.0
2007-11-13 17:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Nero
2007-11-13 16:59 <REP> d-------- C:\Program Files\Nero
2007-11-13 16:59 <REP> d-------- C:\Program Files\Fichiers communs\Nero
2007-11-13 16:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-11-13 12:52 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-13 12:19 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\AdobeUM
2007-11-13 12:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-11-13 10:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision
2007-11-13 09:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2007-11-12 18:01 <REP> d-------- C:\WINDOWS\system32\Adobe
2007-11-12 18:01 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-11-12 17:53 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2007-11-12 17:52 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2007-11-12 17:21 <REP> d-------- C:\Program Files\Google
2007-11-12 16:49 <REP> d-------- C:\Program Files\Mozilla Thunderbird
2007-11-12 16:49 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Thunderbird
2007-11-12 16:49 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Talkback
2007-11-12 16:37 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Apple Computer
2007-11-12 16:36 <REP> d-------- C:\Program Files\iTunes
2007-11-12 16:36 <REP> d-------- C:\Program Files\iPod
2007-11-12 16:36 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2007-11-12 16:36 <REP> d-------- C:\Program Files\Apple Software Update
2007-11-12 16:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-12 16:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-12 16:08 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-12 16:08 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-12 15:59 <REP> d-------- C:\Program Files\MSBuild
2007-11-12 15:59 <REP> d-------- C:\Program Files\Microsoft.NET
2007-11-12 15:59 <REP> d-------- C:\Program Files\Fichiers communs\ODBC
2007-11-12 15:56 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-11-12 15:56 <REP> dr-h----- C:\MSOCache
2007-11-12 15:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-12 15:51 <REP> d-------- C:\Program Files\ffdshow
2007-11-12 15:50 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Media Player Classic
2007-11-12 15:48 <REP> d-------- C:\Program Files\Windows Live
2007-11-12 15:48 <REP> d-------- C:\Program Files\Messenger Plus! Live
2007-11-12 15:41 <REP> d-------- C:\Documents and Settings\JrmY\Contacts
2007-11-12 15:40 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-11-12 15:38 <REP> d-------- C:\Program Files\MSN Messenger
2007-11-12 15:27 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-11-12 14:32 <REP> d-------- C:\WINDOWS\Sun
2007-11-12 12:45 <REP> d-------- C:\Program Files\AnswerWorks 4.0
2007-11-12 12:44 <REP> d-------- C:\Program Files\AutoCAD 2006
2007-11-12 12:44 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Autodesk
2007-11-12 12:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk
2007-11-12 12:31 <REP> d-------- C:\Program Files\Fichiers communs\Autodesk Shared
2007-11-12 12:31 <REP> d-------- C:\Program Files\Autodesk
2007-11-12 12:18 <REP> d-------- C:\Program Files\Alwil Software
2007-11-12 12:18 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-12 12:18 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-11-12 12:18 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-12 12:18 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-12 12:18 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-12 12:18 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-12 12:18 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-12 12:12 <REP> d-------- C:\Program Files\7-Zip
2007-11-12 12:02 <REP> d-------- C:\WINDOWS\SchCache
2007-11-12 10:55 151,602 --------- C:\WINDOWS\system32\pspnt.dll
2007-11-12 10:55 65,606 --------- C:\WINDOWS\system32\rmvport.exe
2007-11-12 10:54 <REP> d-------- C:\Program Files\Hewlett-Packard
2007-11-12 10:53 40,960 --a------ C:\WINDOWS\HPLTLNK1.EXE
2007-11-12 10:53 32,768 --a------ C:\WINDOWS\system32\HPLTLM.DLL
2007-11-12 10:50 <REP> d--h----- C:\_rpcs
2007-11-12 10:34 <REP> d-------- C:\Program Files\SymNetDrv
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\Voisinage r‚seau
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\Voisinage d'impression
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\ModŠles
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Mes documents
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Menu D‚marrer
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Favoris
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Bureau
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\You've Got Pictures Screensaver
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Symantec
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Jasc Software Inc
2007-11-12 10:01 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-11-12 10:01 108,544 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-11-12 10:01 104,960 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-11-12 09:54 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-11-12 09:54 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-11-12 09:53 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 09:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-13 09:13 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-11-12 15:36 --------- d-----w C:\Program Files\QuickTime
2007-11-12 14:59 --------- d-----w C:\Program Files\Microsoft Works
2007-11-12 11:02 --------- d-----w C:\Program Files\Symantec
2007-11-12 11:02 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-12 11:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-12 09:22 --------- d-----w C:\Program Files\Fichiers communs\Sonic Shared
2007-11-12 09:19 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-11-12 09:19 --------- d-----w C:\Program Files\CyberLink
2007-11-12 09:15 --------- d-----w C:\Program Files\Fichiers communs\AOL
2007-11-12 09:14 --------- d-----w C:\Program Files\Dell
2007-11-12 09:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-09-24 08:05 132,904 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
2007-09-24 08:05 11,304 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
2007-09-20 08:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-09-20 08:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{265abae0-3e54-4060-8e4e-3c51e1b409de}]
2007-11-15 09:55 79936 --a------ C:\WINDOWS\system32\keemkauw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2007-11-14 09:31 144480 --a------ C:\WINDOWS\system32\aaandrhh.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"= C:\WINDOWS\system32\aaandrhh.dll [2007-11-14 09:31 144480]

[HKEY_CLASSES_ROOT\CLSID\{11A69AE4-FBED-4832-A2BF-45AF82825583}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-08 23:57]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-04-25 08:50]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 00:20 C:\WINDOWS\stsystra.exe]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" []
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 09:51]
"9c457bf2"="C:\WINDOWS\system32\jwlydbmp.dll" [2007-11-15 09:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 12:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-09-20 15:35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\aaandrhh]
aaandrhh.dll 2007-11-14 09:31 144480 C:\WINDOWS\system32\aaandrhh.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\jkkll.dll

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-12 15:36:25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-13 22:45:00 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 17:45:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-15 17:46:49 - machine was rebooted
.
--- E O F ---

Re,

Télécharge VundoFix.exe (par Atribune) sur ton Bureau.

Double-clique VundoFix.exe afin de le lancer

Clique sur le bouton Scan for Vundo

Lorsque le scan est complété, clique sur le bouton Remove Vundo

Une invite te demandera si tu veux supprimer les fichiers, clique YES

Après avoir cliqué "Yes", le Bureau disparaîtra un moment lors de la suppression des fichiers

Tu verras une invite qui t'annonce que ton PC va redémarrer; clique OK

Copie/colle le contenu du rapport situé dans C:\vundofix.txt ainsi qu'un nouveau rapport HijackThis dans ta prochaine réponse
Note: Il est possible que VundoFix soit confronté à un fichier qu'il ne peut supprimer. Si tel est le cas, l'outil se lancera au prochain redémarrage; il faut simplement suivre les instructions ci-haut, à partir de "clique sur le bouton Scan for Vundo".

VundoFix V6.6.1

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 18:26:41 15/11/2007

Listing files found while scanning....

C:\WINDOWS\system32\aaandrhh.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\aaandrhh.dll
C:\WINDOWS\system32\aaandrhh.dll Has been deleted!

Performing Repairs to the registry.
Done!

Reposte un rapport Hijackthis.

pardon,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:45:27, on 15/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\DOCUME~1\JrmY\LOCALS~1\Temp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.fr/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.fr/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: {ed904b1e-15c3-e4e8-0604-45e30eaba562} - {265abae0-3e54-4060-8e4e-3c51e1b409de} - C:\WINDOWS\system32\keemkauw.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [9c457bf2] rundll32.exe "C:\WINDOWS\system32\jwlydbmp.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = maast.local
O17 - HKLM\Software\..\Telephony: DomainName = maast.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0C4D5D9-89E6-4072-9D69-78284C3F0E34}: NameServer = 192.168.1.200,194.117.200.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)

--
End of file - 6818 bytes

Refais un scan Combofix  

Et voilà suffit de demander, dans tous les cas merci pour la rapidité et la précision des réponses.

ComboFix 07-11-08.1 - JrmY 2007-11-15 19:04:05.2 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1546 [GMT 1:00]
Running from: C:\Documents and Settings\JrmY\Bureau\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Menu Démarrer\Live Safety Center.lnk
C:\Documents and Settings\All Users\Menu Démarrer\Online Security Guide.lnk
C:\Documents and Settings\JrmY\Bureau\Live Safety Center.lnk
C:\Documents and Settings\JrmY\Bureau\Online Security Guide.lnk
C:\Documents and Settings\JrmY\Favoris\Online Security Guide.lnk
C:\WINDOWS\system32\aaandrhh.dllbox

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-15 to 2007-11-15 ))))))))))))))))))))))))))))))))))))
.

2007-11-15 18:26 <REP> d-------- C:\VundoFix Backups
2007-11-15 17:16 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-15 12:57 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-15 12:57 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-11-15 12:57 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-11-15 12:57 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-15 12:57 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-15 12:57 3,314 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-15 09:55 85,056 --a------ C:\WINDOWS\system32\jwlydbmp.dll
2007-11-15 09:55 79,936 --a------ C:\WINDOWS\system32\keemkauw.dll
2007-11-15 09:52 71,232 --a------ C:\WINDOWS\system32\wdigqitp.exe
2007-11-15 09:46 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-11-14 09:30 144,480 --a------ C:\WINDOWS\system32\sstmcbcj.dll
2007-11-14 09:24 81,472 --a------ C:\WINDOWS\system32\aytyetuf.dll
2007-11-14 09:18 71,232 --a------ C:\WINDOWS\system32\fhfbckdf.exe
2007-11-14 03:06 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-14 03:02 <REP> d-------- C:\Program Files\MSXML 4.0
2007-11-13 17:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Nero
2007-11-13 16:59 <REP> d-------- C:\Program Files\Nero
2007-11-13 16:59 <REP> d-------- C:\Program Files\Fichiers communs\Nero
2007-11-13 16:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-11-13 12:52 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-13 12:19 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\AdobeUM
2007-11-13 12:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-11-13 10:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision
2007-11-13 09:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2007-11-12 18:01 <REP> d-------- C:\WINDOWS\system32\Adobe
2007-11-12 18:01 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-11-12 17:53 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2007-11-12 17:52 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2007-11-12 17:21 <REP> d-------- C:\Program Files\Google
2007-11-12 16:49 <REP> d-------- C:\Program Files\Mozilla Thunderbird
2007-11-12 16:49 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Thunderbird
2007-11-12 16:49 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Talkback
2007-11-12 16:37 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Apple Computer
2007-11-12 16:36 <REP> d-------- C:\Program Files\iTunes
2007-11-12 16:36 <REP> d-------- C:\Program Files\iPod
2007-11-12 16:36 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2007-11-12 16:36 <REP> d-------- C:\Program Files\Apple Software Update
2007-11-12 16:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-12 16:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-12 16:08 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-12 16:08 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-12 15:59 <REP> d-------- C:\Program Files\MSBuild
2007-11-12 15:59 <REP> d-------- C:\Program Files\Microsoft.NET
2007-11-12 15:59 <REP> d-------- C:\Program Files\Fichiers communs\ODBC
2007-11-12 15:56 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-11-12 15:56 <REP> dr-h----- C:\MSOCache
2007-11-12 15:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-12 15:51 <REP> d-------- C:\Program Files\ffdshow
2007-11-12 15:50 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Media Player Classic
2007-11-12 15:48 <REP> d-------- C:\Program Files\Windows Live
2007-11-12 15:48 <REP> d-------- C:\Program Files\Messenger Plus! Live
2007-11-12 15:41 <REP> d-------- C:\Documents and Settings\JrmY\Contacts
2007-11-12 15:40 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-11-12 15:38 <REP> d-------- C:\Program Files\MSN Messenger
2007-11-12 15:27 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-11-12 14:32 <REP> d-------- C:\WINDOWS\Sun
2007-11-12 12:45 <REP> d-------- C:\Program Files\AnswerWorks 4.0
2007-11-12 12:44 <REP> d-------- C:\Program Files\AutoCAD 2006
2007-11-12 12:44 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Autodesk
2007-11-12 12:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk
2007-11-12 12:31 <REP> d-------- C:\Program Files\Fichiers communs\Autodesk Shared
2007-11-12 12:31 <REP> d-------- C:\Program Files\Autodesk
2007-11-12 12:18 <REP> d-------- C:\Program Files\Alwil Software
2007-11-12 12:18 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-12 12:18 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-11-12 12:18 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-12 12:18 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-12 12:18 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-12 12:18 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-12 12:18 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-12 12:12 <REP> d-------- C:\Program Files\7-Zip
2007-11-12 12:02 <REP> d-------- C:\WINDOWS\SchCache
2007-11-12 10:55 151,602 --------- C:\WINDOWS\system32\pspnt.dll
2007-11-12 10:55 65,606 --------- C:\WINDOWS\system32\rmvport.exe
2007-11-12 10:54 <REP> d-------- C:\Program Files\Hewlett-Packard
2007-11-12 10:53 40,960 --a------ C:\WINDOWS\HPLTLNK1.EXE
2007-11-12 10:53 32,768 --a------ C:\WINDOWS\system32\HPLTLM.DLL
2007-11-12 10:50 <REP> d--h----- C:\_rpcs
2007-11-12 10:34 <REP> d-------- C:\Program Files\SymNetDrv
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\Voisinage r‚seau
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\Voisinage d'impression
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\ModŠles
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Mes documents
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Menu D‚marrer
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Favoris
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Bureau
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\You've Got Pictures Screensaver
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Symantec
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Jasc Software Inc
2007-11-12 10:01 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-11-12 10:01 108,544 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-11-12 10:01 104,960 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-11-12 09:54 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-11-12 09:54 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-11-12 09:53 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 09:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-13 09:13 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-11-12 15:36 --------- d-----w C:\Program Files\QuickTime
2007-11-12 14:59 --------- d-----w C:\Program Files\Microsoft Works
2007-11-12 11:02 --------- d-----w C:\Program Files\Symantec
2007-11-12 11:02 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-12 11:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-12 09:22 --------- d-----w C:\Program Files\Fichiers communs\Sonic Shared
2007-11-12 09:19 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-11-12 09:19 --------- d-----w C:\Program Files\CyberLink
2007-11-12 09:15 --------- d-----w C:\Program Files\Fichiers communs\AOL
2007-11-12 09:14 --------- d-----w C:\Program Files\Dell
2007-11-12 09:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-09-24 08:05 132,904 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
2007-09-24 08:05 11,304 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
2007-09-20 08:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-09-20 08:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-15_17.46.29.53 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-19 21:49:47 8,509,952 ------w C:\WINDOWS\system32\shell32.dll
+ 2007-10-25 16:56:24 8,510,976 ----a-w C:\WINDOWS\system32\shell32.dll
- 2007-08-21 10:53:25 121,856 ------w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 15:35:14 121,856 ----a-w C:\WINDOWS\system32\xpsp3res.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{265abae0-3e54-4060-8e4e-3c51e1b409de}]
2007-11-15 09:55 79936 --a------ C:\WINDOWS\system32\keemkauw.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-08 23:57]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-04-25 08:50]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 00:20 C:\WINDOWS\stsystra.exe]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" []
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 09:51]
"9c457bf2"="C:\WINDOWS\system32\jwlydbmp.dll" [2007-11-15 09:55]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 12:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-09-20 15:35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"=1 (0x1)

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-12 15:36:25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-13 22:45:00 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-15 19:07:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-15 19:08:09 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-15 17:46
.
--- E O F ---

Re,

[#ff0000]Désactive ton antivirus ![/#f]

Copie (Ctrl+C) le texte se situant dans le cadre ci-dessous :



Ouvre le Bloc-Notes puis colle (Ctrl+V) le texte précedemment copié.
Sauvegarde ce fichier sous le nom de CFScript.txt.

Glisse maintenant le fichier CFScript.txt dans Combofix.exe comme ci-dessous :


Cela va relancer Combofix, tape sur 1 puis valide. Après redémarrage, poste le contenu du rapport Combofix.txt accompagné d'un rapport Hijackthis.
[#ff0000]NOTE : S'il n'y a pas de rédémarrage, poste quand même les rapports demandés.[/#f]

ComboFix 07-11-08.1 - JrmY 2007-11-16 9:44:04.3 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.1496 [GMT 1:00]
Running from: C:\Documents and Settings\JrmY\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\JrmY\Bureau\CFScript.txt..txt
* Created a new restore point

FILE
C:\WINDOWS\system32\aytyetuf.dll
C:\WINDOWS\system32\fhfbckdf.exe
C:\WINDOWS\system32\jwlydbmp.dll
C:\WINDOWS\system32\keemkauw.dll
C:\WINDOWS\system32\msxml3a.dll
C:\WINDOWS\system32\sstmcbcj.dll
C:\WINDOWS\system32\wdigqitp.exe
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\aytyetuf.dll
C:\WINDOWS\system32\fhfbckdf.exe
C:\WINDOWS\system32\jwlydbmp.dll
C:\WINDOWS\system32\keemkauw.dll
C:\WINDOWS\system32\msxml3a.dll
C:\WINDOWS\system32\sstmcbcj.dll
C:\WINDOWS\system32\wdigqitp.exe

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2007-10-16 to 2007-11-16 ))))))))))))))))))))))))))))))))))))
.

2007-11-15 18:26 <REP> d-------- C:\VundoFix Backups
2007-11-15 17:16 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-15 12:57 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2007-11-15 12:57 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-11-15 12:57 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-11-15 12:57 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-15 12:57 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2007-11-15 12:57 3,314 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-14 03:06 <REP> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-11-14 03:02 <REP> d-------- C:\Program Files\MSXML 4.0
2007-11-13 17:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Nero
2007-11-13 16:59 <REP> d-------- C:\Program Files\Nero
2007-11-13 16:59 <REP> d-------- C:\Program Files\Fichiers communs\Nero
2007-11-13 16:59 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-11-13 12:52 584,192 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-11-13 12:19 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\AdobeUM
2007-11-13 12:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2007-11-13 10:16 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Macrovision
2007-11-13 09:41 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2007-11-12 18:01 <REP> d-------- C:\WINDOWS\system32\Adobe
2007-11-12 18:01 16,384 --a------ C:\WINDOWS\system32\FileOps.exe
2007-11-12 17:53 <REP> d-------- C:\Program Files\Fichiers communs\Adobe Systems Shared
2007-11-12 17:52 <REP> d-------- C:\Program Files\Fichiers communs\Adobe
2007-11-12 17:21 <REP> d-------- C:\Program Files\Google
2007-11-12 16:49 <REP> d-------- C:\Program Files\Mozilla Thunderbird
2007-11-12 16:49 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Thunderbird
2007-11-12 16:49 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Talkback
2007-11-12 16:37 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Apple Computer
2007-11-12 16:36 <REP> d-------- C:\Program Files\iTunes
2007-11-12 16:36 <REP> d-------- C:\Program Files\iPod
2007-11-12 16:36 <REP> d-------- C:\Program Files\Fichiers communs\Apple
2007-11-12 16:36 <REP> d-------- C:\Program Files\Apple Software Update
2007-11-12 16:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-11-12 16:36 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2007-11-12 16:08 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-11-12 16:08 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2007-11-12 15:59 <REP> d-------- C:\Program Files\MSBuild
2007-11-12 15:59 <REP> d-------- C:\Program Files\Microsoft.NET
2007-11-12 15:59 <REP> d-------- C:\Program Files\Fichiers communs\ODBC
2007-11-12 15:56 <REP> d-------- C:\WINDOWS\SHELLNEW
2007-11-12 15:56 <REP> dr-h----- C:\MSOCache
2007-11-12 15:56 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-11-12 15:51 <REP> d-------- C:\Program Files\ffdshow
2007-11-12 15:50 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Media Player Classic
2007-11-12 15:48 <REP> d-------- C:\Program Files\Windows Live
2007-11-12 15:48 <REP> d-------- C:\Program Files\Messenger Plus! Live
2007-11-12 15:41 <REP> d-------- C:\Documents and Settings\JrmY\Contacts
2007-11-12 15:40 <REP> d----c--- C:\WINDOWS\system32\DRVSTORE
2007-11-12 15:38 <REP> d-------- C:\Program Files\MSN Messenger
2007-11-12 15:27 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-11-12 14:32 <REP> d-------- C:\WINDOWS\Sun
2007-11-12 12:45 <REP> d-------- C:\Program Files\AnswerWorks 4.0
2007-11-12 12:44 <REP> d-------- C:\Program Files\AutoCAD 2006
2007-11-12 12:44 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Autodesk
2007-11-12 12:44 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk
2007-11-12 12:31 <REP> d-------- C:\Program Files\Fichiers communs\Autodesk Shared
2007-11-12 12:31 <REP> d-------- C:\Program Files\Autodesk
2007-11-12 12:18 <REP> d-------- C:\Program Files\Alwil Software
2007-11-12 12:18 801,144 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-11-12 12:18 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-11-12 12:18 94,416 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-11-12 12:18 92,848 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-11-12 12:18 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-11-12 12:18 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-11-12 12:18 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-11-12 12:12 <REP> d-------- C:\Program Files\7-Zip
2007-11-12 12:02 <REP> d-------- C:\WINDOWS\SchCache
2007-11-12 10:55 151,602 --------- C:\WINDOWS\system32\pspnt.dll
2007-11-12 10:55 65,606 --------- C:\WINDOWS\system32\rmvport.exe
2007-11-12 10:54 <REP> d-------- C:\Program Files\Hewlett-Packard
2007-11-12 10:53 40,960 --a------ C:\WINDOWS\HPLTLNK1.EXE
2007-11-12 10:53 32,768 --a------ C:\WINDOWS\system32\HPLTLM.DLL
2007-11-12 10:50 <REP> d--h----- C:\_rpcs
2007-11-12 10:34 <REP> d-------- C:\Program Files\SymNetDrv
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\Voisinage r‚seau
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\Voisinage d'impression
2007-11-12 10:01 <REP> d--h----- C:\Documents and Settings\JrmY\ModŠles
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Mes documents
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Menu D‚marrer
2007-11-12 10:01 <REP> dr------- C:\Documents and Settings\JrmY\Favoris
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Bureau
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\You've Got Pictures Screensaver
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Symantec
2007-11-12 10:01 <REP> d-------- C:\Documents and Settings\JrmY\Application Data\Jasc Software Inc
2007-11-12 10:01 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-11-12 10:01 108,544 --------- C:\WINDOWS\system32\pxcpyi64.exe
2007-11-12 10:01 104,960 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-11-12 09:54 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-11-12 09:54 12,288 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-11-12 09:53 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 09:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-13 09:13 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2007-11-12 15:36 --------- d-----w C:\Program Files\QuickTime
2007-11-12 14:59 --------- d-----w C:\Program Files\Microsoft Works
2007-11-12 11:02 --------- d-----w C:\Program Files\Symantec
2007-11-12 11:02 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2007-11-12 11:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-12 09:22 --------- d-----w C:\Program Files\Fichiers communs\Sonic Shared
2007-11-12 09:19 --------- d-----w C:\Program Files\Fichiers communs\Real
2007-11-12 09:19 --------- d-----w C:\Program Files\CyberLink
2007-11-12 09:15 --------- d-----w C:\Program Files\Fichiers communs\AOL
2007-11-12 09:14 --------- d-----w C:\Program Files\Dell
2007-11-12 09:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2007-09-24 08:05 132,904 ----a-w C:\WINDOWS\system32\drivers\imagesrv.sys
2007-09-24 08:05 11,304 ----a-w C:\WINDOWS\system32\drivers\imagedrv.sys
2007-09-20 08:59 972,072 ----a-w C:\WINDOWS\UNRecode.exe
2007-09-20 08:55 972,072 ----a-w C:\WINDOWS\UNNeroMediaHome.exe
.

((((((((((((((((((((((((((((( snapshot@2007-11-15_17.46.29.53 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-19 21:49:47 8,509,952 ------w C:\WINDOWS\system32\shell32.dll
+ 2007-10-25 16:56:24 8,510,976 ----a-w C:\WINDOWS\system32\shell32.dll
- 2007-08-21 10:53:25 121,856 ------w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 15:35:14 121,856 ----a-w C:\WINDOWS\system32\xpsp3res.dll
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-08 23:57]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-04-25 08:50]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-23 00:20 C:\WINDOWS\stsystra.exe]
"ISUSPM Startup"="C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe" []
"ISUSScheduler"="C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 20:16]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36]
"NeroFilterCheck"="C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 15:57]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 09:51]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 12:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:55]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe" [2007-09-20 15:35]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"=1 (0x1)

R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
S3 NAL;Nal Service ;\??\C:\WINDOWS\system32\Drivers\iqvw32.sys

.
Contenu du dossier 'Scheduled Tasks/Tƒches planifi‚es'
"2007-11-12 15:36:25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-11-13 22:45:00 C:\WINDOWS\Tasks\Rappel d'abonnement 1 auprès de l'ISP.job"
.
**************************************************************************

catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-16 09:48:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-11-16 9:48:44 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-15 19:08
C:\ComboFix3.txt ... 2007-11-15 17:46
.
--- E O F ---

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:50:01, on 16/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\JrmY\LOCALS~1\Temp\Répertoire temporaire 1 pour HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.fr/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.fr/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Assistant d'Acrobat.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = maast.local
O17 - HKLM\Software\..\Telephony: DomainName = maast.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0C4D5D9-89E6-4072-9D69-78284C3F0E34}: NameServer = 192.168.1.200,194.117.200.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)

--
End of file - 6534 bytes

Re,

Désinstalle correctement Avast! pour le remplacer par AntiVir.
Pourquoi changer ? Avast! vs AntiVir

Fais un scan complet puis poste le rapport en fin d'analyse.

AntiVir PersonalEdition Classic
Report file date: lundi 19 novembre 2007 09:43

Scanning for 933735 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic
Serial number: 0000149996-ADJIE-0001
Platform: Windows XP
Windows version: (Service Pack 2) [5.1.2600]
Username: SYSTEM
Computer name: JEREMY

Version information:
BUILD.DAT : 270 15603 Bytes 19/09/2007 13:32:00
AVSCAN.EXE : 7.0.6.1 290856 Bytes 23/08/2007 13:16:29
AVSCAN.DLL : 7.0.6.0 49192 Bytes 16/08/2007 12:23:51
LUKE.DLL : 7.0.5.3 147496 Bytes 14/08/2007 15:32:47
LUKERES.DLL : 7.0.6.1 10280 Bytes 21/08/2007 12:35:20
ANTIVIR0.VDF : 6.40.0.0 11030528 Bytes 18/07/2007 14:27:15
ANTIVIR1.VDF : 7.0.0.0 1640448 Bytes 13/09/2007 14:26:55
ANTIVIR2.VDF : 7.0.0.198 1206272 Bytes 11/11/2007 08:37:58
ANTIVIR3.VDF : 7.0.0.229 115200 Bytes 19/11/2007 08:37:58
AVEWIN32.DLL : 7.6.0.34 3125760 Bytes 19/11/2007 08:37:58
AVWINLL.DLL : 1.0.0.7 14376 Bytes 26/02/2007 10:36:26
AVPREF.DLL : 7.0.2.2 25640 Bytes 18/07/2007 07:39:17
AVREP.DLL : 7.0.0.1 155688 Bytes 16/04/2007 13:16:24
AVPACK32.DLL : 7.3.0.15 360488 Bytes 03/08/2007 08:46:00
AVREG.DLL : 7.0.1.6 30760 Bytes 18/07/2007 07:17:06
AVARKT.DLL : 1.0.0.20 278568 Bytes 28/08/2007 12:26:33
AVEVTLOG.DLL : 7.0.0.20 86056 Bytes 18/07/2007 07:10:18
NETNT.DLL : 7.0.0.0 7720 Bytes 08/03/2007 11:09:42
RCIMAGE.DLL : 7.0.1.30 2342952 Bytes 07/08/2007 12:38:13
RCTEXT.DLL : 7.0.62.0 86056 Bytes 21/08/2007 12:50:37
SQLITE3.DLL : 3.3.17.1 339968 Bytes 23/07/2007 09:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: off
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: Intelligent file selection
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Macro heuristic..................: on
File heuristic...................: medium

Start of the scan: lundi 19 novembre 2007 09:43

Starting search for hidden objects.
'55423' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'firefox.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'iPodService.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexStoreSvr.exe' - '1' Module(s) have been scanned
Scan process 'acrotray.exe' - '1' Module(s) have been scanned
Scan process 'NMIndexingService.exe' - '1' Module(s) have been scanned
Scan process 'NMBgMonitor.exe' - '1' Module(s) have been scanned
Scan process 'msnmsgr.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'iTunesHelper.exe' - '1' Module(s) have been scanned
Scan process 'issch.exe' - '1' Module(s) have been scanned
Scan process 'stsystra.exe' - '1' Module(s) have been scanned
Scan process 'IAAnotif.exe' - '1' Module(s) have been scanned
Scan process 'jucheck.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned
Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned
Scan process 'NBService.exe' - '1' Module(s) have been scanned
Scan process 'IAANTMon.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
37 processes with 37 modules were scanned

Start scanning boot sectors:
Boot sector 'C:\'
[NOTE] No virus was found!

Starting to scan the registry.
The registry was scanned ( '33' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
[WARNING] The file could not be opened!
C:\pagefile.sys
[WARNING] The file could not be opened!
C:\qoobox\Quarantine\catchme2007-11-15_174551.08.zip
[0] Archive type: ZIP
--> __c009E341.dat
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '47b55630.qua'!
C:\qoobox\Quarantine\C\Program Files\Fichiers communs\Yazzle1848OinUninstaller.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.PurityScan.EU
[INFO] The file was moved to '47bb5631.qua'!
C:\qoobox\Quarantine\C\Program Files\Fichiers communs\BestsellerAntivirus\bm.exe.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.593920
[INFO] The file was moved to '476f563d.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\aytyetuf.dll.vir
[DETECTION] Is the Trojan horse TR/BHO.XE
[INFO] The file was moved to '47b5564a.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\cvpmuino.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '47b15647.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\eykyiuvi.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '47ac564a.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\fhfbckdf.exe.vir
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[INFO] The file was moved to '47a75639.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\jkkll.dll.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '47ac563d.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\jwlydbmp.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.AU
[INFO] The file was moved to '47ad5649.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\keemkauw.dll.vir
[DETECTION] Is the Trojan horse TR/Vundo.79936
[INFO] The file was moved to '47a65637.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\lsuugfyt.dll.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '47b65646.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\sstmcbcj.dll.vir
[DETECTION] Is the Trojan horse TR/BHO.Agent.AW
[INFO] The file was moved to '47b55646.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\wdigqitp.exe.vir
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[INFO] The file was moved to '47aa5637.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\__c009E341.dat.vir
[DETECTION] Is the Trojan horse TR/Trash.Gen
[INFO] The file was moved to '47a45632.qua'!
C:\qoobox\Quarantine\C\WINDOWS\system32\__c00FBF31.dat.vir
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '47a45633.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP37\A0006904.exe
[DETECTION] Is the Trojan horse TR/Crypt.ULPM.Gen
[INFO] The file was moved to '4771566c.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP40\A0007645.exe
[DETECTION] Is the Trojan horse TR/Dldr.PurityScan.EU
[INFO] The file was moved to '47715684.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008742.exe
[DETECTION] Is the Trojan horse TR/Dldr.PurityScan.EU
[INFO] The file was moved to '47715688.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008744.dll
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '47715689.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008745.dll
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '460fc6da.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008746.dll
[DETECTION] Is the Trojan horse TR/Dldr.Agen.ZV.1.B
[INFO] The file was moved to '4771568b.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008747.exe
[DETECTION] Is the Trojan horse TR/Dldr.Agen.593920
[INFO] The file was moved to '4771568a.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008765.exe
[DETECTION] Is the Trojan horse TR/Dldr.WinFixer.AU
[INFO] The file was moved to '460fc6db.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008812.exe
[DETECTION] Contains detection pattern of the Phish-File/Email PHISH/FraudTool.BestSeller.A.4
[INFO] The file was moved to '4771568d.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008813.exe
[DETECTION] Is the Trojan horse TR/Dldr.PurityScan.EU
[INFO] The file was moved to '47715690.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008814.exe
[DETECTION] Is the Trojan horse TR/Dldr.PurityScan.EU
[INFO] The file was moved to '460fc6c1.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008815.exe
[DETECTION] Contains detection pattern of the dropper DR/PurityScan.FK.160
[INFO] The file was moved to '47715692.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008818.exe
[DETECTION] Is the Trojan horse TR/Dldr.WinFixer.AU
[INFO] The file was moved to '460fc6c3.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008828.exe
[DETECTION] Contains detection pattern of the dropper DR/PurityScan.FK.160
[INFO] The file was moved to '47715691.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0008839.dll
[DETECTION] Is the Trojan horse TR/Vundo.AU
[INFO] The file was moved to '47715694.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP42\A0009158.dll
[DETECTION] Is the Trojan horse TR/BHO.Agent.AW
[INFO] The file was moved to '47715699.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP44\A0009321.dll
[DETECTION] Is the Trojan horse TR/BHO.XE
[INFO] The file was moved to '4771569e.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP44\A0009322.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[INFO] The file was moved to '460fc6cf.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP44\A0009323.dll
[DETECTION] Is the Trojan horse TR/Vundo.AU
[INFO] The file was moved to '47715680.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP44\A0009324.dll
[DETECTION] Is the Trojan horse TR/Vundo.79936
[INFO] The file was moved to '4771569f.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP44\A0009326.dll
[DETECTION] Is the Trojan horse TR/BHO.Agent.AW
[INFO] The file was moved to '460fc6f0.qua'!
C:\System Volume Information\_restore{340C3340-2EBB-4324-859A-C37E85627171}\RP44\A0009327.exe
[DETECTION] Is the Trojan horse TR/Fotomoto.F.1
[INFO] The file was moved to '477156a1.qua'!
C:\VundoFix Backups\aaandrhh.dll.bad
[DETECTION] Is the Trojan horse TR/BHO.Agent.AW
[INFO] The file was moved to '47a256de.qua'!


End of the scan: lundi 19 novembre 2007 10:29
Used time: 46:32 min

The scan has been done completely.

8613 Scanning directories
314763 Files were scanned
38 viruses and/or unwanted programs were found
0 Files were classified as suspicious:
0 files were deleted
0 files were repaired
38 files were moved to quarantine
0 files were renamed
2 Files cannot be scanned
314725 Files not concerned
9390 Archives were scanned
2 Warnings
0 Notes
55423 Objects were scanned with rootkit scan
0 Hidden objects were found

Reposte un rapport Hijackthis.

Et voilà,

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:31:33, on 20/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jucheck.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Fichiers communs\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\JrmY\LOCALS~1\Temp\Répertoire temporaire 2 pour HiJackThis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://french.icrfast.com/index.php?rvs=hompag
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.fr/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.fr/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
O2 - BHO: Aide pour le lien d'Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\FICHIE~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Fichiers communs\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Fichiers communs\Nero\Lib\NMBgMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE RÉSEAU')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Accélérateur de démarrage AutoCAD.lnk = C:\Program Files\Fichiers communs\Autodesk Shared\acstart16.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Fichiers communs\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Post-it® Software Notes Lite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O8 - Extra context menu item: Ajouter au fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la cible du lien en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir la sélection en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convertir la sélection en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convertir les liens sélectionnés en Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en fichier Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convertir les liens sélectionnés en un fichier PDF existant - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Console Java (Sun) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = maast.local
O17 - HKLM\Software\..\Telephony: DomainName = maast.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0C4D5D9-89E6-4072-9D69-78284C3F0E34}: NameServer = 192.168.1.200,194.117.200.10
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Fichiers communs\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Fichiers communs\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Fichiers communs\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Fichiers communs\Symantec Shared\SNDSrvc.exe (file missing)

--
End of file - 9061 bytes

Re,

Fix les lignes dans le cadre ci-dessous avec Hijackthis : AIDE EN IMAGES

Merci beaucoup, tous les triangles jaunes ont disparu, et plus aucune fenêtres intempestives ne vient inonder mon écran. Seul un message d'erreur persiste, mais je ne serai dire si le problème vient de la même source que les précédents:

NMIndexStoreSvr.exe a rencontré un problème et doit fermer. Nous vous prions de nous excuser pour le désagrément encouru.

Quelle erreur ?

NMIndexStoreSvr.exe a rencontré un problème et doit fermer. Nous vous prions de nous excuser pour le désagrément encouru.

Tu as essayé réinstaller nero ?

Non je n'ai pas essayé, je le fais cette aprés-midi et je vous tiens au courant.

Ok  

Nero desinstallé, et problème oublié... Adieu Nero...
Merci Angeldark

Bon surf.

Bonjour,
Mon PC était en phase redémarrage, ce matin (attente mot de passe utilisateur).
Ensuite au lancement d'internet, d'accueil "tele2" remplacée par :
"french.icrfast.com/index.php?rvs=hompag" et la page de proposition de logiciel "google" avec les mentions:
"Téléchargement logiciel. Logiciels vérifiés pour les virus" etc....
Je pense qu'il peut y avoir un lien avec l'ouverture, par erreur, d'une pièce jointe avec la mention [courrier indésirable], il y a une semaine. Je suis protégé par AVAST.
1) quel est le risque ?
2) Quelqu'un a-t-il une solution ?
Merci de votre aide.
A+